Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill encourages ‘reasonable’ security by businesses handling consumer information, (Feb 10, 2016)

By Edward L. Puzzo, J.D.

The FTC encourages businesses possessing private consumer data gleaned through transactions on the Internet and elsewhere to adhere to a "reasonable" security standard to protect that information, according to FTC Commissioner Julie Brill. Brill delivered the keynote address at the third installment of the FTC's Start with Security series, held yesterday in Seattle. The Start with Security conferences are part of a FTC data security initiative intended to provide guidance to businesses to help them protect consumers' private information.

Reasonable security. Brill stated that the FTC holds businesses to a "reasonable" security standard, not a "perfect" security standard. The fact that a business suffers a security breach does not mean that it will be subject to an FTC enforcement action. On the other hand, the FTC will bring enforcement actions when businesses create or fail to close vulnerabilities that create unreasonable risks to consumers, even where there is no evidence of an actual breach.

Reasonable security requires companies to take measures that are appropriate for the data and for the size and complexity of their businesses. Companies should be building security into their products from the beginning of their development process, and detecting and fixing security issues and vulnerabilities on an ongoing basis. For privacy as well as security reasons, companies should also be evaluating the data they are collecting and choosing to retain.

FTC Guide. Companies have asked for clearer guidance from the FTC on data security enforcement standards. The starting place for such guidance, Brill stated, is the FTC's Start with Security guide, which offers ten examples of alleged security lapses that led to FTC enforcement actions.

It is also important to give consumers security tools, Brill stated, such as two-factor authentication and credit freezes, and to encourage consumers to use them. Once a consumer has been the victim of identity theft, rapid action is helpful in pursuing identity thieves and stopping further losses. The FTC has recently unveiled new tools on its identitytheft.gov site for this purpose.

News: Privacy FederalTradeCommissionNews