penalties for violations of the Children’s Online Privacy Protection Act,
257 the Fair
Credit Reporting Act,
258 and the Telemarketing Sales Rule.
259
If the FTC believes that a person or company has violated the law, the agency’s
first step is often to obtain voluntary compliance by entering into a consent order
with the company.
260 A company that signs a consent order needs not liability, but it
must agree to stop the disputed practices, consent to the entry of a final order, and
waive its rights to a judicial review.
261 Before an order is made final, the FTC will
place an order on the record for 30 days of public comment.
262 Through its
administrative powers, the FTC may require companies to implement comprehensive privacy and security programs, submit to biennial assessments by independent
experts, provide monetary redress to consumers, return ill-gotten gains, delete
illegally obtained consumer information, and implement robust transparency and
choice mechanisms to consumers.
263
In the absence of a consent order, the FTC may initiate an administrative
complaint. Respondents may appeal decisions made by an administrative law
judge to the Commission. A Commission’s decision may be appealed to a
U.S. Court of Appeals and ultimately to the Supreme Court. As an alternative to
seeking administrative relief, the FTC may seek injunctive relief in the federal
courts.
264 In addition, if the company violates an FTC order, the Commission also
may seek civil penalties or an injunction.
265
6.3 HIPPA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) authorizes the U.S. Department of Health and Human Services (HHS) to impose civil
penalties on any person who violates the HIPAA Privacy Standards, at an amount of
257 15 USC § 6501 et. seq. COPPA also gives states and certain other federal agencies authority to
enforce compliance. Because COPAA violations are considered to be unfair or deceptive trade
practices and are therefore subject to the same administrative penalties as set forth under the
FTC Act.
258 15 U.S.C. §1681.
259 16 U.S.C. §310.
260 “The Enforcers”, Federal Trade Commission Website. Available online at: https://www.ftc.gov/
tips-advice/competition-guidance/guide-antitrust-laws/enforcers.
261 “A Brief Overview of the Federal Trade Commission’s Investigative and Law Enforcement
Authority”, Federal Trade Commission Website (July 2008). Available online at: https://www.ftc.
gov/about-ftc/what-we-do/enforcement-authority#N_1_ [hereinafter “A Brief Overview”].
262 Id.
263 “Privacy & Data Security Update (2016)”, FTC Website. Available online at: https://www.ftc.
gov/reports/privacy-data-security-update-2016.
264 15 U.S.C. § 53(b).
265 A Brief Overview, supra note 261.
444
S. M. Boyne
257 the Fair
Credit Reporting Act,
258 and the Telemarketing Sales Rule.
259
If the FTC believes that a person or company has violated the law, the agency’s
first step is often to obtain voluntary compliance by entering into a consent order
with the company.
260 A company that signs a consent order needs not liability, but it
must agree to stop the disputed practices, consent to the entry of a final order, and
waive its rights to a judicial review.
261 Before an order is made final, the FTC will
place an order on the record for 30 days of public comment.
262 Through its
administrative powers, the FTC may require companies to implement comprehensive privacy and security programs, submit to biennial assessments by independent
experts, provide monetary redress to consumers, return ill-gotten gains, delete
illegally obtained consumer information, and implement robust transparency and
choice mechanisms to consumers.
263
In the absence of a consent order, the FTC may initiate an administrative
complaint. Respondents may appeal decisions made by an administrative law
judge to the Commission. A Commission’s decision may be appealed to a
U.S. Court of Appeals and ultimately to the Supreme Court. As an alternative to
seeking administrative relief, the FTC may seek injunctive relief in the federal
courts.
264 In addition, if the company violates an FTC order, the Commission also
may seek civil penalties or an injunction.
265
6.3 HIPPA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) authorizes the U.S. Department of Health and Human Services (HHS) to impose civil
penalties on any person who violates the HIPAA Privacy Standards, at an amount of
257 15 USC § 6501 et. seq. COPPA also gives states and certain other federal agencies authority to
enforce compliance. Because COPAA violations are considered to be unfair or deceptive trade
practices and are therefore subject to the same administrative penalties as set forth under the
FTC Act.
258 15 U.S.C. §1681.
259 16 U.S.C. §310.
260 “The Enforcers”, Federal Trade Commission Website. Available online at: https://www.ftc.gov/
tips-advice/competition-guidance/guide-antitrust-laws/enforcers.
261 “A Brief Overview of the Federal Trade Commission’s Investigative and Law Enforcement
Authority”, Federal Trade Commission Website (July 2008). Available online at: https://www.ftc.
gov/about-ftc/what-we-do/enforcement-authority#N_1_ [hereinafter “A Brief Overview”].
262 Id.
263 “Privacy & Data Security Update (2016)”, FTC Website. Available online at: https://www.ftc.
gov/reports/privacy-data-security-update-2016.
264 15 U.S.C. § 53(b).
265 A Brief Overview, supra note 261.
444
S. M. Boyne