FEDERAL TRADE COMMISSION

Privacy Act Notice

AGENCY: Federal Trade Commission (FTC).

ACTION: Final notice of new Privacy Act system of records.

SUMMARY: The FTC is establishing a new system of records under the Privacy Act of 1974, as amended. This system will include telephone numbers and other information of individuals who do not wish to receive telemarketing calls from telemarketers, sellers, and agents. These telephone numbers will be disclosed to companies to ensure compliance with the Commission's Telemarketing Sales Rule.

DATES: This system is final and effective as of [insert date of publication in the Federal Register].

FOR FURTHER INFORMATION CONTACT: For information about this Privacy Act notice, you may contact Alex Tang, Attorney, Office of the General Counsel, FTC, 600 Pennsylvania Avenue, NW, Washington, DC 20580, (202) 326-2447, atang@ftc.gov. For information about the National Do Not Call Registry, please contact David Torok, Attorney, Division of Marketing Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580, (202) 326-3075, dtorok@ftc.gov.

SUPPLEMENTARY INFORMATION: As required by the Privacy Act of 1974, as amended, the FTC previously published a notice of its proposal to establish a new agency system of records pertaining to individuals, to be called the "National Do Not Call Registry System-FTC" (FTC-IV-3). The FTC published its proposal in the February 27, 2002, edition of the Federal Register. See 67 FR 8986.

The proposal outlined what personal information the system would collect from individuals, and how we would use, disclose and maintain that information. As explained in the proposal, the new records system is intended to help the FTC implement and enforce the do-not-call requirements of our Telemarketing Sales Rule, 16 CFR Part 310, as recently amended.⁽¹⁾ Once it begins operating, the system, as we explained, will allow you, if you choose, to place your telephone number on our National Do Not Call Registry, so that telemarketers, sellers, and agents will know that you do not want to receive telemarketing calls from them.⁽²⁾ You will have the option of registering through a dial-in system from the telephone number that you wish to place on the Registry, or through the National Do Not Call Registry Web site that will be linked to our main Web site, www.ftc.gov, as described further below. Our Rule will require telemarketers, sellers, and agents that are subject to our Rule to check the Registry at least once every three months to make sure their do-not-call lists are current and consistent with the Registry at that time. This requirement should help ensure that you do not get unwanted telemarketing calls from these telemarketers, sellers, or agents.

Below, in final form, is the system notice that the Privacy Act requires us to publish for the system. Although we received no public comments in response to our proposal, we have taken this opportunity to make a few minor clarifications, which we summarize below.⁽³⁾

System name. We have added the word "National" to distinguish our Registry from do-not-call lists that some states or other organizations maintain. (We have made the same change in the address of the program manager for the system.)

Categories of records in the system. Our proposal explained that the system would maintain your telephone number, as well as the date and time you place your number in the system or remove it from the system. We also proposed to ask you for your telemarketing preferences, zip code, or other voluntary information. As explained in the final system notice below, the system will still record your telephone number and the relevant date and time, as well as any other information automatically generated by the system, if you call in to register, verify, or delete your telephone number from the system. Our proposal explained that the system will use automatic number identification technology, also known as "ANI," which is similar to "caller ID," to verify your telephone number when you call from that number.

If, however, you use the National Do Not Call Registry Web site to register, the Web site will instead ask you for an e-mail address to validate and confirm your registration, since ANI cannot be used in that case to verify your telephone number. Likewise, the Web site will ask you to supply an e-mail address if you use the Web site to verify that your telephone number is in the Registry, or to delete your number from it. (Of course, you may avoid giving us an e-mail address by using the dial-in method described above.) Thus, in this final system notice, we have clarified that "other information that the individual may be asked to provide voluntarily" means we will ask you to provide an e-mail address if you use the Web site to register, or to obtain access to the system to verify or delete your telephone number from the system.⁽⁴⁾ We do not intend, however, to ask you for your telemarketing preferences, zip code, or other personal information, as our original proposal may suggest.

Authority for maintenance of the system. We have updated this section to include the Do-Not-Call Implementation Act, Pub. L. No. 108-10 (Mar. 11, 2003). Congress passed that law after we published our proposed system notice. The new law allows us to collect fees from telemarketers, sellers, and their agents in order to maintain and operate the system.

Routine uses of your information. We are revising this section to make clear that the "records" that we may disclose to telemarketers, sellers, and agents for do-not-call purposes do not include e-mail addresses that we ask from individuals who register through the National Do Not Call Registry Web site. That information is collected only for purposes of registering, verifying, or deleting your telephone number from the Registry, as explained earlier, and not for disclosure to telemarketers, sellers, or their agents.

