Limits on Private-sector Collection and Use of Data - FTC (1 of 5)

Question 1

The Federal Trade Commission Act

Answer 1

Codified in 15 USC section 45. Section 5(a) of the FTC act empowers the agency to enforce against - “unfair or deceptive acts or practices in or affecting commerce” are hereby declared unlawful.

Question 2

Limits on FTC Authority

Answer 2

1. Applies to commerce, excluding nonprofits

2. Excludes financial institutions

Question 3

FTC Privacy & Enforcement Actions

Answer 3

The FTC brings enforcement actions under Section 5 of the FTC Act, which prohibits unfair and deceptive trade practices which holds businesses to fair and transparent privacy and security standards.

Question 4

Two outcomes of FTC enforcement actions

Answer 4

1. Information Resolutions

2. Consent Decree

Question 5

Consent Decree

Answer 5

Formal contract between the government requiring modification of business practices

Question 6

Information Resolution

Answer 6

Agreement that the accused company will modify business practices without a formal enforcement action

Question 7

Privacy Enforcement Actions

Answer 7

1. No broad privacy law in the US
2. Corporate privacy policies often provide the basis for FTC enforcement actions
3. Authority derived from FTCs power to regulate deceptive trade practices
4. First action occurred in 1999, FTC files an enforcement action against GeoCities. Case settled with a consent degree requiring a privacy policy and new privacy controls.
5. In 2014 – Trustee promised that they would conduct annual reviews of website they would certify but did not do that. Consent decree required a $200k fine and to follow-through on policy.

Question 8

FTC Security Enforcement Actions

Answer 8

1. Authority to regulate unfair business practices
2. May arise after a security breach
3. May occur on a proactive basis
4. Windham – credit card information.

Question 9

FTC Sunset Policy

Answer 9

Sets a 20-year maximum length on consent agreements

Question 10

The Children’s Online Privacy Protection Act of 1998 (COPPA)

Answer 10

FTC has regulatory authority over COPPA. COPPA does not apply to most nonprofit organizations. Federal law that applies to the operators of commercial websites and online services that are directed to children under the age of 13.

Organizations in Scope:

1. Commercial sites that are direct at children under the age of 13
2. Commercial sites with knowledge of use by children under 13

Question 11

COPPA Requirements

Answer 11

1. To post a privacy notice on the homepage of the website
2. Provide notice about collection practices to parents
3. Obtain verifiable parental consent before collection personal information from children
4. Give parents a choice as to whether their child’s PI will be disclosed to third parties;
5. Provide parents access and the opportunity to delete the child’s PI and opt out of future collection or use of the information and maintain the confidentiality, security, and integrity of PI collected from the children

Question 12

COPPA Security Requirements

Answer 12

1. Protect the confidentiality, security, and integrity of personal information
2. Delete information when no longer needed
3. Do not require that children provide unnecessary information

Question 13

COPPA Safe Harbor

Answer 13

Encourage self-regulatory programs to limit legal exposure

Question 14

Data Brokers

Answer 14

Entities that collect, aggregate and sell individuals’ personal data, derivatives and inferences from disparate public or private sources. FTC report calls for transparency from brokers of where their data comes from.

Question 15

Internet of Things (IoT)

Answer 15

A term used to describe the many devices that are connected to the internet. Any device that is built with a network interface can be assigned an IP address to allow for automation and remote access. FTC report discusses the benefits and risks of IoT with privacy principles connected to technology.

Question 16

Artificial Intelligence (AI)

Answer 16

A process where machines learn from experience, adjusting to new inputs, and potentially performing tasks previously done by humans. It is a field of computer science dedicated to simulating intelligent behavior in computers.