Source: https://build.export.gov/main/safeharbor/eu/eg_main_018481
Timestamp: 2019-04-26 14:26:13+00:00

Document:
Section 5 of the Federal Trade Commission Act declares "unfair or deceptive acts or practices in or affecting commerce" to be illegal. 15 U.S.C. § 45(a)(1). Section 5 confers on the FTC the plenary power to prevent such acts and practices. 15 U.S.C. § 45(a)(2). Accordingly, the FTC may, upon conducting a formal hearing, issue a "cease and desist" order to stop the offending conduct. 15 U.S.C. § 45(b). If it would be in the public interest to do so, the FTC can also seek a temporary restraining order or temporary or permanent injunction in U.S. district court. 15 U.S.C. § 53(b). In cases where there is a widespread pattern of unfair or deceptive acts or practices, or where it has already issued cease and desist orders on the matter, the FTC may promulgate an administrative rule prescribing the acts or practices involved. 15 U.S.C. § 57a.
Anyone who does not comply with an FTC order is subject to a civil penalty of up to $11,000, with each day of a continuing violation constituting a separate violation.(2) 15 U.S.C. § 45(l). Likewise, anyone who knowingly violates an FTC rule is liable for $11,000 for each violation. 15 U.S.C. § 45(m). Enforcement actions can be brought by either the Department of Justice, or if it declines by the FTC. 15 U.S.C. § 56.
In a letter to Director General John Mogg of the European Commission, FTC Chairman Pitofsky noted the limitations on the FTC's authority to protect privacy where there has not been a misrepresentation (or no representation at all) as to how the information collected will be used. FTC Chairman Pitofsky letter to John Mogg (September 23, 1998). However, companies that want to avail themselves of the proposed "safe harbor" will have to certify that they will protect the information they collect in accordance with prescribed guidelines. Consequently, where a company certifies that it will safeguard the privacy of information and then fails to do so, such action would be a misrepresentation and a "deceptive practice" within the meaning of Section 5.
As the FTC's jurisdiction extends to unfair or deceptive acts or practices "in or affecting commerce," the FTC will not have jurisdiction over the collection and use of personal information for noncommercial purposes, charitable fund-raising for example. See Pitofsky letter, p. 3. However, the use of personal information in any commercial transaction will satisfy this jurisdictional predicate. Thus, for example, the sale by an employer of personal information on its employees to a direct marketer would bring the transaction within the purview of Section 5.
The first exception applies to "banks, savings and loan institutions described in section 18(f)(3) [15 U.S.C. § 57a(f)(3)]" and "Federal credit unions described in section 18(f)(4) [15 U.S.C. § 57a(f)(4)]."(7) These financial institutions are instead subject to regulations issued by the Federal Reserve Board, the Office of Thrift Supervision(8), and the National Credit Union Administration Board, respectively. See 15 U.S.C. § 57a(f). These regulatory agencies are directed to prescribe the regulations necessary to prevent unfair and deceptive practices by these financial institutions(9) and to establish a separate division to handle consumer complaints. 15 U.S.C. § 57a(f)(1). Finally, authority for enforcement derives from section 8 of the Federal Deposit Insurance Act (12 U.S.C. § 1818), for banks and savings and loans, and sections 120 and 206 of the Federal Credit Union Act, for Federal credit unions. 15 U.S.C. §§ 57a(f)(2)-(4).
Under the Communications Act, "every telecommunications carrier," including local exchange carriers, has a duty to protect the privacy of customer proprietary information.(12) 47 U.S.C. § 222(a). In addition to this general privacy-protection authority, the Communications Act was amended by the Cable Communications Policy Act of 1984 (the Cable Act), 47 U.S.C. § 521 et seq., to mandate specifically that cable operators protect the privacy of "personally identifiable information" on cable subscribers. 47 U.S.C. § 551.(13) The Cable Act restricts the collection of personal information by cable operators and requires the cable operator to notify the subscriber of the nature of the information collected and how that information will be used. The Cable Act gives subscribers the right of access to the information about them and requires cable operators to destroy that information when it's no longer needed.
The Communications Act empowers the FCC to enforce these two privacy provisions, either at its own initiation or in response to an outside complaint.(14) 47 U.S.C. §§ 205, 403; id. § 208. If the FCC determines that a telecommunications carrier (including a cable operator) has violated the privacy provisions of section 222 or section 551, there are three basic actions it may take. First, after a hearing and determination of violation, the Commission may order the carrier to pay monetary damages.(15) 47 U.S.C. § 209. Alternatively, the FCC may order the carrier to cease and desist from the offending practice or omission. 47 U.S.C. § 205(a). Finally, the Commission may also order an offending carrier to "conform to and observe [any] regulation or practice" that the FCC may prescribe. Id.
certify to the FCC, on an annual basis, how they are complying with these regulations.
It is not clear whether the Secretary of Agriculture will interpret the failure by a packer or stockyard operator to protect personal privacy in accordance with stated policy to be a "deceptive" practice under the Packers and Stockyards Act. However, the Section 5 exception applies to persons, partnerships, or corporations only "insofar as they are subject to the Packers and Stockyards Act," Therefore, if personal privacy is not an issue within the purview of the Packers and Stockyards Act, then the exception in Section 5 may very well not apply and packers and stockyard operators would be subject to the authority of the FTC in that regard.
