Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC’s Brill calls on Congress to boost data security enforcement tools, (Sep 18, 2014)

By John Curran,TR Daily

FTC Commissioner Julie Brill said yesterday that while the agency has been able to successfully prosecute companies with lax data security standards in recent years using its authority under Section 5 of the FTC Act, the agency needs additional authority from Congress to do more as data security breaches become larger and more widespread.

“We need more tools” to undertake enforcement of data security standards, Brill said in remarks, entitled “On the Front Lines: The FTC’s Role in Data Security,” delivered at an event organized by the Center for Strategic and International Studies.

“Congress should strengthen the FTC’s data security enforcement authority” to include civil penalty authority, rulemaking authority, and jurisdiction over non-profit entities, she said.

Brill discussed the scope of the FTC’s data security enforcement standards, saying that they revolve around the concept of a “flexible standard of reasonable security,” and said that the companies the agency had taken action against in recent years for lax standards were among the worst offenders. She noted that while the FTC has conducted hundreds of investigations into potential data security problems, it had taken action against only 53 companies. “We are looking for systemic failures,” she said.

Further, Brill noted that the FTC’s authority under Section 5 of the FTC Act “remains a highly effective tool” for taking action to stop “unfair” and “deceptive” acts in commerce, with actions in recent years against companies who were deceptive in failing to live up to promises to keep consumer data protected. “A promise to keep information secure has to be backed up by reasonable processes” to do so, she said.

Data security “breaches change, but our enforcement policy has not,” Brill stated. She explained that, when the agency examines companies’ efforts to prevent breaches, it looks at: whether they are performing risk assessments; whether they are seeking to minimize personal information within the data they keep; whether they are putting in place technical and physical safeguards; whether they are destroying consumer data when it is no longer needed; and whether they are training employees to handle personal information correctly.

She added that companies that have been victimized by hackers cannot necessarily use that as an excuse for subsequent data breaches.

“We are focused on those companies that are not living up to the reasonableness standard,” she said. “We realize that no security is perfect . . . It is a constantly evolving area, threats change all the time, practices change all the time.”

Speaking on the subject of “big data” analytics, Brill said that the use of big data offers “great” promise, but also “runs like a Mack truck into data security issues.” If data used in such instances contains personally identifiable information or data linked to consumers, “that’s where we have some significant security and policy issues,” she said.

She also made a strong push for adoption by U.S. payment card issuers of “pin and chip” security technologies, which are used more frequently in Europe, suggesting that they would cut down on data theft. “Let’s get it done,” she said. “It won’t stop it all . . . but it will go a long way.”

News: ConsumerProtection Privacy FederalTradeCommissionNews