Notification procedure. Our proposal explained that, if you want to learn (i.e., confirm) whether our National Do Not Call Registry contains a record of your telephone number, we would require you to use a dial-in system or "other system" to obtain that notification. We are revising the language specifically to mention the National Do Not Call Registry Web site as an option to the dial-in system, as previously discussed.

Record access procedures. Our proposal suggested that we might need to ask for e-mail addresses or other contact information so we could send a written acknowledgment if you ask us to delete your phone number from the Registry. The final version of the system will normally process deletions within 24 hours from when an individual submits such a request by telephone or through the National Do Not Call Registry Web site, so we are not required to send a written acknowledgment to an individual in those situations.⁽⁵⁾ The revised notice also clarifies that if you want access to any other information about your registration that the system may maintain, and the information is not available through the automated dial-in system or the Web site, you must submit your request in writing under the Commission's rules. (We are making the same clarification in the "contesting record procedures" section discussed below.)

Contesting record procedures. This section of the proposal referred only to the automated dial-in system. We are revising this section to include the National Do Not Call Registry Web site, as described earlier.

Record source categories. In this section, we repeat that the system includes not only the information that you provide (i.e., your telephone number, plus your e-mail address, if you register through the National Do Not Call Registry Web site), but also information that the system itself automatically generates (e.g., the date and time you registered), as discussed earlier. We are also clarifying that some telephone numbers in our Registry may come from do-not-call lists that some states or other organizations separately maintain. See 68 FR at 4641.

Other revisions. The final notice also includes some additional cross-references and miscellaneous other revisions (such as the name of the FTC office that will manage the system, and changing "telemarketers and their agents" to "telemarketers, sellers, and their agents"), for clarity and precision.

Privacy Impact Assessment. Section 208 of the E-Government Act of 2002, Pub. L. No. 107-347, generally requires that agencies assess the privacy impact of collecting personally identifiable information online before initiating such a collection activity or developing or procuring the technology to do so. The above requirement did not take effect until after the Commission initiated and legally adopted the Rule amendments that established the National Do Not Call Registry, and after the Commission started developing and procuring the technology for accepting do-not-call registrations online. Nevertheless, we have assessed the privacy impact of the system as discussed below. (The Commission's Chief Information Officer or other designated official has reviewed this assessment.)

1. What information will we be collecting? See above, and the discussion of "Categories of records" below.

2. Why are we collecting this information? See above, and the discussion of "Purpose(s)" and "Routine Uses" below.

3. How do we intend to use the information? See above, and the discussion of "Purpose(s)" and "Routine Uses" below.

4. With whom will we share the information? See above, and the discussion of "Purpose(s)" and "Routine Uses" below.

5. What notice or opportunities for consent will individuals have about what information we collect and how we share it? This notice explains what information we collect and how we share it. Whether you register and submit your information to us is completely up to you. If, however, you do not supply your phone number or other information we may need to process your request, we cannot put your telephone number in our National Do Not Call Registry.

6. How will the information be secured?See the discussion of "Safeguards" below. Our National Do Not Call Registry Web site will use secure socket layer (SSL) encryption. We also plan to use the same or comparable technology when telemarketers, sellers, and their agents access telephone numbers from the system.

7. Does this create a system of records subject to the Privacy Act of 1974, as amended? Yes, as this notice describes.

FTC-IV-3

System Name: National Do Not Call Registry System-FTC (FTC-IV-3)

Security Classification: Not applicable.

System Location: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. System records may be maintained, in whole or part, off-site by contractors.

Categories of individuals covered by the system: Individuals who notify the Commission that they do not wish to receive telemarketing calls.

Categories of records in the system: Telephone numbers of individuals who do not wish to receive telemarketing calls; information automatically generated by the system, including date and/or time that the telephone number was placed on or removed from the Registry; and other information that the individual may be asked to provide voluntarily (such as e-mail address, if the individual registers through the National Do Not Call Registry Web site).

Authority for maintenance of the system: Federal Trade Commission Act, 15 U.S.C. 41 et seq., Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. 6101-6108; Do-Not-Call Implementation Act, Pub. L. No. 108-10 (2003).

Purpose(s): To maintain records of the telephone numbers of individuals who do not wish to receive telemarketing calls; to disclose such records to telemarketers, sellers, and their agents in order for them to reconcile their do-not-call lists with the Registry and comply with the do-not-call provisions of the Commission's Telemarketing Sales Rule, 16 CFR Part 310; to enable the Commission and other law enforcement officials to determine whether a company is complying with the Rule; to provide statistical data that may lead to or be incorporated into law enforcement investigations and litigation; or for other law enforcement, regulatory or informational purposes.

