US CIPP FTC Enforcement

When does an order by the commission become final?

60 days after it is served on the company.

What are companies increasingly subjected to or required to do re: privacy cases?

Companies are subject to periodic outside audits or reviews of their practices, or they may be required to adopt and implement a comprehensive privacy program.

Until the creation of which agency did the FTC issue rules and guidance for the Fair Credit Reporting act and Gramm-Leach-Bliley Act?

Consumer Financial Protection Bureau (CFPB)

True/false: Today's FTC does not include privacy and computer security issues as an important part of its work.

FALSE

Describe the situation surrounding FTC and the APA rule-making authority.

FTC has supported congressional proposals to provide the FTC with APA rule-making authority; such proposal shave not been successful to date, in part due to opposition from companies that are against increased regulation.

What options might the FTC exercise if the complaint is minor?

FTC may work with the company to resolve the problem without launching a formal investigation.

For what purpose was the FTC founded?

FTC was founded to enforce antitrust laws.

Who is the rule-making and enforcement agency for COPPA?

FTC.

True/False: The FTC can assess civil penalties.

False, the FTC lacks authority to assess civil penalties.

Once an individual or company has agreed to a consent decree, what can violations of that decree lead to?

Following an FTC investigation, it can lead to enforcement in the federal district court, including civil penalties as discussed above.

With which agency does the FTC share rule-making and enforcement power for data breaches related to medical records under the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009?

HHS.

Name one statue that provides for both civil and criminal enforcement

HIPAA.

What is a consent decree?

In a consent decree, the respondent does not admit fault, but promises to change its practices.

What other issues does the FTC retain authority over?

In addition to the authority granted under Section 5, the FTC retains separate and specific authority over privacy and security issues under other federal statutes.

Why would the FTC have incentives to negotiate?

It (1) achieves a consent decree that incorporates good privacy and security practices, (2) avoids the expense and delay of a trial, and (3) gains an enforcement advantage, due to the fact that monetary fines are much easier to assess in federal court if a company violates a consent decree.

To what does the FTC Act Section 5 apply and not apply?

It applies to "unfair and deceptive practices in commerce" and does not apply to nonprofit organizations. It's powers also do not extend to certain industries, such as banks and other federally regulated financial institutions, as well as common carriers such as transportation and communications industries.

What can the federal court grant?

It can grant injunctions and other forms of relief.

What can the FTC do if its ruling is ignored?

It can seek civil penalties in federal court of up to $16,000 per violation and can seek compensation for those harmed by the unfair or deceptive practices.

What does it mean that the FTC is an "independent" agency?

It is governed by the decisions of its chairman and four other commissioners, instead of falling under the direct control of the president.

What does Section 6 of the FTC Act do?

It vests the commission with the authority to conduct investigations and to require businesses to submit investigatory reports under oath.

Does FTC Act Section 5 say anything specifically about privacy or information security?

No.

Where a statute provides for both civil and criminal enforcement, how is jurisdiction apportioned?

Procedures exist for the roles of both HHS and the Department of Justice (in HIPAAs case)'

Where are consent decrees posted?

Publicly on the FTC's website.

What is the single most important piece of US privacy law?

Section 5 of the FTC Act.

True/false: Consent decree terms vary depending on the violation.

TRUE

Name the ways in which Congress added privacy-related responsibilities to the FTC over time.

The Children's Online Privacy Protection Act (COPPA) of 1998 and the Controlling the Assault of Non-Solicited Portnography and Marketing (CAN-SPAM) Act of 2003.

With which agency does the FTC share rule-making and enforcement power under the Telemarketing Sales Rule and the CAN-SPAM Act?

The FCC.

Describe FTC's regulation-issuing authority?

The FTC has general authority to issue regulations to implement protections against unfair and deceptive acts and practices.

Which FTC division monitors and litigates violates of consent decrees in cooperation with the Department of Justice?

The FTC's Enforcement Division within the Bureau of Consumer Protection.

What marks the beginning of the FTC's enforcement of privacy violations?

The Fair Credit Reporting Act of 1970.

What amended the Fair Credit Reporting Act?

