Internet Privacy and Data Security: Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility

This testimony summarizes the information contained in GAO's January 2019 report, entitled Internet Privacy: Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility ( GAO-19-52 ).

The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity.

In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018.

Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced:

Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited.

Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions.

Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act.

Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy.

Thank you for the opportunity to testify today about Internet privacy and  data security issues. The United States does not have a comprehensive  data privacy law at the federal level and instead relies in part on a  sectoral approach with industry-specific laws enforced by various  agencies governing areas such as healthcare and financial services. In  addition, the Federal Trade Commission (FTC) currently has the lead in  overseeing Internet privacy across all industries, with some exceptions.  Specifically, FTC addresses consumer concerns about Internet privacy  using its broad authority to protect consumers from unfair and deceptive  trade practices. FTC has jurisdiction over a broad range of entities and  activities that are part of the Internet economy, including websites,  applications (apps), advertising networks, data brokers, device  manufacturers, and others.

My testimony today addresses (1) FTC’s role and authorities for  overseeing Internet privacy, (2) stakeholders’ views on potential actions  to enhance federal oversight of consumers’ Internet privacy, and (3)  breaches of personally identifiable information. This statement is primarily  based on our January 2019 report on Internet privacy. This work  included evaluating FTC’s Internet privacy enforcement actions and  authorities and interviewing various stakeholders, including  representatives from industry, consumer advocacy groups, and  academia, as well as FTC staff and former FTC and Federal  Communications Commission (FCC) commissioners. We also interviewed  officials from other federal oversight agencies—such as the Consumer  Financial Protection Bureau (CFPB), Food and Drug Administration  (FDA), and the Equal Employment Opportunity Commission (EEOC)— about the strengths and limitations of their regulatory and enforcement  authorities and approaches. A complete description of our scope and  methodology can be found in our January 2019 report. This statement  also includes some additional information on data breaches from our  August 2018 report on Equifax.

We conducted the performance audit on which this statement is primarily  based from October 2017 through January 2019 in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

In April 2018, Facebook disclosed that a Cambridge University researcher  may have improperly shared the data of up to 87 million of Facebook’s  users with a political consulting firm. This followed other incidents in  recent years involving the misuse of consumers’ personal information  from the Internet, which about three-quarters of Americans use. These  types of incidents have raised public concern because Internet-based  services and products, which are essential for everyday social and  economic purposes, often collect and use various forms of personal  information that could cause users harm if released.

The federal privacy framework for private-sector companies is comprised  of a set of tailored laws that govern the use and protection of personal  information for specific purposes, in certain situations, or by certain  sectors or types of entities. Such laws protect consumers’ personal  information related to their eligibility for credit, financial transactions, and  personal health, among other areas.

We reported in 2013 that no overarching federal privacy law governs the  collection and sale of personal information among private-sector  companies, including information resellers—companies that collect and  resell information on individuals. We found that gaps exist in the federal  privacy framework, which does not fully address changes in technology  and the marketplace. We recommended that Congress consider  legislation to strengthen the consumer privacy framework to reflect the  effects of changes in technology and the marketplace. Such legislation  has not been enacted.

FTC’s Role and Authorities for Overseeing Internet Privacy

As we reported in January 2019, FTC is primarily a law enforcement  agency with authority to, among other things, address consumer  concerns about Internet privacy, both for Internet service providers and  content providers. It does so using its general authority under section 5 of  the FTC Act, which prohibits “unfair or deceptive acts or practices in or  affecting commerce.”

Even though the FTC Act does not speak in explicit terms about  protecting consumer privacy, the Act authorizes such protection to the  extent it involves practices FTC defines as unfair or deceptive. According  to FTC, an act or practice is “unfair” if it causes, or is likely to cause,  substantial injury not reasonably avoidable by consumers and not  outweighed by countervailing benefits to consumers or competition as a  result of the practice. FTC has used this “unfairness” authority to address  situations where a company has allegedly failed to properly protect  consumers’ data, for example. According to FTC, a representation or  omission is “deceptive” if it is material and is likely to mislead consumers  acting reasonably under the circumstances. FTC has applied this  “deceptiveness” authority to address deceptions related to violations of  written privacy policies and representations concerning data security, for  example.

