1.4 Supervisory Agencies
As stated above, the FTC has become the leading privacy enforcement agency in the
United States.
46 Today, the agency has even extended its jurisdiction to include
undertaking consumer protection enforcement actions against foreign companies
that do business in the U.S.
47 Using its authority arising out of Section 5 of the
Federal Trade Commission Act, the FTC has taken a leading role in bringing privacy
deception and unfair trade practices cases and enforcement actions.
48 Illustrating the
breadth of the agency’s expanded reach, as of November 2013, the agency had
brought “134 spam and spyware cases, 108 Do Not Call cases against telemarketers,
97 Fair Credit Reporting Act lawsuits involving credit-reporting problems, 47 data
security cases, 44 general privacy lawsuits, and 21 actions under the Children’s
Online Privacy Protection Act (“COPPA”)”.
49
As Congress has continued to pass sector-specific privacy legislation, it has
continued to enhance the FTC’s enforcement role. The agency also reports to
Congress and recommends the enactment of additional privacy-related legislation.
50
Perhaps more importantly, the broadening reach of the FTC’s enforcement actions
and consent decrees have fueled the growth of a “new common law of privacy”.
51
Professors Daniel Solove and Woodrow Hartzog have argued that, because the
FTC’s enforcement actions nearly always result in settlement agreements, the
content of those agreements have, in effect, become a new common law of privacy
that companies look for guidance in developing privacy practices.
52
Although the FTC also enforces the GLB Act, federal banking agencies as well as
state level insurance agencies may also bring actions under the Act.
53 HIPPA is
enforced by the Office of Civil Rights within the U.S. Department of Health and
Human Services.
54 In addition to the enforcement powers of federal agencies, state
consumer protection regulators (usually the state Attorney General) also exercise
privacy regulatory authority.
55
46 See Sect. I(B).
47 Brill (2012).
48 Raul et al. (2014), p. 284.
49 Privacy Enforcement and Safe Harbor: Comments of FTC Staff to European Commission Review
of the U.S.-EU Safe Harbor Framework (November 12, 2013). Available online at: https://www.ftc.
gov/sites/default/files/documents/public_statements/privacy-enforcement-safe-harbor-commentsftc-staff-european-commission-review-u.s.eu-safe-harbor-framework/
131112europeancommissionsafeharbor.pdf.
50 Jolly (2016), Sect. 25.
51 Solove and Hartzog (2014), p. 583.
52 Id. at pp. 611–627.
53 Jolly (2016), Sect. 25.
54 Id.
55 Raul et al. (2014), p. 284.
Data Protection in the United States: U.S. National Report
415
As stated above, the FTC has become the leading privacy enforcement agency in the
United States.
46 Today, the agency has even extended its jurisdiction to include
undertaking consumer protection enforcement actions against foreign companies
that do business in the U.S.
47 Using its authority arising out of Section 5 of the
Federal Trade Commission Act, the FTC has taken a leading role in bringing privacy
deception and unfair trade practices cases and enforcement actions.
48 Illustrating the
breadth of the agency’s expanded reach, as of November 2013, the agency had
brought “134 spam and spyware cases, 108 Do Not Call cases against telemarketers,
97 Fair Credit Reporting Act lawsuits involving credit-reporting problems, 47 data
security cases, 44 general privacy lawsuits, and 21 actions under the Children’s
Online Privacy Protection Act (“COPPA”)”.
49
As Congress has continued to pass sector-specific privacy legislation, it has
continued to enhance the FTC’s enforcement role. The agency also reports to
Congress and recommends the enactment of additional privacy-related legislation.
50
Perhaps more importantly, the broadening reach of the FTC’s enforcement actions
and consent decrees have fueled the growth of a “new common law of privacy”.
51
Professors Daniel Solove and Woodrow Hartzog have argued that, because the
FTC’s enforcement actions nearly always result in settlement agreements, the
content of those agreements have, in effect, become a new common law of privacy
that companies look for guidance in developing privacy practices.
52
Although the FTC also enforces the GLB Act, federal banking agencies as well as
state level insurance agencies may also bring actions under the Act.
53 HIPPA is
enforced by the Office of Civil Rights within the U.S. Department of Health and
Human Services.
54 In addition to the enforcement powers of federal agencies, state
consumer protection regulators (usually the state Attorney General) also exercise
privacy regulatory authority.
55
46 See Sect. I(B).
47 Brill (2012).
48 Raul et al. (2014), p. 284.
49 Privacy Enforcement and Safe Harbor: Comments of FTC Staff to European Commission Review
of the U.S.-EU Safe Harbor Framework (November 12, 2013). Available online at: https://www.ftc.
gov/sites/default/files/documents/public_statements/privacy-enforcement-safe-harbor-commentsftc-staff-european-commission-review-u.s.eu-safe-harbor-framework/
131112europeancommissionsafeharbor.pdf.
50 Jolly (2016), Sect. 25.
51 Solove and Hartzog (2014), p. 583.
52 Id. at pp. 611–627.
53 Jolly (2016), Sect. 25.
54 Id.
55 Raul et al. (2014), p. 284.
Data Protection in the United States: U.S. National Report
415