Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC testifies on privacy, security aspects of vehicle, roadway safety discussion draft, (Oct 22, 2015)

By Greg Hammond, J.D.

Maneesha Mithal, Associate Director of the Division of Privacy and Identify Protection of the FTC Bureau of Consumer Protection, testified before the House Committee on Energy and Commerce, Subcommittee on Commerce, Manufacturing, and Trade on “Examining Ways to Improve Vehicle and Roadway Safety.”

Mithal outlined the Commission’s concerns on the privacy and security provisions of a discussion draft to provide greater transparency, accountability, and safety authority for the National Highway Traffic Safety Administration.

Although the FTC supports the Subcommittee’s goal of protecting the privacy and security of consumers’ information, according to the prepared testimony, the Commission is concerned with various aspects of the privacy, hacking, and security provisions. With regard to the privacy provisions, Mithal noted that the draft would create a broad safe harbor from FTC law enforcement actions with regard to manufacturers that submit a privacy policy to the Secretary of Transportation explaining the notice, choices, and privacy-related commitments the manufacturer will make. This, according to Mithal, would preclude the Commission from taking action against manufacturers that make misrepresentations, going “well beyond Title III’s focus on vehicle data, particularly in light of the Commission’s extensive experience in consumer privacy enforcement.”

In addition, the discussion draft would prohibit unauthorized access to an electronic control unit, critical system, or other system containing driving data, even for research purposes. This would likely “disincentivize” security research, which would have a detrimental effect on consumers’ privacy, security, and safety, Mithal said.

With regard to the safety provisions, Mithal identified numerous areas of concern, including that the Automotive Cybersecurity Advisory Council—which the draft would establish to “develop best practices for cybersecurity for manufacturers of automobiles offered for sale in the United States”—would be composed of at least 50 percent of automobile manufacturer representatives. Because best practices need only be approved by a simple majority of members, manufacturers alone could decide what best practices would be adopted, Mithal stated.

“In sum, the Commission understands the desire to provide businesses with certainty and incentives, in the form of safe harbors, to implement best practices,” Mithal said. “However, the security provisions of the discussion draft would allow manufacturers to receive substantial liability protections in exchange for potentially weak best practices instituted by a Council that they control. The proposed legislation, as drafted, could substantially weaken the security and privacy protections that consumers have today.”

News: ConsumerProtection Privacy FederalTradeCommissionNews