The Fair and Accurate Credit Transactions Act of 2003.

What may the commission do after an investigation?

The commission may initiate an enforcement action if it has reason to believe a law is being or has been violated. It issues a complaint.

Why would the company have incentives to negotiate?

The company avoids a prolonged trial, as well as negative, ongoing publicity; it also avoids the details of its business practices being exposed to the public.

What can the court do if consumers are harmed by the act or practice?

The court can order "redress" or mandate an injunction against a violator.

What can the details of these consent decrees be used to do?

The details of these decrees provide guidance about what practices the FTC considers inappropriate.

How have FTC privacy enforcement actions been settled in practice?

Through consent decrees and accompanying consent orders.

What does the consent decree require of the respondent?

To maintain proof of compliance with the decree; inform all related individuals of the consent decree obligations; provide the FTC with confirmation of its compliance with the decree; inform the FTC if company changes will affect the respondent's ability to adhere to its terms.

True / false: as of recently, the FTC has not put forth any privacy or information security regulation under its Magnuson-Moss authority.

True.

True/False: Each day the violator fails to comply with the order is considered a separate offense.

True.

True/False: Each violation of such an order is treated as a separate offense.

True.

True/False: Over time, consent decrees have become more specific in nature.

True.

True/False: today, the FTC focuses on both antitrust law enforcement, and consumer protection

True.

True/false: Review of nonprivacy decrees can be instructive for lawyers or others who seek to understand the FTC's approach to and priorities for consumer protection consent decrees.

True.

True/false: The application of Section 5 to privacy and information security is clearly established today

True.

What does the consent decree usually state?

What affirmative actions the respondent needs to take and which practices their respondent must refrain from engaging in.

In what situations will the FTC proceed to full enforcement?

Where the violation is significant or there is a pattern of noncompliance.

Can the decision of the five commissioners on appeal be appealed?

Yes, it can be appealed to the federal district court.

Can the Administrative Law Judge's opinion be appealed?

Yes, it can be appealed to the five commissioners.

Can FTC respondents face civil penalties for noncompliance with a consent decree?

Yes.

Can additional penalties be assessed if a company does not respond to a complaint or order?

Yes.

What changes to the FTC mission were affected in 1938?

a statutory change caused the FTC mission to shift to a consumer protection focus.

What begins the typical FTC enforcement action?

A claim that a company has committed an unfair or deceptive practice OR has violated a specific consumer protection law.

What authorities does the CFPB hold?

Authority to issues rules and guidance for the FCRA and GLBA, and shares enforcement authority with the FTC for financial institutions that are not covered by a separate financial regulator.

What does Section 5 of the FTC Act state:

"Unfair or deceptive acts or practices in or affecting commerce are hereby declared unlawful."

In what ways can the enforcement action be brought to the FTC's attention?

1. press reports covering the questionable practices 2. complaints from consumer groups of competitors

What are some actions allowed under the FTC's broad investigative authority?

1. subpoenas of witnesses 2. civil investigative demands 3. requirements for businesses to submit written reports under oath

When was the FTC founded?

1914

What happens after the commission issues a complaint?

An administrative trial can proceed before an administrative law judge (ALJ).

What motivated the FTC and Commerce Department to begin convening public workshops and conduction other activities to highlight the importance of privacy protection on websites?

An increase in commercial activity on the Internet that became significant in the mid-1990s.

Because the FTC's regulations re: unfair and deceptive acts are not promulgated under the usual procedures of the Administrative Procedure Act, describe how they are handled?

Any such regulation must comply with the more complex and lengthy procedures under the Magnuson-Moss Warranty Federal Trade Commission Improvement Act of 1975.

What do the company and FTC have incentive to do?

Both have incentives to negotiate a consent decree rather than proceed with a full adjudication process.

When did the FTC begin bringing privacy enforcement cases under its powers to address unfair and deceptive practices?

During the 1990s.

What methods were used before the FTC began to use consent decrees in privacy cases?

the FTC's Bureau of Consumer Protection negotiated such decrees for other consumer protection issues under Section 5 of the FTC Act.