Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC Director Rich presents data security testimony before Congress, (Mar 18, 2015)

By Greg Hammond, J.D.

FTC Director of Consumer Protection Jessica Rich delivered the Commission’s testimony before the Subcommittee on Commerce, Manufacturing, and Trade of the House Energy and Commerce Committee today, providing feedback on the subcommittee’s discussion draft of its bill, Data Security and Breach Notification Act of 2015. The prepared statement discussed the FTC’s support for the goals of the data security bill, but also noted that the legislation does not provide the strong protections needed to combat data breaches, identity theft, and other consumer harms.

The testimony began by discussing the growing number of reports of data breaches impacting millions of Americans, serving as a constant reminder that consumers’ data is at risk. “The need for companies to implement strong data security measures is clear: if sensitive information falls into the wrong hands, the results can be devastating,” Rich said. “Consumers face the risk of fraud, identity theft, and other harm.

Turning to the subcommittee’s proposed legislation, Rich stated that “The Commission supports the goals of the subcommittee’s data security bill to establish broadly applicable data security standards for companies and require them, in certain circumstances, to notify consumers in the event of a breach.”

Specifically, the testimony identified elements that the Commission supports, including provisions (1) requiring that companies implement reasonable data security standards, in addition to a breach notification requirement, which the FTC believes to be essential to protect consumers; (2) granting the Commission jurisdiction to bring cases against common carriers and non-profits, which will help ensure that entities maintain and protect covered personal information that is collected from consumers; and (3) giving the FTC the ability to seek civil penalties, which are an important tool to deter unlawful conduct.

“However, other aspects of the draft legislation do not provide the strong protections that are needed to combat data breaches, identity theft, and other substantial consumer harms,” Rich observed. In particular, the statement noted that (1) the definition of personal information does not protect some of the information that is currently protected under state law; (2) the bill should address the entire data ecosystem, including Internet-enabled devices; (3) the bill does not provide the FTC with rulemaking authority under the Administrative Procedure Act; and (4) the scope of the breach notification trigger should be expanded to cover other substantial harm.

News: ConsumerProtection FederalTradeCommissionNews