Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: Commissioner Wright discusses FTC enforcement and policy efforts in data security, privacy, e-commerce, (May 20, 2014)

By Linda O’Brien, J.D., LL.M.

FTC Commissioner Joshua Wright discussed the recent developments in the FTC’s law enforcement and policy work regarding data security and privacy, the Internet and e-commerce, telecommunications, broadcasting, and mass media in a May 16 speech before the U.S. Chamber of Commerce Telecommunications & E-Commerce Committee’s spring meeting in Washington, D.C.

Wright began his address, entitled “The View from 600 Pennsylvania: Recent Developments in Law Enforcement and Policy at the Federal Trade Commission, “ by noting that, in his view, the Commission can utilize useful frameworks and limiting principles in its ongoing law enforcement and policy work in the areas of data security and privacy, the Internet and e-commerce, telecommunications, broadcasting, and mass media.

E-commerce. In January, the FTC issued an administrative complaint alleging that Apple, Inc. engaged in unfair acts or practices by charging parents and other iTunes account holders for the downloads onto Apple mobile devices of software applications likely to be used by children. A feature on Apple’s platform opened a fifteen minute period during which the user did not need to reenter a billing password after completing the first transaction with the password. In Wright’s view, the evidence involved a small percentage of consumers and the injury was limited to an extremely small subset of consumers. There was no disagreement that an overwhelming majority of consumers used the same feature to make purchases and the charges were properly authorized. The FTC substituted its own judgment for a private company’s decision as to how to design its product to satisfy as many users as possible and should have conducted a more thorough cost-benefit analysis to determine whether the injury justified a finding of unfairness and imposition of a remedy, in Wright’s opinion.

Mobile applications and devices. Some of the FTC’s most interesting and cutting-edge work has been in the examination of the privacy and data security aspects of mobile applications and devices, Wright noted. Recently, the Commission announced a settlement with Snapchat, a company that markets a popular mobile application that allows consumers to send and receive photo and video messages. The FTC alleged that the company misrepresented the disappearing nature of the messages sent through its application and failed to provide adequate security. The FTC settled charges with two companies—Fandango and Credit Karma—that they misrepresented the security of their mobile apps by failing to secure the transmission of millions of consumers’ sensitive personal information.

When implementing its unfairness authority, the FTC recognized that it must undertake a cost-benefit analysis in determining whether an act or practice is unfair. In Wright’s view, the proper approach is to consider the security deficiencies at issue, the resultant harm to consumers, and whether there are low cost steps that would significantly reduce the risk.

Data security and breach notification legislation. A critical area of the Commission’s consumer protection activities is its support for data security and breach notification legislation, according to Wright. In recent testimony before Congress, the FTC recommended that such legislation should supplement the agency’s existing data security authority by authorizing the FTC to seek civil penalties in appropriate circumstances. In January, the FTC set forth some of the guiding principles behind its data security program: a company’s data security measures must be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds; the size and complexity of its business; and the cost of available tools to improve security and reduce vulnerabilities. The Commission has mirrored these concepts in its testimony on data security.

Big data. Big data, the issue of data brokers, and the general concept of the Internet of Things is another area where the Commission has taken great interest. This area could truly benefit from the rigorous study of consumer preferences, behavior, and potential risks, in Wright’s view. These factors should be evaluated within the traditional cost-benefit analysis, since it is critical to understand the potential outcome of any proposed course of action to protect consumers before making specific recommendations. In enacting the Fair Credit Reporting Act (FCRA), Congress balanced the benefits of information collection and sharing against the cost of such information collection and potential risks to confidentiality, accuracy, relevancy, and appropriate use. In doing so, Congress articulated the types of information to be protected, limited the use and access to such information, and provided consumer protections relating to accuracy and the ability to dispute and correct such information. Wright concluded by stating his reluctance to extending similar coverage to other uses and categories of information without a robust balancing of the benefits and costs associated with such requirements.

News: ConsumerProtection FederalTradeCommissionNews