[Federal Register Volume 68, Number 121 (Tuesday, June 24, 2003)] [Notices] [Pages 37491-37494] From the Federal Register Online via the Government Publishing Office [www.gpo.gov] [FR Doc No: 03-15910] ======================================================================= ----------------------------------------------------------------------- FEDERAL TRADE COMMISSION Privacy Act Notice AGENCY: Federal Trade Commission (FTC). ACTION: Proposed notice of Privacy Act system amendments. ----------------------------------------------------------------------- SUMMARY: The FTC is establishing a Privacy Act system of records that will include telephone numbers and other information of individuals who do not wish to receive telemarketing calls from telemarketers, sellers or agents covered by the FTC's Telemarketing Sales Rule. This notice proposes amendments that describe how the system will apply to personal information, if any, collected from or compiled on telemarketers, sellers, or their agents in order to access the system. DATES: Comments, if any, must be received July 24, 2003. Unless revisions are made, this system notice shall become final and effective August 8, 2003. ADDRESSES: Mail comments, if any, to the Office of the Secretary, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580, ``Telemarketing Rulemaking--Comment, FTC File No. R411011.'' Please indicate that your comment pertains to ``Privacy Act System Amendments, National Do Not Call Registry--FTC.'' (Alternatively, you may submit your comment by electronic mail to [email protected], except as provided below.) The Commission will make this notice and, to the extent possible, all papers and comments received in electronic form in response to this notice available to the public through its Web site, http://www.ftc.gov. If your comment includes information that you believe is confidential, you must send it to the above postal address, not by e-mail, and you must include a specific request for confidential treatment that states the legal or factual basis for your claim and identifies the information you believe is confidential. See Commission Rule 4.9(c), 16 CFR 4.9(c). The Commission's General Counsel will grant or deny your request based on applicable law, regulation, and the public interest. Id. FOR FURTHER INFORMATION CONTACT: For information about this Privacy Act notice, contact Alex Tang, Attorney, Office of the General Counsel, FTC, 600 Pennsylvania Avenue, NW, Washington, DC 20580, (202) 326-2447, [email protected]. For information about the National Do Not Call Registry, contact David Torok, Attorney, Division of Marketing Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580, (202) 326-3075, [email protected]. SUPPLEMENTARY INFORMATION: Elsewhere in today's Federal Register, pursuant to the Privacy Act of 1974, as amended, 5 U.S.C. 552a, the Commission is publishing in final form its system notice for a new agency system of records, the ``National Do Not Call Registry System-- FTC'' (FTC-IV-3). The new system will collect and maintain the telephone numbers of individuals who do not wish to receive telemarketing calls from telemarketers, sellers, and agents, pursuant to the Commission's Telemarketing Sales Rule, 16 CFR Part 310, as amended. See 68 FR 4580 (Jan. 29, 2003) (final Rule amendments). The system is intended to help the FTC implement and enforce the do-not-call provisions of the Rule. The Privacy Act notice that the FTC is publishing for this system addresses the privacy of information that is submitted by or generated on individuals who choose to place their telephone numbers in the system so as not to receive telemarketing calls. Telemarketers, sellers, and their agents [[Page 37492]] will be separately required, however, to provide certain information to establish a payment account before they may access the National Do Not Call Registry to check their do-not-call lists against the list of telephone numbers maintained in the Registry at that time, as the Rule requires. The information they submit may include, for example, the name of a contact person, that person's telephone number and e-mail address, a credit card or bank account number that, in certain cases, may be assigned to an individual, etc. See 68 FR 16238, 16244 (Apr. 3, 2003) (revised user fee proposal). This information may also be associated with and retrieved by other information that the system may automatically generate when the telemarketer, seller, or agent accesses the system, such as the date and time of access, or the area code(s) or group(s) of telephone numbers that the telemarketer, seller, or agent downloads from the system. Although the information submitted by, or that the system otherwise compiles on, telemarketers, sellers, and their agents may include information about, or could be otherwise associated with, certain individuals, as described above, the information pertains to such individuals only in a non-personal capacity (e.g., as employees, company officials, etc.) acting or designated to act on behalf of a telemarketer, seller, or agent. In the Commission's view, the information does not pertain to such individuals within the meaning of the Privacy Act, but instead pertains to the telemarketer, seller, or agent that was required to submit the information in order to pay for and obtain authorized access to the system. Nonetheless, to the extent, if any, the Privacy Act applies to this information, the Commission proposes to amend its Privacy Act notice to address the collection, maintenance and use of personal information, if any, compiled from telemarketers, sellers, or agents when they pay for and access the Registry. The proposed amendments are incorporated into the text of the notice below. Privacy Impact Assessment. Section 208 of the E-Government Act of 2002, Pub. L. No. 107-347, generally requires that agencies assess the privacy impact of collecting personally identifiable information online before initiating such a collection activity or developing or procuring the technology to do so. Section 208 did not take effect until after the Commission initiated and legally adopted the Rule amendments that established the National Do Not Call Registry, and after the Commission started developing and procuring the technology for accepting do-not- call registrations online. Nevertheless, we have assessed the privacy impact of the system as discussed below. (The Commission's Chief Information Officer or other designated official has reviewed this assessment.) 