# The FTC ’ s Role in Consumer Privacy & Data Security

May 21, 2013 Jonathan E. Zimmerman Federal Trade Commission The views expressed are those of the speaker and not necessarily those of the FTC.

# 2 

# Overview

 

# FTC Background Information  

# Enforcement

– 

# Recent Case Highlights  

# Policy

– 

# Workshops

– 

# Reports  

# Consumer and Business Education

# 3 

# FTC Background Information

 

## FTC is an independent law enforcement agency

– 

### Five Commissioners appointed by President  

## Consumer protection and competition mandate  

## Section 5 of the FTC Act

– 

### Broad authority to prohibit deceptive or unfair acts or practices  Deceptive practices are representations, omissions, or practices that:

– Are likely to mislead consumers acting reasonably under the circumstances

– Representation, omission, or practice must be material  Unfair practices are those that:

– Cause or are likely to cause substantial injury

– Are not outweighed by the benefits, and

– Are not reasonably avoidable by the consumer  

### In addition to Section 5, enforce several sector-specific privacy laws (e.g., Fair Credit Reporting Act, Children ’ s Online Privacy Protection Act)

# 4 

# FTC ’ s Approach to Privacy

 

## The standard the FTC has devised is that companies must:

– maintain reasonable procedures to protect sensitive consumer information, and

– must live up to any promises they make to consumers regarding the privacy or security of their information.  

## Companies should think about:

– The nature of the information they collect from consumers

– Why they are collecting that information

– How they are using, storing, and disposing of, that information

– What they are disclosing to consumers about these practices

# 5 

# FTC ’ s Approach to Data Security

 

### In Data Security Cases the FTC Recognizes :

– Information security is an ongoing process

– A company ’ s security procedures must be reasonable and appropriate in light of the circumstances  Did the company have effective security measures in place to protect personal information?  If not, could the information have been protected at a reasonable cost?  Were the security vulnerabilities at issue well-known within the information technology industry?  Were simple, readily-available low cost measures available to prevent them?

– A breach does not necessarily show that a company failed to have reasonable security measures – there is no such thing as perfect security

– A company ’ s practices may be unreasonable and subject to FTC enforcement even without a known security breach

# 6 

# FTC Enforcement

 

## More than 100 privacy/data-security related actions since 2001, including: ► 

## 40+ Data Security Cases ► 

## 100+ SPAM and spyware cases ► 

## 20 COPPA cases ► 

## Several FCRA cases

# 7 

# FTC Enforcement: Privacy and Data Security

# 8 

# Recent Privacy Enforcement Highlights

 Mobile

– Path  Alleged conduct: Deceived users by collecting personal information from their mobile device address books without their knowledge and consent  COPPA violation: Even if you don ’ t consider yourself a childdirected site, make sure you have age-gate mechanisms in place or that you have parental consent  Order Provisions: Ban on misrepresentations, establish comprehensive privacy program, and $800,000 COPPA civil penalty  Social Media

– MySpace  Alleged conduct: Sharing user ’ s personal information with thirdparty advertisers contrary to statements in the company ’ s privacy policy  Order provisions: Bar on misrepresentations and audit requirements similar to Facebook and Google

# 9 

# Recent Data Security Enforcement Highlights

 HTC, America (2013)

– First software security case

– Focused on HTC ’ s lack of a software security program as evidenced by security flaws HTC introduced into its Android and Windows Phone and Windows Mobile devices that could have allowed malware to access sensitive device functionality and user information

– Order Provisions: HTC required to provide security patches for millions for phones, set up a software security program, and is subject to security audits for the next 20 years  Twitter (June 2010)

– Failure to secure administrative access  Weak passwords permitted  Administrative login page publicly accessible  Account not disabled after multiple failed login attempts

– Consumers ’ tweets were not private, as promised

– Order provisions: Honor the privacy choices made by consumers and establish a comprehensive information security program, with biennial independent audit.

# Big Picture Lessons

 

### Keep your promises  

### Don ’ t retain information you don ’ t need  

### Share only for permissible purpose  

### Dispose of information properly—and don ’ t forget about paper  

### Keep up with common threats

– 

### Stolen user credentials

– 

### SQL injection attacks

– 

### Failure to limit WIFI network access

– 

### Update antivirus software  

### Get out in front of breaches and have a plan for dealing with them when they occur

# A Word On COPPA

 

## Applies to websites and online services

– 

### Child-directed websites and services that collect personal information from users under the age of 13

– 

### General audience websites and online services with actual knowledge they are collecting personal information from children under 13  

## Websites and online services must

– 

### post privacy policies,

– 

### provide parents with direct notice of their information practices,

– 

### and get verifiable consent from a parent or guardian before collecting personal information from children  

## Questions?

– 

### http://business.ftc.gov/documents/Complying-with-COPPA-FrequentlyAsked-Questions

– 

### Coppahotline@ftc.gov 

# 11

# 12 

# Policy Work

 

## Workshops

– 

### Mobile Payments

– 

### Mobile Privacy Disclosures

– 

### Comprehensive Online Data Collection  

## Reports

– 

### March 2012 Privacy Report

– 

### Kids Apps Reports

– 

### Mobile Privacy Disclosures  

## Consumer and Business Education

– 

### Marketing Your Mobile App

– 

### Mobile App Security

# 13 

# March 2012 Privacy Report

 

### Three Main Principles:

– 

## Principle #1: Adopt Privacy by Design  

### Employ reasonable safeguards to protect data  

### Limit data collection and length of retention  

### Enact procedures to promote data accuracy

– 

## Principle #2: Simplify Privacy Choices  

### Do Not Track

– 

## Principle #3: Improve Transparency  

### Standardize and enhance privacy disclosures to enable better comprehension and comparison of privacy practices

# 2013 Mobile Privacy Disclosures Report
 

# February 2013 Staff Report

– 

### Outgrowth of Commission ’ s prior work on mobile privacy and workshop discussions and comments 

##  

# Recommended Best Practices for:

– 

### Platforms

– 

### App Developers

– 

### Ad Networks and other Third Parties

– 

### App Developer Trade Associations 

# 14

# Consumer and Business Education

 

# Marketing Your Mobile App

– 

### Privacy and Truth-inAdvertising Principles for App Developers 

##  

# Mobile App Developers: Start with Security


# 15

# 16 

# Resources

 

# FTC Business Center (business.ftc.gov)

– 

### Providing you and your business tools to understand and comply with the law

# 17 

# Questions?
 

# More information available at: www.ftc.gov Jonathan E. Zimmerman Federal Trade Commission jzimmerman1@ftc.gov