Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Brill discusses U.S. privacy laws, FTC enforcement at Munich conference, (Apr 30, 2015)

By Michael Menzhuber, J.D., LL.M.

As a preface to a discussion of data flows between the United States, Germany, and the rest of the European Union (EU), FTC Commissioner Julie Brill gave a speech today at the German-American Data Protection Day held in Munich, Germany. Entitled “U.S. Privacy Law: Hiding in Plain Sight,” her prepared remarks provided an overview of U.S. privacy laws and the FTC’s efforts in enforcing those laws.

Brill began by explaining that the FTC is a bipartisan government agency that has brought enforcement actions involving anticompetitive mergers and acquisitions and other anticompetitive practices. According to Brill, cases involving advertising substantiation, telemarketing fraud, payment systems, and other practices that cause financial harm to consumers are also subject to the FTC’s enforcement actions.

After noting different types of privacy laws that exist at both the federal and state level, Brill went on to discuss Section 5 of the FTC Act and its general consumer protection authority, under which the FTC has brought more than 40 privacy-related enforcement actions and approximately 55 data security enforcement actions. Brill explained that Section 5 does not mention the words “privacy” or “personal data,” but instead outlaws “unfair or deceptive acts or practices.”

Brill discussed how the FTC uses its authority over deceptive practices to protect consumer privacy. She explained that if a company makes untrue representations in its privacy policy, the untrue representations are considered deception. She also explained that omissions can be considered deceptive and gave examples of deceptive omission cases.

The Commissioner addressed criticism of the U.S. privacy law that only companies that make promises about their activities will be subject to any kind of privacy regulation. She explained that, besides sector-specific laws, the FTC’s “unfairness” authority provides a separate basis for privacy enforcement and that this “unfairness” standard is used in cases where a company has said nothing about the practice at issue.

Section 5 gives the FTC authority to enforce promises that a company makes when it joins the Safe Harbor program. Brill explained that to be in the Safe Harbor, companies must certify and publicly declare that they follow the seven Safe Harbor privacy principles in their own data practices. She noted that 26 actions have been brought against companies for specifically violating the U.S.-EU Safe Harbor Agreement by falsely stating that they were in the Safe Harbor or claiming to meet the substantive Safe Harbor requirements when they did not. She also noted that the FTC brought an action against TRUSTe, which maintains a Safe Harbor recertification program, over alleged misrepresentations regarding annual recertification and other privacy programs.

Privacy and data security cases generally end with legally binding orders that, according to Brill, require companies to fix the underlying problems, avoid future missteps in their data practices, and set-up and maintain comprehensive privacy and security programs. She noted that orders typically last for 20 years and that companies can face monetary penalties for violating an order.

Brill concluded by explaining that the FTC’s privacy and data security work goes beyond law enforcement and that the FTC constantly examines changes, both positive and negative, in technology and business practices that affect consumers. She discussed efforts by the FTC to promote public discussion about these issues by holding public workshops. She also noted that the FTC recently published an in-depth study of the data broker industry, as well as a report on the Internet of Things, which draws attention to the fundamental importance of data security and providing appropriate safeguards.

News: Privacy FederalTradeCommissionNews