According to an analysis prepared by FTC staff, "All fifty states plus the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted laws more or less like the Federal Trade Commission Act ("FTCA") to prevent unfair or deceptive trade practices." FTC fact sheet, reprinted in Comment, Consumer Protection: The Practical Effectiveness of State Deceptive Trade Practices Legislation, 59 Tul. L. Rev. 427 (1984). In all cases, an enforcement agency has the authority "to conduct investigations through the use of subpoenas or civil investigative demands, obtain assurances of voluntary compliance, to issue cease and desist orders or obtain court injunctions preventing the use of unfair, unconscionable or deceptive trade practices." Id. In 46 jurisdictions, the law allows private actions for actual, double, treble, or punitive damages and, in some cases, recovery of costs and attorney's fees. Id.
1. We do not discuss here all the various Federal statutes that address privacy in specific contexts or state statutes and common law that might apply. Statutes at the federal level that regulate the commercial collection and use of personal information include the Cable Communications Policy Act (47 U.S.C. § 551), the Driver's Privacy Protection Act (18 U.S.C. § 2721), the Electronic Communications Privacy Act (18 U.S.C. § 2701 et seq.), the Electronic Funds Transfer Act (15 U.S.C. §§ 1693, 1693m), the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.), the Right to Financial Privacy Act (12 U.S.C. § 3401 et seq.), the Telephone Consumer Protection Act (47 U.S.C. § 227), and the Video Privacy Protection Act (18 U.S.C. § 2710), among others. Many states have analogous legislation in these areas. See, e.g., Mass. Gen. Laws ch. 167B, § 16 (prohibiting financial institutions from disclosing customer's financial records to a third party without either the customer's consent or legal process), N.Y. Pub. Health Law § 17 (limiting use and disclosure of medical or mental health records and giving patients the right of access thereto).
3. "Deceptive practice" is defined as a representation, omission or practice that is likely to mislead reasonable consumers in a material fashion.
5. See staff letter to Center for Media Education, www.ftc.gov/os/1997/9707/cenmed.htm. In addition, the Children's Online Privacy Protection Act of 1998 confers on the FTC specific legal authority to regulate the collection of personal information from children by website and online service operators. See 15 U.S.C. §§ 6501-6506. In particular, the act requires online operators to give notice and to obtain verifiable parental consent before collecting, using, or disclosing personal information from children. Id., § 6502(b). The act also gives parents a right of access and to refuse permission for the continued use of the information. Id.
6. On November 12, 1999, President Clinton signed the Gramm-Leach-Bliley Act (Pub. L. 106-102, codified at 15 U.S.C. § 6801 et seq.) into law. The Act limits the disclosure by financial institutions of personal information about their customers. The Act requires financial institutions to, inter alia, notify all customers of their privacy policies and practices with respect to the sharing of personal information with affiliates and non-affiliates. The Act authorizes the FTC, the Federal banking authorities and other authorities to promulgate regulations to implement the privacy protections required by the statute. The agencies have issued proposed regulations for this purpose.
7. By its terms, this exception does not apply to the securities sector. Therefore, brokers, dealers and others in the securities industry are subject to the concurrent jurisdiction of the Securities and Exchange Commission and the FTC with respect to unfair or deceptive acts and practices.
8. The exception in Section 5 originally referred to the Federal Home Loan Bank Board which was abolished in August 1989 by the Financial Institutions Reform, Recovery and Enforcement Act of 1989. Its functions were transferred to the Office of Thrift Supervision and to the Resolution Trust Corporation, the Federal Deposit Insurance Corporation, and the Housing Finance Board.
9. While removing financial institutions from the FTC's jurisdiction, Section 5 also stipulates that whenever the FTC issues a rule on unfair or deceptive acts and practices, the financial regulatory Boards should adopt parallel regulations within 60 days. See 15 U.S.C. § 57a(f)(1).
10. "The business of insurance, and every person engaged therein, shall be subject to the laws of the several States which relate to the regulation or taxation of such business." 15 U.S.C. § 1012(a).
11. The FTC has exercised jurisdiction over insurance companies in different contexts. In one case, the FTC took action against a firm for deceptive advertising in a state in which it was not licensed to do business. The FTC's jurisdiction was upheld on the basis that there was no effective state regulation because the firm was effectively beyond the reach of the state. See FTC v. Travelers Health Association, 362 U.S. 293 (1960).
As for the states, seventeen have adopted the model "Insurance Information and Privacy Protection Act" prepared by the National Association of Insurance Commissioners (NAIC). The Act includes provisions for notice, use and disclosure, and access. Also, almost all states have adopted the NAIC's model "Unfair Insurance Practices Act," which specifically targets unfair trade practices in the insurance industry.
12. The term "customer proprietary network information “means information that relates to "the quantity, technical configuration, type, destination, and amount of use of a telecommunications service" by a customer and telephone billing information. 47 U.S.C. § 222(f)(1). However, the term does not include subscriber list information. Id.
13. The legislation does not expressly define "personally identifiable information."
15. However, the absence of direct damage to a complainant is not grounds to dismiss a complaint. 47 U.S.C. § 208(a).

References: § 45
 § 45
 § 45
 § 53
 § 57
 § 45
 § 45
 § 56
 § 57
 § 57
 § 57
 § 57
 § 1818
 § 222
 § 521
 § 551
 § 208
 § 209
 § 205
 § 551
 § 2721
 § 2701
 § 1681
 § 3401
 § 227
 § 2710
 § 16
 § 17
 § 6502
 § 6801
 § 57
 § 1012
 v. 
 § 222
 § 208