Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Ohlhausen discusses FTC’s role in data security before Congressional Bipartisan Privacy Caucus, (Feb 4, 2014)
By Linda O’Brien, J.D., LL.M.
FTC Commissioner Maureen Ohlhausen discussed the role of the FTC in data security and the resources and enforcement tools used by the agency to protect consumers’ personal data before the Congressional Bipartisan Privacy Caucus on February 3 in Washington, D.C.
Ohlhausen began her remarks by urging Congress to enact data security legislation that would enhance the FTC’s enforcement of data security, provide clarity for consumers who suffer a breach of their data, and streamline the steps businesses must take to notify consumers when a breach occurs. Recent publicly announced data breaches are reminders that consumer information is subject to a variety of risks. Such harms as identity theft hurt both consumers and financial institutions. According to estimates by the Bureau of Justice Statistics, 16.6 million persons—or 7 percent of all U.S. residents ages 16 and older—were victims of identity theft in 2012, Ohlhausen noted.
As companies collect more personal information about their customers, the FTC is concerned how entities with consumer data safeguard it from unauthorized access by data hackers or others, Ohlhausen observed. To address data security issues, the Commission uses a multi-pronged approach to enforcement, research, and education.
Law enforcement. The FTC enforces several statutes and rules that impose obligations upon businesses that collect and maintain consumer data, Ohlhausen explained. These include: (1) the Gramm-Leach-Bliley Act, which provides data security requirements for non-bank financial institutions; (2) the Fair Credit Reporting Act reporting procedures for consumer reporting agencies; and (3) the Children’s Online Privacy Protection Act that requires reasonable security for children’s information collected online. The Commission also enforces the prohibition against unfair or deceptive acts or practices in Section 5 of the FTC Act.
In the data security context, the FTC conducts its investigations with a focus on reasonableness. In each investigation, the Commission examines factors such as whether the risks at issue were well known or reasonable foreseeable, and the costs and benefits of implementing various protections based on the tools that are available in the marketplace.
Policy initiatives. The FTC also hosts workshops on business practices and technologies affecting consumer data and programs on emerging forms of identity theft, such as child and senior identity theft.
Consumer education. Ohlhausen stated that the FTC is also committed to promoting better data security practices through consumer education and business guidance. Regarding consumer education, the Commission sponsors OnGuard Online, a website designed to educate consumers about basic computer security. The FTC reaches out to businesses as well by widely disseminating its business guide on data security, along with an online tutorial based on the guide. These resources are designed to provide diverse businesses with practical advice as they develop data security programs for their companies.
Legislation. The FTC recommends federal legislation that would (1) strengthen its existing authority governing data security standards on companies and (2) require companies to provide notification to consumers when there is a security breach in appropriate circumstances, according to Ohlhausen. In her view, reasonable and appropriate security practices are critical to preventing data breaches and protecting consumers from identity theft and other harm.
Legislation in the areas of data security and breach notification should give the FTC the ability to seek civil penalties to help deter unlawful conduct, rulemaking authority under the Administrative Procedure Act, and jurisdiction over non-profit organizations. The FTC remains committed to promoting reasonable security for consumer data and, to help ensure effective deterrence, urges Congress to allow the FTC to seek civil penalties for data security and breach notice violations in appropriate circumstances, Ohlhausen concluded.
News: ConsumerProtection Privacy FederalTradeCommissionNews