Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Brill addresses the FTC’s privacy leadership role, (Jul 15, 2015)

By Michael Menzhuber, J.D., LL.M.

In her keynote address, entitled “The FTC’s Privacy Leadership Role in the United States,” FTC Commissioner Julie Brill discussed the consumer protection foundations of FTC privacy enforcement, the data-driven economy and Section 5 of the FTC Act, protecting consumers from the harmful uses of big data, and developing policies and best practices for a data-driven world. Brill delivered her address at the Privacy Laws & Business 28th Annual Conference, “Privacy in a Connected World,” on July 6 at St. John’s College in Cambridge, UK.

Consumer protection foundations. Brill explained that the FTC derives its authority to protect consumers from Section 5 of the FTC Act which gives the FTC broad authority to provide remedies for consumers harmed by deceptive or unfair practices in the marketplace. She further explained that Section 5 grants the FTC consumer protection authority that changes as technologies and business practices change. In addition to noting the FTC’s enforcement activities against companies that make deceptive claims in advertising, in robocalling, and abusive telemarketing practices; she also noted the agency’s efforts to protect consumers in the online marketplace.

Brill discussed the FTC’s unfairness standard and how, using its deception and unfairness authority, the agency had brought cases and entered into privacy and data security settlements with some of the largest companies in the world. She noted that, in addition to Section 5, the U.S. has numerous privacy laws that apply to specific types of information and that the FTC has a role in enforcing many of them. She noted that privacy protection in the U.S. differs from the single, unified regulation that the institutions of the European Union are striving to enact but explained that, in terms of practical protections and privacy values, the two approaches are not too far apart.

Data-driven economy and Section 5. In addressing the privacy challenges posed by the Internet of Things (IoT), Brill explained that more and more businesses rely on the data that consumers provide when they go online and that while the analytical tools used to parse this data hold tremendous promise they also create risks. She noted that the FTC Act can protect consumers when data collection from the IoT crosses the line into deception or unfairness.

Developing policies and best practices. Brill discussed the FTC’s activities to further policy development and best practices in a data-driven economy. Specifically, she mentioned: (1) the FTC’s data broker report and recommendations; (2) a day-long workshop, accepted comments, and an issued report on the IoT; (3) studying alternative scoring mechanisms that report on individuals based on where they live, their social media interactions, and other non-traditional techniques; and (4) an upcoming November workshop on cross-device tracking, which will begin to explore companies’ efforts to tie consumers’ behaviors across their many different devices.

The Commissioner noted that, in all of these examinations and including its report on the IoT, the FTC has repeatedly held that appropriate privacy and data security protections are essential to building consumer trust in connected devices, the companies that provide them, and those that use data from them. She further noted that the FTC is recommending a “security by design” approach that incorporates security in to the entire lifecycle of products and services and that it is engaging developers in this ongoing conversation.

She discussed the integral role privacy protection will play in building consumer trust in the IoT and noted that the FTC report emphasizes that companies should be asking “how”, rather than “whether”, Fair Information Practice Principles apply to the IoT.

Brill suggested that rights and obligations, based on the Fair Information Practice Principles, should be incorporated into a baseline privacy law. This would: (1) create strong, specific, and enforceable protections for consumers; and (2) set out clearer rules of the road for businesses, especially when dealing with sensitive information. She also suggested that data broker legislation and data security should be enacted and discussed, specifically, the benefits data security legislation.

News: ConsumerProtection Privacy FederalTradeCommissionNews