The need for federal data breach and comprehensive privacy legislation, the Federal Trade Commission’s authority and role under such legislation, the agency’s need for additional staffing and legal authority, and the adequacy of its enforcement efforts under its current authority were among the issues that members of the Senate Commerce, Science, and Transportation Committee’s subcommittee on consumer protection, product safety, insurance, and data security focused on during an FTC oversight hearing this afternoon.
Subcommittee Chairman Jerry Moran (R., Kan.) said in his opening statement that he was interested in what the FTC Commissioners had learned from the agency’s own ongoing series of hearings on competition and consumer protection in the 21st century, the status of the agency’s investigation into Cambridge Analytica’s access to Facebook users’ data, and their thoughts on federal privacy legislation, which he said was working with colleagues from both sides of the aisle to develop.
At the close of the hearing, he indicated his interest on working on the reauthorization of the Undertaking Spam, Spyware, And Fraud Enforcement With Enforcers beyond Borders (US SAFE WEB) Act, which FTC Commission Noah Joshua Phillips mentioned in his testimony.
Subcommittee ranking minority member Richard Blumenthal (D., Conn.), who, like several of his colleagues, is a former state attorney general with experience working with the FTC on enforcement, said that he has been working with Sen. Moran on a bipartisan privacy bill “that I hope will make good progress very soon.”
Regarding that developing legislation, Sen. Blumenthal said that it should provide “clear rules of the road on privacy” and that “at a minimum, rules passed by Congress [should] provide all Americans with rights and redress equal to or better than California and Europe” — references to state privacy legislation passed by California this year and the European Union’s General Data Protection Regulation (GDPR).
Sen. Blumenthal said, “We’ve seen the consequences of lack of enforcement with Facebook.” He added that the incident with Cambridge Analytica revealed earlier this year “didn’t need to happen — would never have happened — if the consent decree the FTC reached with Facebook had been vigorously enforced.” Facebook entered a consent decree with the FTC in 2011 that required the company to strengthen its privacy policies.
“Big tech is no longer entitled to that trust” regarding its handling of consumer data, Sen. Blumenthal suggested. “And big tech may no longer need to be entitled to that bigness” if it “misuses” its size.
Sen. Bill Nelson (D., Fla.), the ranking minority member of the full committee who will be leaving the Senate in January after losing his reelection bid this month, called for giving the FTC more resources to enable it to “effectively do its job — particularly during an age when the American economy is becoming increasingly complex and digitized.”
Sen. Nelson added, “With a little over a thousand full-time employees, the FTC can only do so much in a $19 trillion economy. It is my hope that Congress will finally do the right thing by providing the FTC with increased funding and personnel to police the marketplace and protect American consumers from a myriad of scams, frauds, corporate practices that fleece them from their hard-earned money.”
In his prepared testimony, FTC Chairman Joseph J. Simons said that the agency supports the passage of data security legislation and urges Congress to pass privacy legislation with FTC enforcement authority. However, he said that regardless of congressional action on legislation, the FTC will use whatever enforcement authority it has to protect consumers and competition. “We have no intention of slowing down,” he added.
Chairman Simons also pledged to continue to support the Privacy Shield agreement which enables U.S. firms to export consumer data from the European Union.
Democratic FTC Commissioner Rohit Chopra called for a strong position on enforcement. “We must hold companies accountable … and we must always be willing to take them to court,” he said, while acknowledging that “without question, settlements are important.” However, he said that “no agency should appear to strong arm small companies into financial ruin while letting large firms off with a slap to the wrist.”
Republican Commissioner Phillips emphasized the need to reauthorize the US SAFE WEB Act, originally enacted in 2006 and extended by Congress in 2012 (TR Daily, Dec. 4, 2012). The legislation authorizes the FTC to work with its foreign enforcement counterparts on online criminal activity.
Commissioner Phillips recommended that Congress eliminate the sunset of that authority.
“SAFE WEB is a vital tool, but it sunsets next year. Congress should reauthorize it and eliminate the sunset,” he said.
At the end of the hearing, Chairman Moran said, “You’ve caught my attention on US SAFE WEB reauthorization, and if you’ll have your staff contact us we’ll work with you on that.”
