Antitrust Law Daily Wrap Up, PRIVACY NEWS: Ohlhausen discusses FTC/FCC enforcement after broadband reclassification, (Dec 4, 2015)

By Michael Menzhuber, J.D., LL.M.

The Federal Communications Commission (FCC) should consider the approach taken by the FTC when it evaluates how to regulate broadband service providers’ privacy and data security practices, FTC Commissioner Maureen K. Ohlhausen stated in her December 4 speech at the 33rd Annual Institute on Telecommunications Policy & Regulation in Washington, D.C.

Ohlhausen began her address, entitled: “FTC-FCC: When is Two a Crowd?” by providing a background on the FTC and how the FCC/FTC issue arose with respect to jurisdiction over privacy and security. She explained that, historically, the FTC’s common carrier exemption did not include Internet service providers. In light of the FTC’s enforcement activities in this area, she noted that the net neutrality debate and her task force’s report recommended a cautious approach to any new regulation in this area.

She next discussed the impact of the FCC’s Open Internet Order, which effectively reclassified broadband as a Title II common carrier service, thus limiting the FTC’s jurisdiction over Internet service providers (ISPs). The FCC’s enforcement has focused more on privacy and data security issues than on the net neutrality problems that the Open Internet Order was intended to address.

There is concern that the new limits on FTC jurisdiction would likely negatively affect consumers, in the Commissioner’s view. While acknowledging that some observers have felt that consumers will be better off because there would now be “two cops on the beat,” she explained that consumers could be worse off if the “cops” had conflicting rulebooks.

The FCC is still writing its rule book. However, based on the FCC’s resolution of its first data security case against a cable operator, there is evidence that its approach to privacy and data security enforcement differ greatly from the “reasonable security” taken by the FTC. Adopting a “strict liability” standard, which appeared to be the FCC’s approach in its data security case, could harm consumers, in Ohlhausen’s view.

Ohlhausen noted the “uniqueness” arguments for why there should be two sets of rulebooks but contended that she was not convinced that: (1) ISPs access to types or volumes of consumer data are so unique that it justifies a special set of particularly strict rules; and (2) there was sufficient evidence that consumers would be better off if one portion of the Internet ecosystem operates under a different set of rules than the others.

After discussing the case-by-case approach taken by the FTC, and its focus on consumer harm in determining whether to bring a case and calculate remedies, she suggested that it would do a lot to align the rulebooks if the FCC followed the FTC’s principles. The Commissioner noted the recently released Memorandum of Understanding (MOU) between the FCC and the FTC. However, while the MOU formalizes coordination, it does not solve the “two-rulebook” problem.

Consumer harm, with the ultimate goal of making consumers better off, would be the focus of the FTC’s active privacy and data security enforcement. Ohlhausen concluded by expressing her hope that the FCC would use the same focus as it evaluates how to regulate broadband service providers’ privacy and data security practices.

News: Privacy ConsumerProtection FederalTradeCommissionNews