1. What information will we be collecting? See ``Categories of records'' below. 2. Why are we collecting this information? See ``Purpose(s),'' ``Routine Uses,'' and ``Disclosure to Consumer Reporting Agencies'' below. 3. How do we intend to use the information? See ``Purpose(s),'' ``Routine Uses,'' and ``Disclosure to Consumer Reporting Agencies'' below. 4. With whom will we share the information? See ``Purpose(s),'' ``Routine Uses,'' and ``Disclosure to Consumer Reporting Agencies'' below. 5. What notice or opportunities for consent will individuals have about what information we collect and how we share it? This notice explains what information we collect from telemarketers, sellers, and their agents, and how we share it. 6. How will the information be secured? See ``Safeguards'' below. The Web site through which telemarketers, sellers, and agents will be required to submit information to establish a payment account will use secure socket layer (SSL) encryption. Once they have submitted the required information, telemarketers, sellers, and agents will be assigned account numbers or other identifiers in order to obtain subsequent access to the system. 7. Does this create a system of records subject to the Privacy Act of 1974, as amended? As explained above, the information to be collected from telemarketers, sellers, and their agents pertains to them, and not to any individual whose name or other personal identifier may be submitted as part of such information. Therefore, the Commission does not believe the Privacy Act applies to the collection, maintenance or use of the information. Nonetheless, the Commission has proposed to amend its Privacy Act system notice, as set forth below, to the extent, if any, that the Act applies to that information. FTC-IV-3 System Name: National Do Not Call Registry System-FTC (FTC-IV-3) Security Classification: Not applicable. System Location: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. System records may be maintained, in whole or part, off-site by contractors. Categories of individuals covered by the system: Individuals who notify the Commission that they do not wish to receive telemarketing calls. Individuals whose names or other identifiers (e.g., e-mail addresses) are included in the information that telemarketers, sellers, or their agents must submit to pay for and obtain access to the system are covered by this system only to the extent, if any, that the Privacy Act applies to that information. Categories of records in the system: Telephone numbers of individuals who do not wish to receive telemarketing calls; information automatically generated by the system, including date and/or time that the telephone number was placed on or removed from the Registry; and other information that the individual may be asked to provide voluntarily (such as e-mail address, if the individual registers through the National Do Not Call Registry Web site). Telemarketers, sellers, and their agents are separately required to submit information to pay for and obtain authorized access to the system, including the names of, or other identifiers that may be associated with, individuals (e.g., name of contact person, name of the person to whom the credit card is issued, e-mail address, etc.). Such information is not part of this system except to the extent, if any, that the Privacy Act applies to the agency's collection, maintenance and retrieval of the information. Authority for maintenance of the system: Federal Trade Commission Act, 15 U.S.C. 41 et seq., Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. 6101-6108; Do- Not-Call Implementation Act, Pub. L. No. 108-10 (2003). Purpose(s): To maintain records of the telephone numbers of individuals who do not wish to receive telemarketing calls; to disclose such records to telemarketers, sellers, and their agents in order for them to reconcile their do-not-call lists with the Registry and comply with the do-not- call provisions of the Commission's Telemarketing Sales Rule, 16 CFR Part 310; to enable the Commission and other law enforcement officials to determine whether a [[Page 37493]] company is complying with the Rule; to provide statistical data that may lead to or be incorporated into law enforcement investigations and litigation; or for other law enforcement, regulatory or informational purposes. Information submitted by or compiled on telemarketers, sellers, and their agents is used for purposes of fee collection, authorizing their access to the system, and related purposes and uses as described in this notice. Routine uses of records: Records from this system may be disclosed as permitted by 5 U.S.C. 552a(b), and, as authorized by 5 U.S.C. 552a(b)(3), in accordance with the routine uses announced by the Commission in Appendix I of its system notice applicable to all other agency Privacy Act systems of records (57 FR 45678), as may be revised and updated from time to time. Additional routine uses for records in this system are as follows, provided that no routine use specified either herein or in Appendix I shall be construed to limit or waive any other routine use published for this system: a. Telephone numbers, but not any e-mail addresses, submitted by individuals may be made available or referred on an automatic or other basis to telemarketers, sellers, and their agents for the purpose of determining or verifying that an