[ Pobierz całość w formacie PDF ]
keep codes of conduct current. Stakeholders may decide at any time that a code of conduct no longer
provides effective consumer data privacy protections, in light of technological or market changes. NTIA
might also draw this conclusion and seek to re-convene stakeholders. As with the initial development of a
code of conduct, however, stakeholder participation in the process to revise a code of conduct would be
voluntary. The Federal Government would not revise a code of conduct; rather, stakeholder groups will
make these changes with Federal Government input. Finally, under the legislative safe harbor framework
discussed in the following section, Congress could prescribe a renewal period for codes of conduct, so
that the FTC periodically reviews codes that are the basis of enforcement safe harbors.
32. The FTC brings cases based on violations of commitments in its privacy statements under its authority to
prevent deceptive acts or practices. In addition, the FTC brings data privacy cases under its unfairness jurisdiction, which
will remain an important source of consumer data privacy protection.
& &
27
IV. Building on the FTC s
Enforcement Expertise
A. Protecting Consumers Through Strong Enforcement
Enforcement is critical to ensuring that the privacy commitments companies make by adopting a code
of conduct are meaningful. Self-regulatory bodies, which develop and administer voluntary guidelines
for member companies, can provide a first line of enforcement, though they are not necessary for the
framework described here. Enforcement through self-regulatory bodies can help to detect and remedy
compliance issues at an early stage. As a result, this kind of enforcement can strengthen trust in a code
of conduct and the companies that commit to the code.
Government agencies also play a vital role in enforcing the privacy protections in codes of conduct. The
FTC is the Federal Government s leading consumer privacy enforcement authority.33 Enforcement actions
by the FTC (and State Attorneys General) have established that companies failures to adhere to volun-
tary privacy commitments, such as those stated in privacy policies, are actionable under the FTC Act s
(and State analogues) prohibition on unfair or deceptive acts or practices.34 In addition, the FTC brings
cases against companies that allegedly failed to use reasonable security measures to protect personal
information about consumers.35 Using this authority, the FTC has brought cases that effectively protect
consumer data privacy within a flexible and evolving approach to changing technologies and markets.
The same authority would allow the FTC to enforce the commitments of companies under its jurisdic-
tion to adhere to codes of conduct developed through the multistakeholder process.36 Thus, companies
that adopt codes of conduct will make commitments that are legally enforceable under existing law.
B. Providing Incentives to Develop Enforceable Codes of Conduct
The FTC has significant enforcement and policy expertise to offer all stakeholders on consumer data
privacy issues codes of conduct. With or without consumer data privacy legislation, the FTC should
provide assistance and advice regarding development of the codes. In the absence of legislation, the
FTC, Federal civil and criminal law enforcement representatives, and States should participate in the
multistakeholder deliberations by providing advice on substance and process. Once stakeholders have
developed a code, a company may voluntarily adhere to the code in order to gain greater certainty and
33. Note, however, the FTC does not currently have authority to enforce Section 5 of the FTC Act, 15, U.S.C. § 45,
against certain corporations that operate for profit.
34. See FTC Act § 5, 15 U.S.C. § 45. In addition to using its Section 5 authority to protect consumer data privacy, the
FTC has brought dozens of cases under sector-specific statutes, such as the Children s Online Privacy Protection Act, the
Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Do Not Call Rule. For a review of these cases, see FTC Staff
Report at 9-13.
35. See FTC Staff Report at 10 (reviewing enforcement actions that include counts based on unfair acts or
practices).
36. The FTC s jurisdiction over nonprofits and certain other types of entities under FTC Act § 5 may be limited.
& &
29
CONSUMER DATA PRIVACY IN A NETWORKED WORLD: A FRAMEWORK FOR PROTECTING
PRIVACY AND PROMOTING INNOVATION IN THE GLOBAL DIGITAL ECONOMY
assure its customers that its practices protect their privacy. Companies may choose to adopt multiple
codes of conduct to cover different lines of business; the common baseline of the Consumer Privacy Bill
of Rights should help ensure that the codes are consistent. Then, in any investigation or enforcement
[ Pobierz całość w formacie PDF ]