FTC Fixes Vulnerabilities in Notices and Consents Data Collection
The FTC has indicated that it will use its rule-making power under Section 18 of the FTC Act to create a new rule that will likely seek to curb large-scale data collection and use.
In October 2021, FTC Commissioner Rebecca Kelly Slaughter made of them speech in which she expressed a desire to go beyond the FTC’s ‘notice and consent’ framework to address the broader oversight practices that underpin the digital advertising economy, in particular by applying “Clear use and purpose restrictions that minimize what data can be collected and how it can be deployed.
Driving these changes is fear that the notification and consent framework has left the collection, retention and sharing of data largely unchecked, which Slaughter says can be detrimental to consumers. whether or not the collection itself has been disclosed in any way.. To underline her concerns, she quotes a FTC Staff Report published in October 2021, which revealed the extent to which ISPs are able to amass consumer information. The report details how this information can be combined with broker data to categorize and target consumers based on their race, ethnicity, sexual orientation, economic status, political or religious affiliation.
The FTC is concerned that this information could be used by companies to discriminate against certain groups, and even if the discrimination is unintentional, it could exacerbate economic or racial inequalities, marginalize workers, or exacerbate other disparities. Additionally, Slaughter highlighted how the practice of unconstrained data collection, retention and sharing has increased the severity of data breaches and fueled disinformation campaigns.
The FTC appears particularly skeptical of services that treat consumer data as a commodity for sale, rather than part of providing the service or product requested by the consumer. The agency is also concerned about secondary uses of the data, i.e. uses other than the purpose for which the data was originally collected. Therefore, any new FTC rule is likely to tighten up acceptable practices regarding the collection and use of consumer information, and require that the collection and use be related to the purpose for which it was provided. by the consumer.
Although the The FTC recently streamlined its Section 18 rule making process, it is likely to remain relatively slow, and the FTC will need to demonstrate that problems with data collection and use are substantial, unavoidable, and not outweighed by compensatory benefits to consumers or to competition.
That being said, it would be wise for companies that haven’t already implemented minimization measures to start developing them now. In particular, it is important to review and strengthen all policies that broadly allow secondary use of data. Not only will this put businesses in a better position if a new FTC rule is enacted (or if a federal privacy law is passed), but it is already recommended for businesses that need or will soon be. conform to Colorado, California and Virginia. privacy laws. Additionally, as noted above, businesses that collect and store a lot of data are more vulnerable to attacks, and if attacked, any notification and / or remediation required will be more burdensome and costly the more more data.
Keep an eye out for this space for new developments.
© 2021 Proskauer Rose LLP / srl. Revue nationale de droit, volume XI, number 356