International Law

FTC Testifies on Data Security Bill, Peer-to-Peer File Sharing

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

The Federal Trade Commission strongly supports the goals of H.R. 2221, the proposed "Data Accountability and Trust Act," according to Acting Director of the Bureau of Consumer Protection Eileen Harrington, who testified May 5 before the House Energy and Commerce Committee Subcommittee on Commerce, Trade and Consumer.

If enacted, the new law would require companies to implement reasonable data security policies and procedures and to notify consumers when there has been a data security breach that affects them. The legislation also would give the Commission the authority to obtain civil penalties for violations.

Coverage of Data Stored on Paper

The FTC suggested that the data security legislation be extended to cover data stored on paper, as well as electronic data. It also recommended that certain provisions imposing obligations on information brokers be targeted specifically to address harms consumers may face when brokers sell information about them. These provisions should not displace existing legal protections, according to the agency.

For more information on the proposed "Data Accountability and Trust Act," see the May 7, 2009 entry, of Trade Regulation Talk.

Data Sharing Over P2P Networks

The agency's testimony also focused on the Commission's efforts to promote better security for sensitive consumer information and to prevent the inadvertent sharing of consumers' personal or sensitive data over Peer-to-Peer Internet (P2P) file-sharing networks.

Using its authority under the FTC Act and other federal laws, the testimony noted, the Commission had brought 26 law enforcement actions since 2001 against companies that allegedly failed to maintain reasonable procedures to protect consumers' personal information.

Although P2P technologies hold potential benefits for computer users and businesses, the FTC said, they also can raise the risk that sensitive information will be made available over P2P networks, either through inadvertent sharing or through malware.

Enforcement Efforts

The FTC noted that the agency had brought cases related to P2P file sharing, had helped P2P software developers devise voluntary best practices to help consumers prevent inadvertent file sharing, and had continued to monitor efforts by companies to comply with these practices.

Regarding one of these enforcement efforts, the FTC announced that it had reached an agreement with one of the largest privately held mortgage lenders in the United States to resolve charges that the company failed to provide reasonable security for consumers' sensitive information, in violation of the FTC's Safeguards Rule.

Missouri-based James B. Nutter & Company (JBN) was also accused of violating the FTC's Privacy Rule by failing to provide privacy notices and, later, providing notices that were inaccurate.

To settle these charges, JBN has agreed to a proposed order that would require it to establish and maintain a comprehensive data security program covering consumers' personal information, to hire an independent auditor to assess its security procedures every two years for ten years, and to certify that these procedures comply with the proposed order. The proposed order also bars JBN from violating the agency's Safeguards and Privacy Rules.

Text of the FTC's testimony is available here. Further information on the case, In the Matter of James B. Nutter & Company, FTC File No. 072 3108, is available here.

Full post as published by Trade Regulation Talk on May 08, 2009 (boomark / email).