Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC Commissioner Brill discusses the global regulation of consumer data, (Feb 19, 2015)

By Linda O’Brien, J.D., LL.M.

The Internet has become today’s global trade route, making it possible and easy for companies to deliver products and services to consumers all over the world, FTC Commissioner Julie Brill observed in a speech before the Dartmouth College Tuck School of Business in Hanover, New Hampshire on February 18.

In her remarks titled “Global Regulation of Data Flows in a Post-Snowden World, “Brill stated that one of the key drivers in the Internet economy is the flow of personal data. In the context of online services, the collection and analysis of data about individual consumers is integral to how some of the largest companies in the world do business. Data also allows small and medium companies to monetize their services. At the same time, there has been the development of a new wave of innovations based on connecting everyday objects – from light bulbs to appliances to cars – to the Internet. This phenomenon is known as the Internet of Things.

A great deal rides on data – and not just any kind of data, but personal data. Therefore, it is important this personal data is protected. Engendering consumer trust in the data-driven economy isn’t as simple as companies’ compliance with federal and state laws. Because data flows are now global, so are data privacy and security issues. Here in the U.S., protecting consumer privacy and data security are top priorities at the FTC. However, the U.S. privacy framework is different from those in Europe, Asia, and Latin America, Brill noted.

U.S. consumer privacy network. According to Brill, the United States does not have a single, comprehensive law that governs the collection, use, and disclosure of personal information in the commercial sphere. Instead, there are a variety of federal and state laws that play an important role in protecting the privacy and security of individuals’ information. Some federal privacy laws apply to specific sectors, such as healthcare, banking, credit reporting, and communications. Other federal laws protect children’s and students’ privacy. In addition to these specific laws, Section 5 of the FTC Act prohibits “unfair or deceptive acts or practices,” and the FTC has used this authority to address a number of data security and privacy practices that fall through some of the gaps in more specific laws.

FTC enforcement. To protect privacy comprehensively, the Commission needs address more than just how companies collect and use personal information, Brill noted. Companies also need to ensure that they don’t engage in practices that enable others to inappropriately obtain personal data through breaches or hacks. The FTC plays an important role in ensuring companies that are employing reasonable data security practices to prevent harm to consumers from data breaches. Data security is a large part of the FTC enforcement program. In Brill’s view, while the FTC Act and sector-specific data privacy laws create good protections for consumers and their data, consumer privacy and data security framework can and should be improved. As more and more sensitive information flows throughout the commercial marketplace, it is important to ensure that the data are appropriately protected.

The growth of the Internet of Things, while exciting, will increase the need to adapt data security laws. Consumers need to know more about and have better protections from inappropriate uses of data behind the scenes. Data brokers are companies that assemble individual profiles on consumers by collecting information from far-flung sources, but typically do not interact with consumers themselves. Through these profiles, consumers can end up in marketing segments drawn along lines of race, ethnicity, financial status, health conditions, and other sensitive characteristics. Consumers deserve much more transparency and control concerning these profiles and their uses, Brill stated.

Handling differences. Brill noted that other countries handle privacy differently. Most countries with industrialized economies have a baseline law that governs data practices in the commercial sphere. This is certainly the case in Europe, as well as Canada, Mexico, Israel, and Japan.

One of the major differences between the U.S. and European Union (EU) privacy frameworks is that, in Europe, privacy is a fundamental right. The Charter of Fundamental Rights establishes rights to the protection of private life and of personal data. The EU’s 1995 Directive adopted a comprehensive set of privacy rights that determine how companies may legally process data about EU citizens. The Directive requires each of the member states of the EU to adopt a national law that implements the principles of the Directive. In the U.S., some privacy principles are enshrined within the Constitution’s Fourth and Fourteenth Amendments, but the privacy and security of consumer information generally has not yet been recognized as a Constitutional right.

However, Brill observed that the U.S. and EU have a great deal in common beyond the question of rights, and examine the individual liberties and other protected values, including protecting consumer privacy in a data-driven economy. There are mechanisms that allow personal data to legally flow from the EU tothe United States. From the time that the Directive went into force, the EU and the U.S. recognized that prohibiting such data flows would be harmful to the economies on both sides of the Atlantic. This mutual interest in transatlantic data flows led to the U.S.-EU Safe Harbor Framework, which allows specific companies to certify that they provide adequate protections for personal data.

The viability of the Safe Harbor was seriously threatened starting in June 2013, when information provided by Edward Snowden began to detail some of the data collection activities of the National Security Agency and other intelligence and law enforcement agencies. For more than a year, the U.S. Department of Commerce and the European Commission have been negotiating changes to the Safe Harbor Framework. The Snowden revelations began a robust conversation on both sides of the Atlantic about whether the right balance has been struck in the law enforcement and national security arenas.

Going forward, the appropriate measure of progress should not be which system “wins.” Instead, the appropriate measure is whether the United States and Europe develop practical, effective, and interoperable frameworks that will allow data to be adequately protected and to flow between our economies. Neither the U.S. nor Europe will succeed without getting privacy and data security right, as they are key elements to engendering consumer trust, Brill concluded.

News: Privacy ConsumerProtection FederalTradeCommissionNews