Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC Chairwoman Ramirez offers advice to businesses on consumer privacy obligations, (Aug 21, 2013)

By Jeffrey May, J.D.

At the Technology Policy Institute Aspen Forum on August 19, FTC Chairwoman Edith Ramirez discussed how businesses should approach big data to protect consumer privacy and how the FTC will work to ensure companies live up to that obligation. In remarks prepared for delivery, entitled “The Privacy Challenges of Big Data: A View from the Lifeguard’s Chair,” Ramirez suggested that her agency should act “like a vigilant lifeguard” when confronting consumer privacy issues.

“The FTC’s job is not to spoil anyone’s fun but to make sure that no one gets hurt,” she noted. “With big data, the FTC’s job is to get out of the way of innovation while making sure that consumer privacy is respected.”

Three core principles, according to Ramirez, which were laid out in the FTC’s 2012 Privacy Report, should govern businesses’ decisions about consumer privacy and the use of big data: (1) privacy-by-design, (2) simplified choice, and (3) greater transparency. Discussing these three principles, Ramirez renewed the agency's call for Congress to enact baseline privacy legislation, incorporating these concepts.

The FTC chairwoman suggested that companies should engage in privacy by design by building privacy into products and services as they are being developed. Businesses should ask tough questions to lay bare vulnerabilities, thereby permitting engineers to design systems that better safeguard privacy.

Second, consumers should be offered choice mechanisms that are simple and easy-to-use. Consumers need to understand who is collecting their data and what it is being used for. Ramirez said that a workable Do Not Track option is needed to put consumers back in control over the collection of their information.

Third, transparency is necessary so that consumers can determine whether they are being treated fairly when companies use big data analytics to make determinations that could adversely affect them. “Transparency is the key to accountability, the key to responsible data collection and use, and the key to building consumer trust,” Ramirez remarked.

“Addressing the privacy challenges of big data is first and foremost the responsibility of those collecting and using consumer information,” Ramirez warned. “The time has come for businesses to move their data collection and use practices out of the shadows and into the sunlight.”

Ramirez cautioned industry to avoid the indiscriminate collection of personal information that comes from the lure of “big data.” Such data collection violates the First Commandment of data hygiene: “Thou shall not collect and hold onto personal information unnecessary to an identified purpose.”

Privacy protection should not just focus on after-the-fact use restrictions, Ramirez added. While “use restrictions have their place,” they have “serious limitations and cannot, by themselves, provide effective privacy protection.” It is critical that consumers be given a choice about what information is being collected at the time of collection, she said.

“Common Carrier” Exception to FTC Jurisdiction. Ramirez also took the opportunity to reiterate the agency's long-running call for Congress to repeal the “common carrier” exception to the FTC’s jurisdiction to permit the agency to tackle data privacy issues in the telecommunications area. The need for the repeal was explained the context of smartphone technology.

“Multiple players in the mobile ecosystem have access to that data—not just the carriers that provide service, but the mobile applications you use, the advertising networks that service those applications, the analytics companies that receive the information from the networks, and many others,” Ramirez explained. “If data is stripped from your smartphone and misused, it may be impossible to determine which one of many entities is responsible—an endeavor made more difficult by the archaic division of responsibility between the Federal Communications Commission, which has jurisdiction over carriers, and the FTC, which, in many instances, has jurisdiction over all of the players except the carriers.”

Data Breach. Noting that the FTC would “continue to be active in data security” under her watch, Ramirez said that “with big data comes big responsibility.” The agency head said that, even though the FTC already had authority under Sec. 5 of the FTC Act to address data breaches, Congress should “give the agency civil penalty authority against companies that fail to maintain reasonable security.” According to Ramirez, “[t]he advent of big data only bolsters the need for this legislation.”

Data Determinism. Businesses that use big data to make determinations about individuals based on inferences or correlation drawn by algorithms also need on to be aware that the FTC is watching. Discussing “data determinism,” Ramirez suggested that “the built-in imperfections in the decision-by-algorithm process demand transparency, meaningful oversight and procedures to remediate decisions that adversely affect individuals who have been wrongly categorized by correlation.” Businesses need to make sure that they are not accidently classifying people based race, ethnic background, gender, and sexual orientation. Ramirez noted that consumers already have access and correction rights under the Fair Credit Reporting Act (FCRA) and that the agency's recent trend to step up its FCRA enforcement efforts will continue.

News: ConsumerProtection Privacy FederalTradeCommissionNews