Ohlhausen Cites Consumer Privacy and Data Security Injuries, Sets Dec. 12 Workshop

The FTC is targeting "consumer informational injury" in privacy and data security cases, said acting Chairman Maureen Ohlhausen, announcing a Dec. 12 workshop. "The goal is to inform our case selection and enforcement choices," she said in an FCBA speech Tuesday. She said the FTC takes "very seriously" its privacy and data security enforcement role, having brought more than 500 related cases, including six settlements in the past month with Uber (see 1708150010), TaxSlayer (see 1708290042), Lenovo (see 1709050020) and three companies to uphold the EU-U.S. Privacy Shield agreement (see 1709080025). The "case-by-case" approach to countering deceptive or unfair actions, she said, allows the commission to adapt "in the complex, fast changing technology industry" where consumers have "disparate and evolving expectations." Looking for patterns, Ohlhausen identified consumer informational injury of: "deception injury or subverting consumer choice," in which consumers are misled through claims about privacy or security features; "financial injury," in which "fraudsters" use private data to steal money; "health or safety injury," including from stalkers or revenge porn; "unwarranted intrusion injury," which led to the FTC's Do Not Call registry; and "reputational injury," which usually overlaps with other injuries, such as financial harm from release of medical information. She said the FTC needs to further understand when informational injuries require intervention. She said the privacy and data security workshop will seek to better identify consumer injuries, explore frameworks for quantitatively measuring injuries and estimating risks, and understand how parties evaluate the tradeoffs to sharing, collecting, storing and using information. Responding to questions afterward, Ohlhausen said communications "silos" are breaking down, with IoT a "fantastic example" of technology implicating FTC privacy and other authority. Despite having two commissioners, the FTC is being productive, she said: "Commissioner [Terrell] McSweeny and I work together very well." Ohlhausen welcomed FCC robocalling actions and is "excited" about connected and automated car technology, recognizing privacy and data security concerns.