Federal and State Regulators and Enforcement of Privacy Law

Question 1

Governance of the FTC

Answer 1

Independent agency governed by 1 chairperson and 4 commissioners; not under US president’s control

Question 2

Who is responsible for enforcement of HIPAA?

Answer 2

Office of Civil Rights in Dept of Health and Human Services

Question 3

Who is responsible for enforcement of the Gramm-Leach-Bliley Act (GLBA)?

Answer 3

Federal Reserve and Office of Comptroller of the Currency

Question 4

Who is responsible for enforcement of financial consumer protection issues generally?

Answer 4

CFPB

Question 5

Who is responsible for enforcement of Telephone Consumer Protection Act and other telemarketing and marketing privacy statutes?

Answer 5

FCC Commission, together with FTC

Question 6

Who is responsible for enforcement of the Americans with Disabilities Act and other workplace antidiscrimination statutes?

Answer 6

EEOC

Question 7

Who is responsible for enforcement of the Fair Credit Reporting Act?

Answer 7

FTC

Question 8

Who is responsible for enforcing the Children’s Online Privacy Protection Act (COPPA)?

Answer 8

FTC

Question 9

Who is responsible for enforcing the Controlling the Assualt of Non-Solicited Pornography and Marketing (CAN-SPAM) Act of 2003?

Answer 9

FTC

Question 10

Source of FTC’s power re: “unfair and deceptive acts or practices in or affecting commerce”

Answer 10

Section 5 of FTC Act

Question 11

Section 5 of FTC Act –> limitations on FTC’s power

Answer 11

Does not extend to non-profits (because not “in commerce”)

Does not extend to banks or other federally regulated financial institutitons

Does not extend to comon carriers like transportation and communications industries

Question 12

Who is responsible for enforcement of Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009?

Answer 12

FTC and HHS share rulemaking and enforcement power re: data breaches

Question 13

FTC’s “notice and choice” approach

Answer 13

• FTC method of enforcement in late 1990s
• Companies encouraged to provide privacy notices on their websites and to offer choice to consumers about whether info would be shared with third parties
• Enforcement action for violation

Question 14

Unfair and Deceptive Acts and Practices (UDAP) Statutes

Answer 14

• Each state has one of these
• Similar to Section 5 of FTC Act
• Some statutes also allow enforcement against “unconscionable” practices (range of harsh seller practices)
• Enforced by state attorneys general

Question 15

OECD Recommendation on Cross-Border-Cooperation in the Enforcement of Laws Protecting Privacy (2007)

Answer 15

Calls on member countries to

• Discuss practical aspects of privacy law enforcement cooperation
• Share best practices in addressing cross-border challenges
• Work to develop shared enforcement priorities
• Support joint enforcement initiatives and awareness campaigns

Question 16

Global Privacy Enforcement Network (GPEN) (2010)

Answer 16

• Includes FTC and other enforcement authorities around the world
• Aims to promote cross-border information sharing as well as investigation and enforcement cooperation among privacy authorities around the world

Question 17

Asia-Pacific Economic Cooperation (APEC)

Answer 17

• Established Cross-Border Privacy Enforcement Arrangement (CPEA)
• Aims to establish framework for participating members to share info and evidence on cross-border investigations and enforcement actions in Asia-Pacific region
• FTCis a participant

Question 18

FTC’s 2015 Privacy and Data Security Update:

5 Principles

Answer 18

1. Know what data you have and who has legitimate right / need to access it
2. Limit data retained based on legitimate need
3. Implement safeguards to protect data
4. Dispose of data when no longer needed
5. Have plan for responding to security incidents

Question 19

FTC’s “harm-based model”

Answer 19

• FTC’s enforcement method in 2000s
• Emphasized addressing substantial “injury” as required under FTC’s unfairness authority
• Harm to consumers due to identity theft
• Privacy-program requirements
• Impacts beyond tangible financial harm