Congress needs to step up and provide both the resources and legal authority for the Federal Trade Commission (FTC) to effectively enforce the privacy rights of consumers in the United States, former director of the FTC’s Bureau of Consumer Protection Jessica Rich wrote in an editorial.
Rich, the top career privacy staff member at the agency for almost 15 years and director for another four years, acknowledged that privacy presents a tough issue for lawmakers and elicits vigorous pushback from most businesses.
Recent events—from the never-ending data breaches hitting the country to the passage of privacy laws such as California’s Consumer Privacy Act—have triggered hope that lawmakers would take action.
But nothing has happened yet, Rich said in her New York Times op-ed.
Although the FTC Act “gives the agency a lot to work with” and empowers it to investigate fraud, deception and clearly harmful practices; bring enforcement actions halting such conduct and retrieve the money lost by consumers; study trends in the marketplace; and issue studies, it “is not enough to protect privacy,” she wrote.
“Under the FTC Act, the agency can’t set normative privacy standards that all companies must follow, such as requiring them to post a privacy policy, limit the consumer data they collect and retain, refrain from certain uses of that data or give consumers choices about how their data is used,” Rich explained. “Sure, the agency might be able to get this type of relief against a particular company following proof of specific and harmful misconduct, but it can’t set these standards on an industry-wide basis.”
Nor can the FTC generally impose penalties on privacy wrongdoers unless they are already under an order for previous violations, she said. Further, the calculation of privacy rights-related disgorgement can be very difficult, and the agency has limited jurisdiction over key industry sectors, such as telecommunications companies, and no jurisdiction over banks or nonprofit entities.
As a result, the FTC has relied “more often than many would like on the greater certainty of negotiated settlements,” she said. “A strong privacy mandate from Congress could set clear limits on how consumer data can be used, and give the FTC greater power to enforce these limits in litigation.”
Rich called for Congress to give the agency “the increased authority and resources it has needed for the last 25 years” and provide “more lawyers, more investigators, more technologists and state-of-the-art tools.”
“I’m not saying it’s simple, but establishing basic privacy norms that all companies must follow, coupled with civil penalties for first-time violations and about 100 new staff members, would be a huge step in the right direction,” she concluded.
To read the op-ed, click here.
Why it matters: Rich bemoaned congressional inaction on privacy as well as the fact the agency is “woefully understaffed in privacy,” and encouraged lawmakers to provide the FTC with greater authority and resources. “Let’s not let perfect be the enemy of the good as we debate, intellectualize, testify, criticize—and continue to leave the FTC holding the bag,” she cautioned.