In this post, we look at the additional powers given to the Federal Trade Commission (FTC) to enforce the Consumer Privacy Bill of Rights (CPBR) and what it may mean for the agency that already enjoys significant authority to enforce existing consumer privacy protection laws.
Enhanced Privacy Protection Role for the FTC
The CPBR would bestow enforcement power on the FTC that is consistent with its authority under Section 5 of the FTC Act. The FTC has exercised its power under Section 5 to bring actions for “unfair or deceptive acts or practices” as the basis for consumer privacy protection. It appears that the CPBR would add to its consumer protection arsenal by giving the FTC the authority to bring actions against “persons, partnerships, or corporations,” including certain non-profit entities, for specific violations of the CPBR and seek civil penalties in an amount not to exceed $25 million. Similar to other enforcement actions, the determination of the penalty amount under the CPBR would take into account the degree of culpability, history of prior conduct, ability to pay, effect of a fine on ability to stay in business, and other matters as justice may require.
In addition to enforcement, the CPBR would also give the FTC a more pro-active role in enhancing consumer protections. Under the CPBR, certain entities would be able to submit codes of conduct related to processing personal information for review and approval by the FTC. The FTC would consider whether the proposed codes of conduct provide equivalent or greater protections of personal data than those required by the CPBR. Adherence to an FTC-approved code of conduct would provide a safe harbor to persons or entities charged with violations of the CPBR.
How Expanded are the FTC’s Powers?
A question arises as to whether the CPBR goes far enough or adds anything new to the FTC’s already established consumer protection role. Given the FTC’s existing authority to enforce Section 5 of the FTC Act in the consumer privacy arena, the FTC has the expertise to continue the charge to safeguard consumer data and privacy interests. Indeed, the current library of FTC enforcement actions and guidance under Section 5 would likely inform the application of the CPBR, which expressly notes that a violation of the CPBR would be treated as “an unfair or deceptive act or practice in violation of Section 5 of [the FTC Act].” Thus, in practice, the CPBR may not change the enforcement landscape. And, imposing an additional burden on limited FTC resources to review and approve codes of conduct in a limited timeframe could serve to detract from enforcement activity that current laws already authorize the FTC to undertake.
This is the last in a six-part series analyzing the proposed Consumer Privacy Bill of Rights. The topics include the following:
