Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC Commissioner Discusses Data Security At Beyond the Password: Protecting Your Online Identity, (Apr 19, 2013)

By Jody Coultas, J.D.

On April 17, FTC Commissioner Maureen K. Ohlhausen participated in a discussion of data security hosted by Google entitled "Beyond the Password: Protecting Your Online Identity." The meeting in the Washington, D.C. brought together security experts to discuss the challenges of protecting data and the solutions that companies are working on to protect consumers against existing and emerging threats.

In her prepared remarks, Ohlhausen discussed the FTC’s role in data security, including prosecuting cases, educating consumers on how to protect themselves, and sharing best practices with businesses to help them keep their consumer data secure.

Enforcement. The FTC enforces the GrammLeach-Bliley Act, which imposes data security requirements on financial institutions, the Fair Credit Reporting Act, which requires credit reporting agencies to use reasonable procedures to ensure that recipients of sensitive consumer information have a permissible purpose for receiving that information from the agencies, and Section 5 of the FTC Act, which prohibits businesses from making false or misleading claims about its data security procedures. Ohlhausen noted two cases, one against a leading cord blood bank and the other against a major hotel chain, in which the FTC alleged that companies failed to protect their customers’ personal information in violation of Section 5.

Consumer Education. OnGuard Online, launched in 2005, is the FTC’s website designed to educate consumers about basic computer security. The Commission also focuses on providing consumers with ways to protect their identities, as well as steps to take if they were victims of identity theft. The FTC’s identity theft primer and victim recovery guide has reached millions of consumers.

Ohlhausen also noted that on June 4, the FTC will sponsor a public forum to address security threats facing smartphones and mobile technology users.

Best Business Practices. In order to protect consumers, Ohlhausen stated that businesses should build privacy and security considerations into the development of business plans or products, a concept called "privacy by design." Businesses should also limit the information collected to only what is necessary for business operations, securely store collected data, and safely dispose of data that is no longer needed. Businesses must live up to the assurances they make regarding security standards. It is also critical to have a plan for responding to security breaches.

News: Privacy ConsumerProtection FederalTradeCommissionNews