The Key to Protecting Privacy Is Locked in an Underfunded Government Agency
Reading Time: 6 minutesThe Shockingly Small Team in Charge of Protecting Millions of Americans’ Privacy, If Congress wants to protect Americans’ data, it needs to increase funding for the Federal Trade Commission., To protect Americans’ privacy, Congress needs to increasing fund
Amazon told its users they could delete voice recordings gathered by the Alexa smart speaker and location data gathered by the Alexa app—but Amazon actually kept some of that data for years. Even worse, Amazon kept voice recordings from children indefinitely. That’s all according to the Federal Trade Commission, which, along with the Department of Justice, recently charged Amazon for deceiving parents and violating a children’s privacy law.
The complaint against Amazon follows a MediaDownloader of recent FTC enforcement actions, each targeting violations of Americans’ privacy and abuses of their data. Last August, the agency sued location-data broker Kochava for selling mobile location data that could be used to track hundreds of millions of people (a saga that is still unfolding, after a court dismissed the lawsuit and the FTC refiled). In February, the FTC proposed a $1.5 million fine for telehealth and prescription drug company GoodRx, which the agency says shared consumers’ health data with Facebook, Google, and other companies; in March, it proposed a $7.8 million settlement with online counseling service BetterHelp, which it says secretly shared consumers’ health data—including identifiable mental health data, such as experiences with depression and thoughts of suicide—with third parties. The privacy enforcement actions keep coming.
But there’s a little-known fact: The team doing much of this work is comprised of just a few dozen people. Among tech-focused government organizations, the FTC’s privacy team punches well above its weight, rolling out enforcement actions covering data about health, mental health, children, geolocation, and more. Congress, meanwhile, has stalled on passing comprehensive federal privacy legislation. While that debate continues, Congress can do something much quicker to help further protect Americans’ privacy in the short term, in a way that will complement a future privacy law: give more money to the FTC’s privacy and enforcement staff.
The FTC has worked to protect Americans from companies’ privacy and cybersecurity abuses for decades. Principally, this authority derives from Section 5 of the FTC Act, which makes it unlawful for companies to engage in ‘unfair methods of competition’ and ‘unfair or deceptive acts or practices’ related to commerce. An act or practice is considered unfair if it ’causes or is likely to cause substantial injury to consumers’ that is not ‘reasonably avoidable’ or ‘outweighed by the countervailing benefits to consumers or to competition.’ Deception happens when ‘there is a representation, omission, or practice that is likely to mislead the consumer acting reasonably in the circumstances, to the consumer’s detriment.’
The website GeoCities was the subject of the FTC’s first internet privacy case. Its settlement was announced on Aug. 13, 1998, and in hindsight, it was even more groundbreaking than it already seemed at the time: GeoCities told users it would not share ‘optionally’ inputted information with third parties—including education level, income, marital status, occupation, and interests—but did so anyway. It also misrepresented the fact that third parties were collecting data on child visitors. (This was right before the 1998 passage of the Children’s Online Privacy Protection Act, which went into effect in 2000 and which the FTC now enforces.) ‘We are losing patience with self-regulation,’ David Medine, of the FTC’s Bureau of Consumer Protection, said at the time. ‘It’s too bad, but I think industry has lost the opportunity to show that they will do it on their own.’
Today, the FTC’s Bureau of Consumer Protection has its own Division of Privacy and Identity Protection, which oversees consumer privacy, credit reporting, identity theft, and information security issues under the commission’s authority. Recently, the FTC has also brought more attention to data brokers—companies engaged in the highly invasive and harmful practice of collecting, selling, and sharing Americans’ data. Premom, the fertility tracking app, was one of the latest to receive an FTC response to its data-abusive behavior. The app told users that it was not sharing their health and other data with third parties when it was indeed doing so, the agency says. Yet, according to a 2021 FTC report, the entire Division of Privacy and Identity Protection—the team responsible for much of this work—has only 40 to 45 employees. (The FTC confirmed via email that this figure is still accurate.)