Regarding federal privacy legislation, Commissioner Phillips said that “reasonable minds can differ on the risks,” and recommended that legislation “should focus on harms.” He added, “Any new rules will come with trade-offs to consumers of innovation and competition.”
Commissioner Phillips said, “We will enforce any new privacy authority Congress sees fit to assign us.”
Democratic Commissioner Rebecca Kelly Slaughter said, “We should and we will enforce the law against wrong doers to the fullest extent that our authority and resources allow.”
She emphasized in her testimony how additional resources and authority would enable the FTC to do more on the enforcement front. “We had about 50% more full-time employees at the beginning of the Reagan administration as we do now,” she noted.
With regard to legal authority, she said the FTC needs the ability to impose monetary penalties for violation of the law, rulemaking authority, and the elimination of jurisdictional exemptions from its authority.
One such exemption is the common carrier exemption, which prevents the FTC from exercising its authority over unfair and deceptive business practices against telecommunications service providers and other common carriers.
Limitations on the FTC’s authority “particularly” affects its ability to pursue data breach enforcement, Commission Slaughter said.
Republican Commissioner Christine Wilson, focused mainly on issues in the medical and drug fields during her prepared testimony.
During the questioning portion of the hearing, Sen. Blumenthal asked the commissioners about FTC investigations into data breach and privacy practices at major technology firms, frequently eliciting responses from Chairman Simons that he could not speak about “specific non-public investigations.”
However, Chairman Simons assured him that “anytime you see a press report of a privacy violation, … it’s safe to assume we are investigating it or we will investigate it.”
Pressed by Sen. Blumenthal as to when there might be results from the agency’s investigation of Facebook and the Cambridge Analytica incident, Chairman Simons said, “Our goal is to do this as fast as possible and get to the right results as fast as possible.” He declined to say how many full-time employees have been assigned to investigate Facebook, while stating that it is his “goal with respect to every investigation” to ensure that sufficient resources are allocated.
Sen. Blumenthal asked, “Without being unduly critical of your predecessors, are you satisfied that the Facebook consent decree was adequately enforced?”
Chairman Simons said that the agency “engages in self-criticism” in an effort to improve its operations.
“I hope to turn your opinion around” with respect to the agency’s performance, Chairman Simons said.
When Sen. Blumenthal finished his first round of questioning, Chairman Moran said, “I would just add to what he said that this subcommittee and I will do everything we can to provide you with the resources both legal and financial” for the FTC to do its work. Chairman Moran noted that he is on the Senate Appropriations financial services and general government subcommittee, which has jurisdiction over funding the FTC. “Sen. Udall used to serve on FSGG with me but he abandoned me,” Chairman Moran joked.
Later, Sen. Tom Udall (D., N.M.) noted that he is still a member of the full Appropriations Committee and pledged to support additional resources for the FTC. “I would be happy to co-author a letter with you,” he added.
Sen. Moran told the FTC commissioners, “I think your workload is growing and I think it will continue to grow.” He asked whether the FTC has the necessary resources to carry out enforcement activities under its existing authority.
Chairman Simons said, “I think we do. I think if we had additional resources that they would be put to good use.”
Chairman Moran asked, under the agency’s existing authority, what it would do with more resources.
Chairman Simons said that “staff is almost killing themselves” on litigation, and that more staff could be used in the Bureau of Economics, and “also technology resources.”
Sen. Moran noted that “significant work” is done by outside consultants and asked whether that was the best approach.
“You want a mix … [of] core people inside agency and supplement that with outside consultants,” Chairman Simons said.
Chairman Moran asked what resources the FTC would need for enforcement if granted additional authority by future federal privacy legislation.
Commissioner Chopra said that the amount of data collection is growing in every sector of the economy. “When cities grow they hire more police officers. We need to do the same,” he said.
Commissioner Slaughter said that while she agreed with Chairman Simons on what to do with more resources, she emphasized that more resources are definitely needed.
In response to a question from Sen. Amy Klobuchar (D., Minn.), who will be the second-ranking Democrat on the committee after Sen. Nelson’s departure and could succeed him as ranking member if Sen. Maria Cantwell (D., Wash.) doesn’t want to give up her leadership role on the Energy and Natural Resources Committee, Chairman Simons said that the FTC could use more economists “to assess merger enforcement.”
