Chris Jay Hoofnagle

Assessing the Federal Trade Commission's Privacy Assessments

Regulators worldwide need to keep tabs on companies caught violating consumer protection rules. Assessments by outside accounting firms are a key tool for regulators to detect privacy and security problems. Its not widely known that an assessment, a term of art in accounting, is a less-intense evaluation than an audit. Also, in practice, assessments overseen by Americas top consumer protection cop, the US Federal Trade Commission, fall short of whats needed to ensure that information-intensive companies are protecting privacy and honoring promises. This article outlines five practical steps to make company oversight more effective.

Online pharmacies and technology crime

Online pharmacies are businesses that sell prescription-controlled drugs over the internet. Some online pharmacies operate illegally in the United States, by providing controlled pharmaceuticals without a prescription, and some pharmacies sell controlled substances. Online pharmacies are also a major driver of other kinds of computer crime because in order to gain consumers’ attention, pharmacies and their marketers send tremendous volumes of spam email and engage in other tactics that involve computer intrusions, such as the creation of botnets. Online pharmacies are both an enduring technology crime challenge, and a lens for understanding cybercrime. This chapter introduces the problem of illegal online pharmacies and the intense law enforcement efforts to end their operation. To provide background for the cybercrime challenge presented by online pharmacies, the chapter explains the methods that such businesses use to promote their visibility in organic search engine results. The methods used to promote online pharmacies show that they have dynamics similar to retail-style businesses, where a firm needs to reach a large number of customers. This chapter also presents data from an empirical experiment examining how pharmacies achieve top-ranked status in U.S.-based, English-language search engine results. In our sample, over a third of the inbound links to pharmacies in top search results appear to be from hacked websites. In analyzing links among the pharmacies, we find that online pharmacies are highly concentrated, often employing shared infrastructure (such as phone numbers). We conclude with a discussion of opportunities for U.S. law enforcement to address pharmacies directly instead of pursuing intermediaries, and consider whether pharmacies can be liable for illegal search engine optimization techniques used to promote their sites. Because online pharmacies’ infrastructure is so interdependent, minor, targeted law enforcement interventions could disrupt a large number of the most successful online pharmacies. Online pharmacies’ operation thus contradicts popular libertarian narratives that the internet is an ungovernable medium.

Unfair and deceptive practices

In enacting the Wheeler–Lea Amendments to the Federal Trade Commission Act in 1938, Congress dramatically expanded the power of the Federal Trade Commission. Congress broadened the FTCs organic power from the prevention of “unfair methods of competition in commerce” to include prevention of “unfair or deceptive acts or practices in commerce.” Theories of unfairness and deception now form the basis of FTC privacy law. This chapter traces the contours of this broad prohibition, focusing on the case-by-case development of the doctrine and policy statements. It is analyzed separately here from the subject-matter chapters in Part II because the FTCs authorities to police unfair and deceptive trade practices are broader than many realize in privacy cases. This chapter makes clear that the FTC could go further in policing privacy practices based on precedent in advertising and other cases. Furthermore, the development of the substantiation doctrine (discussed below) could have profound effects on the market for privacy-protective services when competition on privacy begins in earnest. Cynics say that the commission does not use an objective or standardized definition of unfairness and deception. There is some truth to that, in part because, by statute and by custom, courts defer to the Commissions judgment concerning what is deceptive and unfair. As we saw in Chapter 1, Congress affirmatively made a policy decision to choose vague language in 1914 and again in 1938 because business practices and technology were constantly evolving, causing new problems that Congress could not quickly act to remedy. Section 5 does not have a static meaning, and lawyers will always have to grapple with its application in new business contexts. As two FTC attorneys put it in 1962, “[Section 5] cannot be defined in terms of constants. More broadly, it is a recognition of an ever-evolving commercial dexterity and the personal impact of economic power as important dimensions of trade. Its underlying proposition is that a free competitive society must have some means of preventing that very freedom to compete from destroying our economic system.” It is also clear that Congress chose to free the FTC from the restraints imposed by the common law in fraud matters. Yet, imposing common law requirements tends to be the first kind of reform proposed by critics of the FTC.

US Regulatory Values and Privacy Consequences

Europeans face a regulatory challenge: how can the human rights and dignitary values that animate data protection law be protected in transborder data flows? With the proposal of the EU-US Privacy Shield, part of the challenge will be answered by the US Federal Trade Commission (FTC). The FTC is a small but powerful US agency established in 1914 to address problems of monopoly and trust. Shortly after its creation, the FTC turned its attention to consumer issues. Over the years, Congress has repeatedly empowered the FTC, and the agency has accomplished much on privacy matters. In a recent book, I recount the FTC’s privacy successes.But this article focuses on the limits of the FTC’s powers. The American business community has eschewed dignity as a privacy value in favor of economistic conceptions of privacy interests. This article explains how the FTC’s focus on economic liberty constrains how it can protect Europeans’ normative interests in privacy. First, this article recounts why the FTC has to find economic pretenses to extend its reach to normative, dignity-based affronts to personality. The article then discusses the structural limits of the FTC and how these limits constrain privacy enforcement. The article concludes with a discussion of instruments that could bridge the gap between the FTC’s economistic conceptions and the values Europeans place in data protection.