Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC reiterates support for data security legislation before Senate Judiciary Committee, (Feb 4, 2014)

By Linda O’Brien, J.D., LL.M.

In a hearing today by the Senate Committee on the Judiciary regarding preventing data breaches and combating cybercrime in the digital age, FTC Chairwoman Edith Ramirez testified about the agency’s ongoing efforts to promote data security and reiterated its support for enactment of a strong federal data security and breach notification law.

In her prepared remarks, Ramirez outlined the FTC’s efforts to promote data security through civil law enforcement, education, and policy initiatives. She noted that businesses are collecting more personal information about consumers than ever before and that rising reports of data breaches show that these systems are susceptible to being compromised.

Ramirez pointed out that behind recent data breaches is the threat of identity theft, a pernicious crime that harms both consumers and financial institutions. According to estimates by the Bureau of Justice Statistics, 16.6 million persons – or 7 percent of all U.S. residents ages 16 and older – were victims of identity theft in 2012.

“Never has the need for legislation been greater,” Ramirez. “With reports of data breaches on the rise, and with a significant number of Americans suffering from identity theft, Congress needs to act.”

To promote data security, the FTC enforces several statutes and rules that impose obligations upon businesses that collect and maintain consumer data, Ramirez explained. These include the proscription against unfair or deceptive acts or practices in Section 5 of the FTC Act; the Gramm-Leach-Bliley Act; the Fair Credit Reporting Act (FCRA); and the Children’s Online Privacy Protection Act (COPPA). The Commission also undertakes policy initiatives to promote privacy and data security, including hosting workshops on emerging business practices and technologies affecting consumer data.

Ramirez stressed the FTC’s bipartisan support for data security legislation that would enhance existing laws and strengthen the agency’s existing authority. The Commission supports legislation, for example, that would give the FTC the ability to seek civil penalties to help ensure FTC enforcement actions have an appropriate deterrent effect. Under current laws, the FTC only has the authority to seek civil penalties for data security violations involving companies that fail to protect children’s information provided online in violation of the COPPA Rule or credit report information in violation of the FCRA. The Commission recommends data security legislation that would provide the agency with jurisdiction over non-profits, which have been the source of a substantial number of breaches.

The Commission also recommends that Congress enact a federal law that would require companies, in appropriate circumstances, to notify consumers when there is a security breach, Ramirez stated. This would help consumers mitigate likely harm from the misuse of their data. Reasonable and appropriate security practices are critical to preventing data breaches and protecting consumer data from identity theft. Although most states have breach notification laws, a strong and consistent, national requirement would ensure that all consumers are protected.

Additionally, the FTC promotes better data security practices through consumer education and business guidance, the testimony notes. On the consumer education front, the Commission recently posted information for consumers who may have been affected by the recent Target and other breaches, providing steps they should take to protect themselves. It also widely disseminates a business guide on data security, along with an online tutorial, that are designed to provide diverse businesses—and especially small businesses—with practical, concrete advice as they develop data security programs and plans for their companies. The FTC remains committed to promoting reasonable security for consumer data, Ramirez concluded.

The Commission vote approving the testimony and its inclusion in the formal record was 4-0.

News: ConsumerProtection Privacy FederalTradeCommissionNews