Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill discusses data protection and the Internet of Things at Berlin conference, (May 4, 2015)

By Michael Menzhuber, J.D., LL.M.

FTC Commissioner Julie Brill discussed the presence and the growth of the “Internet of Things” and the potential data protection and privacy challenges it presents, in her keynote address to the EuroForum European Data Protections Days today in Berlin, Germany.

Brill began by defining the term “Internet of Things” (IoT) as the phenomenon of connecting nearly everything to the Internet. She noted its current presence and growth by pointing to the number of networked devices now and the projected number in 2020. She pointed out that, as data becomes cheaper to collect and keep, our ability to analyze it is also improving. She then gave examples of the benefits of this development; as well as examples of how the federal government, states and cities are promoting the use of big data.

The FTC, according to Brill, is encouraging this growth and, in January of 2015, released a report on the IoT that discussed its potential benefits. However, in addition to technical and engineering problems that need to be solved to make these potential benefits possible, the IoT presents big privacy and data concerns. She stated that more networked devices will mean that more sensitive data is collected. She explained that as user interfaces on devices shrink or disappear, consumers will have a difficult time knowing when data is being collected or to exercise any control.

Brill noted that policy makers in both the United States and Europe recognize the challenges presented by the IoT and see similar solutions. She pointed to the FTC’s Internet of Things report where it noted that consumer trust may be eroded if appropriate privacy protections are not provided. She also discussed how to preserve consumer trust and then explained how both baseline privacy legislation and data broker legislations would play important roles.

Brill stated reasons for her optimism that policy makers in United States and Europe will succeed in this area, including that both share many of the same beliefs about why privacy matters and their important role in protecting other values.

After noting different types of privacy laws that exist at both the federal and state level, Brill discussed Section 5 of the FTC Act and its general consumer protection authority, under which the FTC has brought more than 40 privacy-related enforcement actions and approximately 55 data security enforcement actions. Brill stated that the Section 5 prohibition against unfair or deceptive practices is useful protection against inappropriate data collection, use, and disclosure with respect to the IoT. She then pointed to how Section 5 creates a consumer-oriented focus in companies’ thinking about how they handle consumer data; as well as empowers privacy professionals within companies.

In discussing how Section 5 creates a consumer-oriented focus, Brill explained that, if a company makes untrue representations in its privacy policy, the untrue representations are considered deception. She also explained that omissions can also be considered deceptive and gave an example of deceptive omission case.

Brill stated that the FTC’s “unfairness” authority provides a separate basis for privacy enforcement. She explained that an unfair practice is one that: (1) causes substantial injury to consumers; (2) is not reasonably avoidable; and (3) does not have offsetting benefits. She stated that “unfairness” is used in cases that meet this standard, even if the company has said nothing about the practice at issue.

Brill then addressed three specific IoT challenges: (1) data security; (2) sensitive information; and (3) fair and ethical data use. She began by noting that data security was the first, and possible foremost, challenge with respect to the IoT.

The collection of sensitive information, such as health, location and financial information, while having the potential for society-changing innovations, poses some of the greatest privacy and security risks, according to Brill. She discussed a FTC staff study of 12 health-related mobile apps that showed that sensitive information was being transmitted to third parties.

Regarding the fair and ethical use of big data flowing from connected devices, Brill discussed the concern that profiles created by data brokers, from data they collect and combine, can contain sensitive data. She then gave an example of how this sensitive financial information, while being helpful in one respect, could potentially be used to scam a consumer.

Law enforcement was only one part of the FTC’s approach to strengthening consumer trust by protecting privacy and data security. Brill stated that, although the Consumer Privacy Bill of Rights discussion draft that had been released in February did not contain strong baseline privacy legislation, she was looking forward to working to develop a stronger and more appropriate proposal. She also voiced her support for data broker legislation and strong data security legislation.

While acknowledging that legislation is the right long-term solution, Brill spoke to the need for industry to develop best practices right now to address the most urgent consumer protection issues surrounding the IoT. Her first recommendation was that companies get creative about providing transparency and control for connected devices. Her second recommendation was that companies look closely as how they use data to ensure that sensitive information is not being used to treat consumers unfairly.

Brill concluded by expressing her belief that, while FTC enforcement and policy development protect many of the same interests that other countries’ privacy laws express in different ways, some similarity of things may be recognized through the IoT that inform the ongoing global discussions about the interoperability of privacy frameworks.

News: Privacy FederalTradeCommissionNews