Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Wright discusses FTC’s enforcement efforts in privacy and data security of consumer information, (Apr 9, 2014)
By Linda O’Brien, J.D., LL.M.
FTC Commissioner Joshua Wright discussed the agency’s recent enforcements efforts addressing the privacy and data security of consumer information and how the enforcement actions may help inform privacy legislation in the European Union (EU) in a speech before the Forum for EU-US Legal-Economic Affairs in Brussels on April 8.
Wright began his remarks, entitled “Privacy and Data Security at the Federal Trade Commission: Recent Developments, “ by noting that there is not just one law or statute that broadly regulates the privacy and data security of consumer information in the United States. Instead, the U.S. privacy and data security framework consists of an array of federal laws, which identify and regulate specific areas on concerns and are enforced by a range of federal agencies. These federal laws are designed to protect consumers from harms associated with certain types of consumer information that is gathered through transactions with entities. Each of the laws sets forth specific requirements and protections for the handling of a particular type of personal information.
FTC privacy program. The Commission’s online privacy program began in 1998 when the agency brought a deception case against a popular Internet website that provided services such as personal home pages and email services to its members, Wright stated. The company misrepresented how member information gathered in the registration process was used and released without the member’s permission. Many of the FTC’s privacy cases were based on similar alleged deceptions, despite representations to consumers that their personal information would not be shared or disclosed. During the same timeframe as the FTC’s early privacy cases, the FTC also began examining representations that companies made about the security of the consumer information they were handling.
While FTC recent enforcement efforts still focus largely upon deceptive statements in the privacy and data security area, the stakes are much higher, since companies have access to a greater volume of personal information, in Wright’s view. Recently, the FTC announced the settlement of charges against two companies that misrepresented the security of their mobile applications when they failed to secure the transmission of millions of consumers’ sensitive personal information from their mobile applications. The FTC also settled charges against a social networking application developer that deceived users by collecting personal information from their mobile device address books with their knowledge or consent.
FTC authority in the online environment. The unfairness prong of Section 5 of the FTC Act allows the agency to pursue enforcement actions where there may not be an express or implied representation but where a practice that causes or is likely to cause substantial injury to consumers is not reasonably avoidable by consumers themselves. In implementing its unfairness authority, the FTC recognizes that it must undertake a cost-benefit analysis in deeming an act or practice as unfair. In Wright’s view, the proper approach is for the FTC to consider the security deficiencies at issue, the resultant harm to consumers, and the existence of low cost steps that would significantly reduce the risk.
Wright noted that one of the first cases brought by the FTC to allege unfairness in the online environment was against an Internet scammer that used copycat or misspelled web addresses to divert users to one of his sites. The FTC has continued to carefully apply its unfairness authority while at the same time exploring new opportunities for its use. As an example, the FTC charged a mobile device manufacturer with failure to employ reasonable security measures in the design of the software developed for its devices which introduced security flaws that placed consumer information at risk. The FTC also alleged unfairness and deception in a recent enforcement action against a marketer of video cameras designed to allow consumers to monitor home security. Although the marketer claimed the cameras were secure, they had faulty software that left them open to online viewing by anyone with the camera’s Internet address.
Compliance with U.S. - EU safe harbor. Wright next discussed the international privacy framework -known as the U.S.-EU safe harbor -that enables U.S. companies to transfer consumer data from the EU to the United States in compliance with EU law. In January, the FTC announced settlements with 12 companies representing a cross-section of industries, including retail, professional sports, laboratory science, data broker, debt collection, and information security. The companies handle a variety of consumer information, including in some instances data about health and employment, and deceptively claimed to hold current certifications under the U.S.-EU safe harbor framework. FTC Chairwoman Edith Ramirez has made clear that enforcement of the U.S.-EU safe harbor framework is an FTC priority and these cases help ensure the integrity of the safe harbor framework, Wright concluded.
News: Privacy FederalTradeCommissionNews