FTC staff investigate Internet privacy complaints from various sources  and also initiate investigations on their own. If FTC staff have reason to  believe that an entity is engaging in an unfair or deceptive practice, they  may forward an enforcement recommendation to the commission. The  commission then determines whether to pursue an enforcement action.  With certain exceptions, FTC generally cannot directly impose civil  monetary penalties for Internet privacy cases. Instead, FTC typically  addresses Internet privacy cases by entering into settlement agreements  requiring companies to take actions such as implementing reasonable  privacy and security programs. If a company then violates its settlement  agreement with FTC, the agency can request civil monetary penalties in  court for the violations. In addition, FTC can seek to impose civil  monetary penalties directly for violations of certain statutes and their  implementing regulations, such as the statute pertaining to the Internet  privacy of children and its corresponding regulations.

FTC has not promulgated rules under section 5 specific to Internet  privacy. According to FTC staff, the process the agency must use to issue  such rules—known as the Magnuson-Moss procedures—includes steps  that add time and complexity to the rulemaking process. FTC has not  promulgated any regulations using the Magnuson-Moss procedures since  1980. Although FTC has not implemented its section 5 authority by  issuing regulations regarding internet privacy, it has issued regulations  when directed and authorized by Congress to implement other statutory  authorities using a different set of rulemaking procedures. These  procedures, spelled out in section 553 of the Administrative Procedures  Act (APA), are those that most federal agencies typically use to develop  and issue regulations.

APA section 553 establishes procedures and requirements for what is  known as “informal” rulemaking, also known as notice-and-comment  rulemaking. Among other things, section 553 generally requires agencies  to publish a notice of proposed rulemaking in the Federal Register. After  giving interested persons an opportunity to comment on the proposal by  providing “data, views, or arguments,” the statute then requires the  agency to publish the final rule in the Federal Register.

In contrast, the rulemaking procedures that FTC generally must follow to  issue rules under the FTC Act are the Magnuson-Moss procedures noted  above. These are required by the Magnuson-Moss Warranty Act  amendments to the FTC Act and impose additional rulemaking steps  beyond APA section 553. These steps include providing the public and  certain congressional committees with an advance notice of proposed  rulemaking (in addition to the notice of proposed rulemaking). FTC’s  rulemaking under Magnuson-Moss also calls for, among other things, oral  hearings, if requested, presided over by an independent hearing officer,  and preparation of a staff report after the conclusion of public hearings,  giving the public the opportunity to comment on the report.

FTC has promulgated regulations using the APA section 553 notice-and- comment rulemaking procedures when authorized or directed by specific  statutes. For example, the 1998 Children’s Online Privacy Protection Act  (COPPA) required FTC to issue regulations concerning children’s online  privacy; promulgate these regulations using the APA section 553 process;  and, in determining how to treat a violation of the rules, to treat it as an  unfair or deceptive act or practice in most cases. COPPA governs the  online collection of personal information from children under the age of 13  by operators of websites or online services, including mobile applications.  COPPA contained a number of specific requirements that FTC was  directed to implement by regulation, such as requiring websites to post a  complete privacy policy, to notify parents directly about their information  collection practices, and to obtain verifiable parental consent before  collecting personal information from their children or sharing it with others.

Laws and regulations may be enforced in various ways, for example, by  seeking civil monetary penalties for non-compliance. As mentioned, FTC  has authority to seek civil monetary penalties when a company violates a  settlement agreement or certain statutes or regulations. For example, in  March 2018, FTC announced that it is investigating whether Facebook’s  current privacy practices violate a settlement agreement that the  company entered into with FTC. In the case that resulted in the 2012  settlement, FTC had charged Facebook with deceiving consumers by  telling them they could keep their information private, but then allowing it  to be shared and made public. FTC also has authority to seek civil  monetary penalties for violations of the COPPA statute as well as FTC’s  COPPA regulations.

