Citation[]
Internet Privacy: Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility (GAO-19-52) (Jan. 15, 2019) (full-text).
Overview[]
The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under Section 5 of the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date the FTC has not issued regulations for Internet privacy other than those protecting Financial privacy and the Internet privacy of children, which were required by law. For FTC violations, the FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity.
In the last decade, the FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, the FTC did not levy civil penalties because it lacked such authority for those particular violations.
The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, the FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, the FCC promulgated privacy rules for Internet service providers that Congress later repealed. The FTC resumed privacy oversight of Internet service providers in June 2018.
Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced:
- Statute. Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited.
- Rulemaking. Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions.
- Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of Section 5 of the FTC Act.
Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy.