U.S. Lawmaker Moves Ahead with Mobile Device Privacy Act

Editor’s note: The following is a guest post by Michael Essany.

On Tuesday, Capitol Hill was once again buzzing with talk of mobile devices and the consumer protection measures some lawmakers now believe are vital to implement.

Rep. Edward Markey (D-Mass) today was leading the charge to advance legislation aimed at bolstering mobile privacy safeguards for the millions of Americans who face potentially invasive privacy breaches from software makers and wireless providers.

Markey’s office has just released a discussion draft of the proposed Mobile Device Privacy Act, which, according to Markey, would require wireless operators and their partners to “notify subscribers if they employ mobile analytics measurement tools like the controversial Carrier IQ.”

The Carrier IQ software, if you are unfamiliar, is what’s known as a rootkit that is installed at a carrier’s request on mobile phones. Naturally, Carrier IQ raises user privacy concerns in light of the fact that it runs in the background and monitors and logs user activity.

As of late fall 2011, Carrier IQ was believed to be installed on more than 140 million mobile devices around the world. Prior to backing away from the software in response to vociferous public outcries, AT&T and Sprint asserted that the Carrier IQ software and its collected data were “only used as a means to improve service performance.”

Sprint and Apple have since disabled Carrier IQ across all handsets, while Verizon Wireless, Nokia, and Research In Motion deny having ever implemented Carrier IQ services on their devices.

Laying Down The Law

If Rep. Markey and many of his colleagues on the Hill have their druthers, The Mobile Device Privacy Act will pass into law and subsequently require disclosure of mobile phone monitoring software when a consumer buys a new device. The law would similarly mandate customer notification if the carrier, manufacturer or operating system later installs monitoring tools. Customer acknowledgement would even be required when downloading an app containing monitoring software.

Other protections would include:

• Third party receiving the personal information must have policies in place to secure the information.
• Agreements on transmission to third parties must be filed at the Federal Trade Commission (FTC) and Federal Communications Commission (FCC).
• Outline an enforcement regime for the FTC and FCC, along with State Attorney General enforcement and a private right of action.

Taking the safeguards one step further, Markey wants the act to mandate disclosure on the type of subscriber data that is collected, the identity of the third party to which the information is transmitted and how the info will be used.

“Consumers have the right to know and to say no to the presence of software on their mobile devices that can collect and transmit their personal and sensitive information,” Rep. Markey stated in written comments released to the press Tuesday.

Markey is the co-Chair of the Bi-Partisan Congressional Privacy Caucus and the former Chairman of the Subcommittee on Telecommunications and the Internet.

“While consumers rely on their phones, their phones relay all sorts of information about them, often without their knowledge or consent… Today I am releasing draft legislation to provide greater transparency into the transmission of consumers’ personal information and empower consumers to say no to such transmission,” he added.

To review the entire discussion draft of the proposed legislation, click here

Source: U.S. Rep Ed Markey