In our January 2019 Internet privacy report, we found that during the last  decade, FTC filed 101 Internet privacy enforcement actions to address  practices that the agency alleged were unfair, deceptive, a violation of  COPPA, a violation of a settlement agreement, or a combination of those  reasons. Most of these actions pertained to first-time violations of the FTC  Act for which FTC does not have authority to levy civil monetary  penalties. In nearly all 101 cases, companies settled with FTC, which  required the companies to make changes in their policies or practices as  part of the settlement.

Stakeholders and FTC Identified Potential Actions to Enhance Federal Oversight of Consumers’ Internet Privacy

Various stakeholders we interviewed for our January 2019 Internet  privacy report said that opportunities exist for enhancing Internet privacy  oversight. Most industry stakeholders said they favored FTC’s current  approach—direct enforcement of its unfair and deceptive practices  statutory authority, rather than promulgating and enforcing regulations  implementing that authority. These stakeholders said that the current  approach allows for flexibility; that regulations could hinder innovation,  create loopholes, and become obsolete; and that rulemakings can be  lengthy. Other stakeholders, including consumer advocates and most  former FTC and FCC commissioners we interviewed, favored having FTC  issue and enforce regulations. Stakeholders said that regulations can  provide clarity, flexibility, and act as a deterrent, and may also promote  fairness by giving companies notice of what actions are prohibited.

Those stakeholders who believe that FTC’s current authority and  enforcement approach is unduly limited identified three main actions that  could better protect Internet privacy: (1) enactment of an overarching  federal privacy statute to establish general requirements governing  Internet privacy practices of all sectors, (2) APA section 553 notice-and- comment rulemaking authority, and (3) civil penalty authority for any  violation of a statutory or regulatory requirement, rather than allowing  penalties only for violations of settlement agreements or consent decrees  that themselves seek redress for a previous statutory or regulatory  violation.

Stakeholders from a variety of perspectives—including academia,  industry, consumer advocacy groups, and former FTC and FCC  commissioners—told us that a statute could enhance Internet privacy  oversight by, for example, clearly articulating to consumers, industry, and  privacy enforcers what behaviors are prohibited. Some stakeholders  suggested that such a framework could either designate an existing  agency (such as FTC) as responsible for privacy oversight or create a  new agency. For example, in Canada, the Office of the Privacy  Commissioner, an independent body that reports directly to the  Parliament, was established to protect and promote individuals’ privacy  rights.

Some stakeholders also stated that the absence of a comprehensive  Internet privacy statute affects FTC’s enforcement. For example, a former  federal enforcement official from another oversight agency said that FTC  is limited in how it can use its authority to take action against companies’  unfair and deceptive trade practices for problematic Internet privacy  practices. Similarly, another former federal enforcement official from  another agency said that FTC is limited in how and against whom it can  use its unfair and deceptive practices authority noting, for example, that it  cannot pursue Internet privacy enforcement against exempted industries.

In addition, some stakeholders said FTC’s section 5 unfair and deceptive  practices authority may not enable it to fully protect consumers’ Internet  privacy because it can be difficult for FTC to establish that Internet  privacy practices are legally unfair. Because of this difficulty, some  stakeholders said that FTC relies more heavily on its authority to take  enforcement action against deceptive trade practices compared with the  agency’s unfair trade practices authority. This is consistent with the  results of our analysis of FTC cases, which showed that in a majority of  the actions FTC settled, FTC alleged that companies engaged in  practices that were deceptive. Furthermore, a recently decided federal  appeals court case illustrates potential limits on FTC’s enforcement  remedies. The court found that FTC could not direct the company, which  was accused of unfair practices, to create and implement comprehensive  data security measures for the personal information the company stored  on its computer networks as a remedy for the practices alleged. Instead,  the court ruled that FTC’s authority was limited to prohibiting specific  illegal practices.

Various stakeholders said that there are advantages to overseeing  Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority. Officials from other consumer and worker  protection agencies we interviewed described their enforcement  authorities and approaches. For example, officials from CFPB and FDA,  both of which use APA section 553 notice-and-comment rulemaking, said  that their rulemaking authority assists in their oversight approaches and  supports their enforcement actions. EEOC officials said that regulations  are used to guide investigations that establish whether enforcement  action is appropriate.

