which is empowered to bring enforcement actions under Section 5 of the FTC Act
targeting unfair
242 or deceptive
243 data processing practices. In addition to the FTC,
the Consumer Financial Protection Bureau, the Department of Health and Human
Services (“HHS”) and the 50 state Attorneys General all possess various levels of
enforcement responsibility.
6.1 Gramm-Leach-Bliley Act
Penalties for violations under the Gramm-Leach-Bliley Act (“GLBA”),
244 vary
depending upon the specific authority of the agency that brings the enforcement
action. For example, if the Federal Trade Commission brings the action pursuant to
Section 5(l) of the FTC Act, the penalties may run up to $40,000 per offense.
245 The
FTC Act does not create a private cause of action. Nor can the FTC impose fines for
violations of Section 5. Instead the Act authorizes injunctive remedies and issue fines
for violations of Section 5 consent decrees.
246 The Federal Consumer Financial
Protection Bureau (“CFPB”) can bring administrative adjudication enforcement
actions or actions in federal district court against individuals or entities that violate
federal consumer financial laws pursuant to the provisions of the Dodd-Frank Wall
Street Reform and Consumer Protection Act.
In a new development, the CFPB has begun to use its authority to regulate unfair,
deceptive, or abusive acts or practices to bring data security related enforcement
actions even in cases where consumers have not experienced a discernable harm.
247
In a recent case, the CFPB entered into a consent decree with Dwolla, Inc.
(“Dwolla”), an online payment platform, for alleged misrepresentations regarding
Dwolla’s data security practices.
248 According to the CFPB, Dwolla, which collects
and stores consumers’ sensitive personal information and provides a platform for
242 An act or practice is unfair where it (1) causes or is likely to cause substantial injury to
consumers, (2) cannot be reasonably avoided by consumers; and (3) is not outweighed by
countervailing benefits to consumers or to competition. See “Consumer Compliance Handbook:
Federal Trade Commission Act Section 5: Unfair or Deceptive Acts or Practices”, Federal Reserve
Supervisor’s Handbook, at 7. Available online at: https://www.federalreserve.gov/boarddocs/
supmanual/cch/ftca.pdf.
243 “A representation, omission, or practice is deceptive if it is likely to mislead a consumer acting
reasonably under the circumstances and is likely to affect a consumer’s conduct or decision
regarding a product or service” Id. at 7.
244 Title V, 15 U.S.C. §§6801–6809.
245 Fair (2016). The Federal Trade Commission (“FTC”) may bring an administrative hearing
against an individual or entity, suspected of unfair or deceptive trade practices and subsequently
issue an order to cease and desist. If the individual or entity subject to the order violates that order,
the FTC may impose an administrative fine.
246 Solove and Hartzog (2014), p. 159.
247 Id.
248 Tosi et al. (2016).
442
S. M. Boyne
targeting unfair
242 or deceptive
243 data processing practices. In addition to the FTC,
the Consumer Financial Protection Bureau, the Department of Health and Human
Services (“HHS”) and the 50 state Attorneys General all possess various levels of
enforcement responsibility.
6.1 Gramm-Leach-Bliley Act
Penalties for violations under the Gramm-Leach-Bliley Act (“GLBA”),
244 vary
depending upon the specific authority of the agency that brings the enforcement
action. For example, if the Federal Trade Commission brings the action pursuant to
Section 5(l) of the FTC Act, the penalties may run up to $40,000 per offense.
245 The
FTC Act does not create a private cause of action. Nor can the FTC impose fines for
violations of Section 5. Instead the Act authorizes injunctive remedies and issue fines
for violations of Section 5 consent decrees.
246 The Federal Consumer Financial
Protection Bureau (“CFPB”) can bring administrative adjudication enforcement
actions or actions in federal district court against individuals or entities that violate
federal consumer financial laws pursuant to the provisions of the Dodd-Frank Wall
Street Reform and Consumer Protection Act.
In a new development, the CFPB has begun to use its authority to regulate unfair,
deceptive, or abusive acts or practices to bring data security related enforcement
actions even in cases where consumers have not experienced a discernable harm.
247
In a recent case, the CFPB entered into a consent decree with Dwolla, Inc.
(“Dwolla”), an online payment platform, for alleged misrepresentations regarding
Dwolla’s data security practices.
248 According to the CFPB, Dwolla, which collects
and stores consumers’ sensitive personal information and provides a platform for
242 An act or practice is unfair where it (1) causes or is likely to cause substantial injury to
consumers, (2) cannot be reasonably avoided by consumers; and (3) is not outweighed by
countervailing benefits to consumers or to competition. See “Consumer Compliance Handbook:
Federal Trade Commission Act Section 5: Unfair or Deceptive Acts or Practices”, Federal Reserve
Supervisor’s Handbook, at 7. Available online at: https://www.federalreserve.gov/boarddocs/
supmanual/cch/ftca.pdf.
243 “A representation, omission, or practice is deceptive if it is likely to mislead a consumer acting
reasonably under the circumstances and is likely to affect a consumer’s conduct or decision
regarding a product or service” Id. at 7.
244 Title V, 15 U.S.C. §§6801–6809.
245 Fair (2016). The Federal Trade Commission (“FTC”) may bring an administrative hearing
against an individual or entity, suspected of unfair or deceptive trade practices and subsequently
issue an order to cease and desist. If the individual or entity subject to the order violates that order,
the FTC may impose an administrative fine.
246 Solove and Hartzog (2014), p. 159.
247 Id.
248 Tosi et al. (2016).
442
S. M. Boyne