Code-breaker: what can the FTC do?

By Wayne Wickham on January 31, 2014

ftc-federal-trade-commissionNow, I am no lawyer or private investigator, but I was moved to a bit of sleuthing this week while pondering the authority of the Federal Trade Commission (FTC).

Much has been written about the FTC’s authority to make judgments as to the adequacy of a firm’s data protection and Point of Sale (POS) security systems.

To my mind, it seemed logical that Congress could easily fix this problem if there is indeed a hole in the FTC Code.

First, I went to the FTC website and really found nothing, so I went on to the US Code. Title 15 – Commerce and Trade, to be precise.

Here, it appears to me that the FTC is granted authority—albeit in a piece meal fashion.

Title 15 of the US Code has 110 chapters on subjects from Y2K and privacy, to online shopper protection. There are also other areas such as intellectual property and cyber security research.

“There is bound to be something in here to straighten this misunderstanding out,” I thought.

Here is what I found:

Chapter 110-Online Shopper Protection (§ 8401-8405): This chapter identifies aggressive sales tactics used on the internet to be regulated.

Chapter 94-Privacy (§ 6801-6809): This chapter identifies protection of non-public personal information by “financial” institutions.

A few other chapters touch on the subject, like the Consumer Product Safety Commission, which regulates products that cause consumer injuries.

Now this may be the crux of the issue and driver of much of the litigation surrounding internet privacy: Was the consumer actually injured or damaged?

Most of the information out so far suggests consumers are not.

I left my brief investigation feeling somewhat confused. So, I call to any lawyers out there to respond to my mingling in their arena. Please email me or comment below to put me out of my misery.

Wayne Wickham is manager of MSCAd at Advisen. He is responsible for the property & casualty, professional liability, and specialty risk content in MSCAd, focusing on developing the database of cyber events and cases in MSCAd. Wayne is Advisen’s expert in cyber risk management and has 35 years of experience in the insurance industry.