This is extraordinary given the division’s case output. Each one of the cases mentioned above (and detailed on the commission website) is the culmination of months of conducting deep investigations, identifying risks and harms, writing up arguments, coordinating (if needed) with other agencies and departments (like the Department of Justice), and in some cases working with companies to impose fines, reach settlements, and finalize agreements that will prevent similar future data abuses. Put simply, these cases are no easy task. They require significant work, as well as legal and, increasingly, technological expertise. In a market rife with privacy abuses, it’s also challenging to identify where to focus limited resources.
The size of the FTC’s team pales in comparison to those of foreign counterparts. The U.K.’s Information Commissioner’s office, which does privacy enforcement, has more than 700 employees; Ireland’s Data Protection Commissioner has about 150, per that 2021 FTC report. Germany’s Data Protection Agency has around 745 staff, and France’s has about 200. While each country has different laws, the FTC has far fewer resources, while still bearing responsibility for protecting the privacy of hundreds of millions of people. Ashkan Soltani, the FTC’s former chief technologist, testified to Congress in 2021 that the privacy team ‘simply does not have enough resources to police an industry that touches nearly every aspect of the American economy,’ and that the agency’s Division of Enforcement is likewise short-staffed, despite being tasked with monitoring compliance for every single consent decree agreement the FTC reaches with companies. Tech expertise, Soltani noted, is another gap that more resources could help fill.
There’s some recognition of this, evidenced by the fact that the FTC’s budget has increased pretty steadily over the past several years—the 2023 budget is $430 million, up from $306 million in 2018. Still, it hasn’t kept pace with the data economy and the prevalence of unfair or deceptive uses of that data, and as a result, resources are still stretched thin across numerous areas, to privacy’s detriment.
Congress needs to step in. Legislators should absolutely pass a comprehensive federal privacy law. But any new law on data privacy will require increased enforcement, which also means increased funding. Past battles over Big Oil, for example, make it clear that once industry lobbyists weaken a bill as much as possible, they will try to attack and gut the means of enforcing it.
The FTC itself is intentionally headed by a bipartisan group: It has five commissioners, and no more than three can be from the same party. Today, it is chaired by Lina Khan, alongside two other Democratic commissioners and two empty seats—but President Joe Biden recently nominated two Republicans to fill the open positions. Some Republicans in Congress have criticized the direction the FTC has taken under Khan’s leadership—which has, in turn, partly posed a barrier to more funding. Some of that criticism is partisan, advanced well before Khan came into the role, and some reflects genuine concerns about lower morale and the FTC’s case processes, including around antitrust. Privacy itself, however, is generally a bipartisan issue. Even when former Republican Commissioner Christine Wilson raised process concerns in her statement on the GoodRx case, for example, she expressed support for the penalties to GoodRx—in fact argued they should have been larger—and stressed that career staff are ‘dedicated professionals who work across administrations that bring shifting priorities and policies to the agency.’ Political disagreements about antitrust and leadership policy should not impede the FTC’s ability to staff its crucial privacy mission.
On the Congressional side, the American Data Privacy Protection Act, or ADPPA—the comprehensive privacy law introduced in the last Congress and likely to be reintroduced in the current session—is sponsored by both Democrats and Republicans. (If ADPPA passes, it too would need to be paired with an increase in FTC resources, because it requires the FTC to enforce the law.) I frequently speak with Congressional staff on both sides of the aisle who find the FTC’s privacy enforcement actions to be important because of similar concerns about abuses of Americans’ data.
There is strong reason for Congress to give the FTC additional funding to bolster this element of privacy enforcement. After all, the FTC’s recent cases—ranging from companies indefinitely keeping children’s voice recordings to companies lying to their customers and secretly sharing health data—are just the tip of the iceberg. If consumers are to be protected against everything right below the surface, while waiting on Congress to pass a major privacy law, the FTC’s privacy team needs more resources to make it happen.
Reference: https://slate.com/technology/2023/07/federal-trade-commission-funding-privacy.html
Ref: slate
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG