Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Ohlhausen addresses need to protect consumers in a global computing world, (Jun 11, 2014)

By Jody Coultas, J.D.

FTC Commissioner Maureen K. Ohlhausen spoke today at Forum Global’s 2014 Cloud Computing Conference in Washington, D.C. about protecting consumers as commercial computation goes international by moving into the cloud.

Commissioner Ohlhausen noted that communication between the U.S. and Europe has been growing rapidly, with telecom providers adding transatlantic cable capacity at an average annual rate of 19% between 2008 and 2012. The Internet has contributed more than 10% to GDP growth in the last five years alone. Although it is difficult to determine where data flows start and end, it is estimated that cross-border data flows comprise 16-25% of all U.S. data traffic, and 13-16% of data traffic in Europe crosses into other regions.

Cloud computing is a special case of cross-border data flows that enables parties in different geographical locations to contribute in real time to the same work product, according to Commissioner Ohlhausen. According to Cisco estimates, global cloud Internet traffic is predicted to increase nearly 4.5-fold between 2012 and 2017. Cloud IP traffic is forecast to grow at a compound annual growth rate of 35% from 2012 to 2017. And by 2017, nearly two-thirds of all data server workloads will be processed in cloud data centers.

The cross-border flow of information raises a number of issues for the FTC, especially jurisdiction. The 2006 U.S. SAFE Web Act explicitly confirmed the FTC’s jurisdiction over foreign companies that cause injuries in the U.S. and U.S. companies that cause injuries abroad. However, unilateral action alone is insufficient to protect consumers while supporting the growing and beneficial international trade based on information, according to the Commissioner. Because a single service might have physical components in several jurisdictions, countries must work together to achieve their consumer protection policy goals. Commissioner Ohlhausen stated that there are several ongoing efforts to increase international privacy interoperability, including the U.S./European Union Safe Harbor framework and the Asia-Pacific Economic Cooperation (APEC) Privacy Framework.

U.S. / EU Safe Harbor. The U.S. / EU Safe Harbor, established in 2000, provides a way for businesses to transfer personal data from the EU to the U.S. in a manner consistent with EU law. More than 3,000 companies currently participate in the Safe Harbor program, including all the major U.S. cloud service providers. Commissioner Ohlhausen noted that the FTC has brought Safe Harbor enforcement actions against 24 companies, including Google, Facebook, and MySpace. However, the Commissioner stressed that the FTC could not do it alone, considering the global scope of cloud computing, and was looking forward to working with its European colleagues on future Safe Harbor enforcement. The FTC has committed to review referrals received from EU Member States regarding noncompliance with the Safe Harbor framework, but has only received a few Safe Harbor referrals since the establishment of the framework.

The FTC devoted a section of its business center website to the Safe Harbor framework, which includes explanations of the FTC’s role enforcing Safe Harbor; provides legal resources, reports, and blog posts about the Safe Harbor; and links to the Department of Commerce’s export.gov website which explains in detail the steps to participate. The FTC works closely with Department of Commerce and the Director-General for Justice to monitor and address Safe Harbor implementation issues. Commissioner Ohlhausen noted that the FTC was looking for ways to partner with the European Commission and the member states to raise awareness among EU consumers about the Safe Harbor.

APEC Privacy Framework. The APEC framework facilitates interoperability of different privacy regimes. The FTC has helped to develop the privacy framework, the Cross-Border Privacy Rules, and the Cross-order Privacy Enforcement Arrangement. The U.S., China, Mexico, and Japan have been accepted into the APEC Cross-Border Privacy Rules system. Understanding the contours of the APEC system, as well as the EU’s system, should help companies design their systems and practices to comply with both regimes and help build the interoperability necessary to support increasingly connected economies, according to the Commissioner.

Conclusion. The benefits of cross-border data flows and cloud computing are substantial and growing. To best serve those citizens and consumers, international policy makers must continue to cooperate by finding ways to increase the interoperability of our privacy and consumer protection regimes, according to the Commissioner.

News: ConsumerProtection Privacy FederalTradeCommissionNews