Although the FTC’s primary legal authority comes from Section 5 of the Federal
Trade Commission Act, which prohibits unfair or deceptive practices in the marketplace, the agency also has authority to enforce a variety of sector specific laws,
including the Truth in Lending Act, the CAN-SPAM Act, the Children’s Online
Privacy Protection Act, the Equal Credit Opportunity Act, the Fair Credit Reporting
Act, the Fair Debt Collection Practices Act, and the Telemarketing and Consumer
Fraud and Abuse Prevention Act.
56 The Commission is empowered to bring enforcement actions to stop violations of the law and to force companies to take affirmative
steps to remediate their unlawful behavior. These steps include: “implementation of
comprehensive privacy and security programs, biennial assessments by independent
experts, monetary redress to consumers, disgorgement of ill-gotten gains, deletion of
illegally obtained consumer information, and provision of robust transparency and
choice mechanisms to consumers”.
57 In addition, FTC has the power to seek civil
monetary penalties against organizations or individuals who violate the FTC Act, as
well as against entities that violate the Children’s Online Privacy Protection Act, the
Fair Credit Reporting Act, and the Telemarketing Sales Rule.
58 The forms of relief
for privacy violations that the FTC has secured include injunctive relief, damages,
and consent decrees which require companies to submit to the FTC’s ongoing
oversight and to implement controls, audits, and other privacy enhancing processes
during a period of time that can span decades.
59
1.5 Self-Regulation Instruments and Data Protection
The Network Advertising Initiative, formed in 1999, is a robust self-regulation
framework that is comprised exclusively of third-party digital advertising companies. The NAI relies on a thorough new member review process, technical monitoring tools, and investigation of consumer concerns to encourage compliance with the
organizations Self-Regulatory Code of Conduct.
60 According to NAI’s 2015 Update
to the Code of Conduct, the organization may impose sanctions, including suspension or revocation of membership and may refer the matter to the Federal Trade
Commission for non-compliance.
61 In addition, the NAI may publicly name a
company or the violation in its annual compliance report, and in the press, when
56 Federal Trade Commission, Privacy & Data Security Update (2016). Available online at: https://
www.ftc.gov/reports/privacy-data-security-update-2016.
57 Id.
58 Id.
59 Id.
60 “Enforcement”, Network Advertising Initiative (April 2016). Available at https: www.
networkadvertising.org/code-enforcement/enforcement.
61 Id.
416
S. M. Boyne
Trade Commission Act, which prohibits unfair or deceptive practices in the marketplace, the agency also has authority to enforce a variety of sector specific laws,
including the Truth in Lending Act, the CAN-SPAM Act, the Children’s Online
Privacy Protection Act, the Equal Credit Opportunity Act, the Fair Credit Reporting
Act, the Fair Debt Collection Practices Act, and the Telemarketing and Consumer
Fraud and Abuse Prevention Act.
56 The Commission is empowered to bring enforcement actions to stop violations of the law and to force companies to take affirmative
steps to remediate their unlawful behavior. These steps include: “implementation of
comprehensive privacy and security programs, biennial assessments by independent
experts, monetary redress to consumers, disgorgement of ill-gotten gains, deletion of
illegally obtained consumer information, and provision of robust transparency and
choice mechanisms to consumers”.
57 In addition, FTC has the power to seek civil
monetary penalties against organizations or individuals who violate the FTC Act, as
well as against entities that violate the Children’s Online Privacy Protection Act, the
Fair Credit Reporting Act, and the Telemarketing Sales Rule.
58 The forms of relief
for privacy violations that the FTC has secured include injunctive relief, damages,
and consent decrees which require companies to submit to the FTC’s ongoing
oversight and to implement controls, audits, and other privacy enhancing processes
during a period of time that can span decades.
59
1.5 Self-Regulation Instruments and Data Protection
The Network Advertising Initiative, formed in 1999, is a robust self-regulation
framework that is comprised exclusively of third-party digital advertising companies. The NAI relies on a thorough new member review process, technical monitoring tools, and investigation of consumer concerns to encourage compliance with the
organizations Self-Regulatory Code of Conduct.
60 According to NAI’s 2015 Update
to the Code of Conduct, the organization may impose sanctions, including suspension or revocation of membership and may refer the matter to the Federal Trade
Commission for non-compliance.
61 In addition, the NAI may publicly name a
company or the violation in its annual compliance report, and in the press, when
56 Federal Trade Commission, Privacy & Data Security Update (2016). Available online at: https://
www.ftc.gov/reports/privacy-data-security-update-2016.
57 Id.
58 Id.
59 Id.
60 “Enforcement”, Network Advertising Initiative (April 2016). Available at https: www.
networkadvertising.org/code-enforcement/enforcement.
61 Id.
416
S. M. Boyne