Routine uses of records: Records from this system may be disclosed as permitted by 5 U.S.C. 552a(b), and, as authorized by 5 U.S.C. 552a(b)(3), in accordance with the routine uses announced by the Commission in Appendix I of its system notice applicable to all other agency Privacy Act systems of records (57 FR 45678), as may be revised and updated from time to time. Additional routine uses for records in this system are as follows, provided that no routine use specified either herein or in Appendix I shall be construed to limit or waive any other routine use published for this system:

a. Telephone numbers, but not any e-mail addresses, submitted by individuals may be made available or referred on an automatic or other basis to telemarketers, sellers, and their agents for the purpose of determining or verifying that an individual does not wish to receive telemarketing calls;

b. Records may be made available or referred on an automatic or other basis to other federal, state, or local government authorities for regulatory, compliance, or law enforcement purposes.

Disclosure to consumer reporting agencies: Not applicable.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage: Stored in a computer database maintained on magnetic disks and tape, or other electronic systems determined by the Commission in consultation with staff or contractors.

Retrievability: Indexed by area code and phone number of individuals who have informed the Commission that they do not wish to receive telemarketing calls. May also be retrieved by other data, if any, compiled or otherwise maintained with the record.

Safeguards: Access to computerized records by electronic security precautions. Access is generally restricted to those agency personnel and contractors whose responsibilities require access, or to approved telemarketers, sellers, and their agents. (See also "Purposes" and "Routine Uses" above to learn how information may be used or disclosed.)

Retention and disposal: Automated information retained indefinitely, until deleted pursuant to request by the subject individual, or deleted automatically after certain period of time, to be determined by the Commission.

System manager and address: National Do Not Call Registry Program Manager, Division of Planning and Information, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580.

Notification procedure: To obtain notification of whether the system contains a record pertaining to that individual (i.e., the individual's telephone number), individuals may be required to use a dial-in system or a designated Web site that will enable the identification and verification of their telephone numbers. Individuals filing written requests pursuant to 16 CFR 4.13 will be acknowledged and directed to use those automated systems.

Record access procedures: See notification procedures above. To request access to any information maintained with your registration that is not available to you through the automated dial-in system or the designated Web site, you must submit your request in writing under the Commission's Rules to: "Privacy Act Request, Office of the General Counsel, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580." See 16 CFR 4.13.

Contesting record procedures: See notification procedures above. Where an individual believes the system has erroneously recorded or omitted information that is collected and maintained by the system, the individual will be afforded the opportunity to register, change, or delete that information after the automated system identifies and verifies the telephone number from which the individual is calling, or the individual provides other requested identifying information if the individual is using the designated Web site. To contest the accuracy of any other information maintained on you that is not accessible to you through the automated dial-in system or Web site, you must submit your request in writing under the Commission's Rules to: "Privacy Act Request, Office of the General Counsel, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580." See Commission Rule 4.13, 16 CFR 4.13.

Record source categories: Individuals who inform the Commission through the procedures established by the Commission that they do not wish to receive telemarketing calls. Some records may come from do-not-call lists that some states or other organizations separately maintain.

Exemptions claimed for the system: None.

By direction of the Commission.

Donald S. Clark
Secretary

1. The Rule amendments were published earlier this year. See 68 FR 4580 (Jan. 29, 2003).

2. In this document, "you" means an individual who places his or her telephone number on the National Do Not Call Registry to indicate that he or she does not wish to receive telemarketing calls from telemarketers, sellers, or agents.

3. In a separate document published elsewhere in today's FEDERAL REGISTER, we are proposing to amend the Privacy Act notice for this system to explain the extent, if any, that it will apply to information that telemarketers, sellers, and their agents separately submit in order to pay for access to the system and check their do-not-call lists against the system. If you are an individual who registers your telephone number in our system, that separate proposed amendment, which would only affect the information that those companies submit, should not affect you.

4. As described in the notice, the system will maintain system information indefinitely or until it is no longer needed or it is deleted automatically. In the case of e-mail addresses, we anticipate that the information will be retained for no more than a year.

5. The Privacy Act requires agencies to send a written acknowledgment not later than 10 days after an individual submits a request to amend his or her record, which would include deleting a record from the system. See 5 U.S.C. 552a(d)(2)(A). The United States Office of Management and Budget, which is responsible for interpreting the Privacy Act, has explained that this requirement does not apply if the agency processes the request within the 10-day period that the law would allow for acknowledging the request. See 40 FR 28948, 28958 (1975). If you use the National Do Not Call Registry Web site to register or to delete your telephone number from the system, however, the system will acknowledge your request by e-mail.