Antitrust Law Daily Wrap Up, PRIVACY NEWS: Data Security Is Topic of FTC Commissioner Ohlhausen’s Remarks on Sixth Annual Data Privacy Day, (Jan 29, 2013)

By Jeffrey May, J.D.

Yesterday, FTC Commissioner Maureen K. Ohlhausen, as keynote speaker at the “Data Privacy Day Event: Respecting Privacy, Safeguarding Data, Enabling Trust” at George Washington University Law School in Washington, D.C., discussed the FTC’s role in data security and offered practical guidance on how businesses can best protect the data entrusted to them.

In her prepared remarks, Ohlhausen said that the agency has brought over three dozen data security cases. Among those was an action announced on January 28 against a leading umbilical cord blood and tissue bank. In that matter, Cbr Systems, Inc. agreed to resolve FTC allegations that it failed to protect the security of customers’ personal information, and that its inadequate security practices contributed to a breach that exposed Social Security numbers and credit and debit card numbers of nearly 300,000 consumers.

Ohlhausen also noted an FTC matter that is currently in active litigation—the agency’s court action against Wyndham Hotels for failure to protect consumer’s personal information, resulting in three data breaches in less than two years. “A central allegation of the Commission’s case is that Wyndham’s privacy policy misrepresented the security measures that the company and its subsidiaries took to protect consumers’ personal information and that its failure to safeguard personal information caused substantial consumer injury,” Ohlhausen said.

In addition to the agency's consumer and business education efforts, Ohlhausen discussed the FTC's recently announced formal study of the data broker industry. “It is vital that we have a good understanding of data brokers because appropriate use of data can greatly benefit consumers through better services and convenience while inappropriate use or insecure maintenance of data could cause significant harm to consumers,” the official noted.

Ohlhausen suggested some common sense steps that a business can take to minimize the risk of a data breach or security compromise. Businesses should build in privacy and security considerations from the start, incorporating privacy protections into the development of a business plan or product. In addition, businesses should limit the information collected to what is truly necessary, securely store collected data, and safely dispose of data that is no longer needed.

“It is critical that businesses honor the promises they make to protect consumers’ privacy,” Ohlhausen added. “This is at the heart of the Commission’s law enforcement against deceptive practices.”

Ohlhausen concluded by making a few observations about new technologies, such as mobile and facial recognition technology, and how they are creating new challenges in the data security landscape. She discussed the Commission’s 2010 case against social networking service Twitter, in which the agency charged that serious lapses in the company’s data security allowed hackers to obtain unauthorized administrative control of Twitter.

“As a result, hackers had access to private ‘tweets’ and non-public user information—including users’ mobile phone numbers—and took over user accounts,” the official said. “The Commission’s order, which applies to Twitter’s collection and use of consumer data, including through mobile devices or applications, prohibits misrepresentations about the extent to which Twitter protects the privacy of communications, requires Twitter to maintain reasonable security, and mandates independent, comprehensive audits of Twitter’s security practices.”

“Facial recognition technology also has particular data security risks… because a face is a unique identifier that, unlike a credit card number or ID number, cannot be changed easily if the biometric data information is compromised,” Ohlhausen added.

On the topic of federal data security legislation, Ohlhausen said that although the FTC can proceed using its FTC Act, Section 5 authority, “there are gaps that could be closed through carefully crafted federal legislation.” Moreover, while almost all states have data security laws, “[a] single standard would let companies know what to do and consumers know what to expect.”

News: Privacy ConsumerProtection FederalTradeCommissionNews