Ability to Levy Civil Penalties for Initial Violations

Some stakeholders suggested that FTC’s ability to levy civil penalties  could also be enhanced. As noted, FTC can levy civil penalties against  companies for violating certain regulations, such as COPPA regulations,  or for violating the terms of a settlement agreement already in place.  According to most former FTC commissioners and some other  stakeholders we interviewed, FTC should be able to levy fines for initial  violations of section 5 of the FTC Act. An academic told us that the power  of an agency to levy a fine is a tangible way to hold industries  accountable.

Breaches Involving Personally Identifiable Information Highlight the Importance of Security and Privacy

Recent data breaches at federal agencies, retailers, hospitals, insurance  companies, consumer reporting agencies, and other large organizations  highlight the importance of ensuring the security and privacy of personally  identifiable information collected and maintained by those entities. Such  breaches have resulted in the potential compromise of millions of  Americans’ personally identifiable information, which could lead to identity  theft and other serious consequences. For example, the breach of an  Equifax online dispute portal from May to July 2017 resulted in the  compromise of records containing the personally identifiable information  of at least 145.5 million consumers in the United States and nearly 1  million consumers outside the United States. We reported in August 2018  that Equifax’s investigation of the breach identified four major factors—  identification, detection, segmenting of access to databases, and data  governance—that allowed the attacker to gain access to its network and  extract information from databases containing personally identifiable  information. In September 2017, FTC and CFPB, which both have  regulatory and enforcement authority over consumer reporting agencies  such as Equifax, initiated an investigation into the breach and Equifax’s  response. Their investigation is ongoing.

According to a 2017 National Telecommunications and Information  Administration (NTIA) survey conducted by the U.S. Census Bureau, 24  percent of American households surveyed avoided making financial  transactions on the Internet due to privacy or security concerns. NTIA’s  survey results show that privacy concerns may lead to lower levels of  economic productivity if people decline to make financial transactions on the Internet. Consumers who were surveyed indicated that their specific  concerns were identity theft, credit card or banking fraud, data collection  by online services, loss of control over personal information, data  collection by government, and threats to personal safety.

Recent data breaches and developments regarding Internet privacy  suggest that this is an appropriate time for Congress to consider what  additional actions are needed to protect consumer privacy, including  comprehensive Internet privacy legislation. Although FTC has been  addressing Internet privacy through its unfair and deceptive practices  authority and FTC and other agencies have been addressing this issue  using statutes that target specific industries or consumer segments, the  lack of a comprehensive federal privacy statute leaves consumers’  privacy at risk. Comprehensive legislation addressing Internet privacy that  establishes specific standards and includes APA notice-and-comment  rulemaking and first-time violation civil penalty authorities could enhance  the federal government’s ability to protect consumer privacy, provide  more certainty in the marketplace as companies innovate and develop  new products using consumer data, and provide better assurance to  consumers that their privacy will be protected. In our January 2019 report,  we recommended that Congress consider developing comprehensive  legislation on Internet privacy that would enhance consumer protections  and provide flexibility to address a rapidly evolving Internet environment.  Issues that should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee  Internet privacy, including notice-and-comment rulemaking authority  and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s  ability to provide services and innovate.

Chairman Portman, Ranking Member Carper, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions you may have at this time.

For further information regarding this testimony, please contact Alicia  Puente Cackley at (202) 512-8678 or cackleya@gao.gov or Mark  Goldstein at (202) 512-2834 or goldsteinm@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this statement.

Individuals who made key contributions to this testimony include Andrew  Huddleston, Assistant Director; Kay Kuhlman, Assistant Director; Bob  Homan, Analyst-in-Charge; Melissa Bodeau; John de Ferrari; Camilo  Flores; Nick Marinos, and Sean Standley.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

This testimony focuses on the Federal Trade Commission's authority to oversee Internet privacy and security. Without a comprehensive federal data privacy law, the United States relies in part on FTC to use its broad authority to protect consumers from unfair and deceptive trade practices.

Most industry representatives we interviewed favored the current approach and warned that further regulations could hinder innovation.

Consumer advocates and most of the former FTC and FCC commissioners we interviewed favored having FTC issue and enforce regulations.

We previously recommended Congress consider comprehensive Internet privacy legislation.