Full committee Chairman John Thune (R., S.D.) asked the FTC to consider using its authority under section 6(b) to obtain information to enable it to study business practices in particular industries to look at “consumer information data flows,” that is, what information companies collect, and what they do with it.
Chairman Simons said that such an inquiry “might make sense” for the agency to use its “powerful” section 6(b) authority.
Chairman Thune obtained unanimous support from the commissioners for congressional efforts to develop comprehensive privacy legislation. He asked about specific provisions the Commissioner viewed as important for such legislation. Chairman Simons mentioned civil penalty authority.
Commissioner Phillips warned that “it is critical that Congress decide what the harms are,” and what penalties are needed to address those harms. “You want to make sure that the conduct you’re chilling is conduct you want to chill,” he said.
Chairman Thune also obtained all five commissioners’ agreement that the FTC is appropriate authority to enforce new federal privacy legislation, and that the legislation should repeal the FTC Act’s common carrier exemption.
Sen. Ed Markey (D., Mass.) asked about claims by YouTube that certain content — such as “ toy reviews for kids” — are not targeted to children and thus the data collection restrictions in the Children’s Online Privacy Protection Act, which he authored when he was in the House, do not apply.
Chairman Simons said, “I don’t want to comment on any particular investigation that may or may not be ongoing, but that would be of concern to us.” He offered a similar response when Sen. Markey asked about the practice of characterizing apps as educational when they allow in-app purchases and are “saturated with advertising,” with game characters encouraging purchases.
Sen. Markey said he plans to reintroduce legislation to protection 13-, 14-, and 15-year olds, who are not protected by COPPA, and do-not-track legislation with requirements for an “eraser button” that children and parents could use to erase children’s private information from the Internet.
Sen. Maggie Hassan (D., N.H.) asked for and received a commitment from all five commissioners to look into and report back the use of “loot boxes” in children’s video games, which she said a U.K. study suggests is correlated with a rise in gambling problems in children.
Sen. Shelley Moore Capito (R., W.Va.) asked what Congress could do to help the FTC fight robocalls.
“It would be helpful to remove the common carrier exemption,” Chairman Simons said.
Chairman Moran asked whether recently enacted California privacy legislation and potential privacy legislation in other states would “complicate consumers’ ability to enjoy privacy protections no matter where they live.”
“If you’re got a good federal statute, … federal preemption might be the way to go on that,” Chairman Simons said.
Commissioner Chopra said, “We saw how preemption of state law in mortgage law —and the same argument was used [regarding potential confusion from differing state laws] — that preemption was catastrophic.” He warned that “broad preemption” regarding privacy would be “a mistake.”
Commissioner Slaughter said, “I would be very concerned about a weak [federal] law that would preempt strong state laws.”
Commissioner Wilson said she respects federal and “would be wary of preemption in many circumstances” but that she thinks it would be appropriate in this case.
Chairman Moran said that Commissioner Slaughter’s response suggests that “the way to find a solution to this may be in the strength of federal law.”
Chairman Moran also raised the issue of having the same privacy rules apply across all types of companies in in the Internet ecosystem, saying that the strength of protections should depend on the sensitivity of the data stored.
Commissioner Phillips agreed.
Sen. Ted Cruz (R., Texas) asked what the FTC could do about social media platforms like Twitter blocking users based on political content.
Commissioner Chopra said that the FTC could use its section 6(b) authority to look into the company’s business practices.
Sen. Cruz suggested that the FTC has additional authority it could use. “When companies are holding themselves out as neutral fora [and then are blocking based on content], that is actively deceptive,” he said.
Commissioner Phillips said that the FTC does not have authority “to police the First Amendment itself.”
Sen. Blumenthal said that the commissioners seemed to be focused on their consumer protection authority to look at deceptive and unfair business practices, but that “Sen. Cruz was making reference to antitrust authority.”
“We’re expecting you to use the full extent of your authority,” Sen. Blumenthal said. “The misuse of market power may include deceptive and misleading practices,” he added.
He asked for a commitment to “assess the market share of the Big 5 [tech companies] and report to us.”
Commissioner Chopra said that “market share is a little bit of a tricky one,” but he noted that “several of the biggest tech companies are under order by the FTC,” including Google, Facebook, and Twitter, “and there are others.” —Lynn Stanton, [email protected]
Interested in submitting an article?
Submit your information to us today!Learn More