individual does not wish to receive telemarketing calls; b. Records may be made available or referred on an automatic or other basis to other federal, state, or local government authorities for regulatory, compliance, or law enforcement purposes. c. Information submitted by or compiled on telemarketers, sellers, and their agents may be used as described in paragraph b. above, and, to the extent not covered by that paragraph, for payment or billing purposes, including referral to debt collection agencies or other governmental entities for collection, tax reporting, or other related purposes, consistent with the Privacy Act. Information that is submitted by or compiled on telemarketers, sellers, and their agents and that is incorporated into the PAY.GOV system shall also be subject to routine uses, if any, that may be separately published for that system. Disclosure to consumer reporting agencies: Not applicable, except for information submitted by or otherwise compiled on telemarketers, sellers, and their agents, which may be disclosed as described above. Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system: Storage: Stored in a computer database maintained on magnetic disks and tape, or other electronic systems determined by the Commission in consultation with staff or contractors. Retrievability: Indexed by area code and phone number of individuals who have informed the Commission that they do not wish to receive telemarketing calls. May also be retrieved by other data, if any, compiled or otherwise maintained with the record. For information submitted by or compiled on telemarketers, sellers, or their agents, records may be indexed and retrieved by any category of data that is submitted by or compiled on such telemarketers, sellers, or agents. Safeguards: Access to computerized records by electronic security precautions. Access generally restricted to those agency personnel and contractors whose responsibilities require access, or to approved telemarketers, sellers, and their agents. (See also ``Purposes'' and ``Routine Uses'' above to learn how information may be used or disclosed.) Retention and disposal: Automated information retained indefinitely, until deleted pursuant to request by the subject individual, or deleted automatically after certain period of time, to be determined by the Commission. System manager and address: National Do Not Call Registry Program Manager, Division of Marketing Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580. Notification procedure: To obtain notification of whether the system contains a record pertaining to that individual (i.e., the individual's telephone number), individuals may be required to use a dial-in system or a designated Web site that will enable the identification and verification of their telephone numbers. Individuals filing written requests pursuant to 16 CFR 4.13 will be acknowledged and directed to use those automated systems. To the extent, if any, that the Privacy Act applies to information submitted by or compiled on telemarketers, sellers, or their agents, the system provides notice (i.e., confirms) that the system is maintaining such information when an individual accesses the system using the account number that was previously assigned to the telemarketer, seller, or agent at the time that entity originally entered information into the system to establish the relevant account. Record access procedures: See notification procedures above. To request access to any information maintained with your registration that is not available to you through the automated dial-in system or the designated Web site, you must submit your request in writing under the Commission's Rules to: ``Privacy Act Request, Office of the General Counsel, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.'' See 16 CFR 4.13. The same access procedure applies to the extent, if any, that the Privacy Act applies to information submitted by or compiled on telemarketers, sellers, or their agents, where that information is not made available for review or amendments when the telemarketer, seller, or agent accesses the system. Contesting record procedures: See notification procedures above. Where an individual believes the system has erroneously recorded or omitted information that is collected and maintained by the system, the individual will be afforded the opportunity to register, change, or delete that information after the automated system identifies and verifies the telephone number from which the individual is calling, or provides other requested identifying information if the individual is using the designated Web site. To contest the accuracy of any other information maintained on you that is not accessible to you through the automated dial-in system or Web site, you must submit your request in writing under the Commission's Rules to: ``Privacy Act Request, Office of the General Counsel, Federal Trade Commission, 600 Pennsylvania Avenue NW., Washington, DC 20580.'' See Commission Rule 4.13, 16 CFR 4.13. To the extent, if any, that the Privacy Act applies to information submitted by or compiled on telemarketers, sellers, or their agents, individuals are required to send any request to amend or correct records pertaining to them, if any, to the General Counsel at the above address. See Commission Rule 4.13, 16 CFR 4.13. Record source categories: Individuals who inform the Commission through the procedures established by the Commission that they do not wish to receive telemarketing [[Page 37494]] calls. Some records may come from do-not-call lists that some states or organizations separately maintain. Record sources for this system may also include telemarketers, sellers, and agents, but only to the extent, if any, that the Privacy Act applies to such information. Exemptions claimed for the system: None. By direction of the Commission. Donald S. Clark, Secretary. [FR Doc. 03-15910 Filed 6-23-03; 8:45 am] BILLING CODE 6750-01-P