Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill Addresses E.U., U.S. Privacy Policy Differences in Brussels Speech, (Apr 16, 2013)

By Tobias J. Gillett, J.D., LL.M.

FTC Commissioner Julie Brill delivered a speech today to the Mentor Group in Brussels, Belgium, describing the American privacy regime and its differences and similarities to the European Union regime. She contended that the American approach of a regulatory framework—backed up by strong enforcement—could coexist with, and be equally as effective as, the E.U.’s regulatory regime.

Brill began her speech by noting the common problems facing both the U.S. and E.U. in revising privacy laws to address the transformations wrought by the Internet and mobile technologies. She observed that the FTC, as the agency charged with curbing unfair or deceptive acts or practices, has employed its enforcement authority to target inappropriate privacy and data security practices. These efforts have resulted in the creation of a "common law of privacy" in the United States, according to Brill, in conformity with Congress’s mandate that the FTC define those privacy practices that are deceptive or unfair through its enforcement actions.

In addition, Brill noted the FTC’s work in developing policy to protect privacy in a rapidly-changing marketplace. This work has included hearings, workshops, and conferences, as well the FTC’s March 2012 privacy report calling for improvements in firms’ privacy practices. More recently, the FTC has addressed mobile privacy disclosures and facial recognition technology. This work led the FTC to support the proposed Consumer Privacy Bill of Rights last year, according to Brill, in connection with which the FTC has called on industry to:

• Provide more transparency so that consumers can better understand companies’ collection, use, and retention practices with respect to consumer information.

• Give consumers more effective tools to assert greater control over their information and how it is used.

• Provide appropriate access to the data companies hold about consumers.

• Take appropriate steps to ensure that the data companies hold about consumers is accurate.

• Take reasonable steps to secure the data about consumers that they have.

• Create a climate of accountability.

Having established this background on the FTC’s approach to privacy, Brill proceeded to discuss the differences and similarities between the U.S. privacy regime and the draft E.U. privacy regulation. She noted that the two approaches shared "common ground" on many issues, including "promoting privacy by design, protecting children’s privacy, enhancing data security, and providing consumers with appropriate access, correction and deletion rights." However, she observed that they differ in some other respects, such as when and how consumer consent should be obtained and the timing and scope of notification of data breaches.

Cross-border data transfers was one particular area of difference highlighted by Brill. The U.S. relies on "holding those who transfer data accountable for its safe-keeping, and self-regulatory codes of conduct to protect the privacy of personal information that flows across borders." E.U. law, on the other hand, often focuses on "whether the foreign country provides an ‘adequate’ level of privacy protection rather than the data protection practices of the recipient." Brill suggested that "providing more flexibility for cross-border data transfers could enhance privacy protection, spur innovation and trade," and help achieve interoperability between the U.S. and E.U. systems.

She clarified that she was not suggesting that one system was "inherently better equipped to deal with privacy issues over the other," and noted that she supported comprehensive privacy legislation in the United States. However, she contended that the United States’ "framework approach, backed up by strong enforcement" has achieved "many of the same goals as those embraced by E.U. data protection authorities." Therefore, she argued, the U.S. and the E.U. did not have to attain uniformity in their approaches, because they had "plenty of common ground for mutual recognition of [their] different, but equally effective, privacy frameworks."

"We should recognize the value not only of legislative solutions, but also the strength of a broad and flexible framework, coupled with strong enforcement, to ensure that consumer privacy is appropriately protected in our modern technological era," she concluded.

News: Privacy ConsumerProtection FederalTradeCommissionNews