In a November 9, 2018 comment submitted to the U.S. Department of Commerce’s National Telecommunications and Information Administration (“NTIA”), the staff of the Federal Trade Commission (“FTC”) called for a balanced approach to protecting consumer data privacy “that weighs the risks of data misuse with the benefits of data to innovation and competition.” NTIA’s request for comment is part of an effort to modernize privacy policy in a manner that protects personal data while ensuring organizations have the legal clarity and flexibility to innovate.

The FTC staff comment outlined the Commission’s enforcement and policy experience; its “guiding principles” to balancing risks and benefits; and its recommendations for consumer privacy policy. The staff comment, authorized by a 5-0 vote of the Commission, addressed four issue areas:

• Security: The FTC has been active in bringing data security cases and is exploring its remedial authority related to data privacy.
• Transparency: The FTC supports transparency as an important means for building trust in privacy disclosures. Challenges arise with “how and when to be transparent” so that consumers have access to meaningful information at the right time. While privacy disclosures provide accountability, the FTC staff comment notes that many “are characterized by bloat, opacity, and legalese.” The FTC supports a more consumer-oriented approach to disclosures, including context-specific and sector-specific approaches.
• Control: The FTC supports a balanced approach to consumer control of collection and use of data in a manner that “takes consumer preferences, context (including risk), and form into account.”
• FTC Enforcement: The staff comment reports that the FTC has “used its enforcement authority vigorously” and “should continue to be the primary enforcer of laws related to information flows in markets.” However, the FTC’s enforcement capabilities are limited by lack of authority over non-profits and common carrier activity and the absence of civil penalty authority. FTC enforcement can be constrained because certain privacy laws are either targeted narrowly to specific risks or do not include in statutory definitions the kinds of data collection made possible as the result of technological advances.

The FTC staff comment urged Congress to act on data security and breach notification legislation. The Commission noted that “legislation should balance consumers’ legitimate concerns about the protections afforded to the collection, use, and sharing of their data with business’ need for clear rules of the road, consumers’ demand for data-driven products and services, and the importance of flexible frameworks that foster innovation.”