Woodrow Hartzog of Samford's Cumberland School of Law and Stanford's Center for Internet and Society and Daniel J. Solove of George Washington have written The Scope and Potential of FTC Data Protection, 83 George Washington Law Review (2015, Forthcoming). Here is the abstract:
For more than fifteen years, the Federal Trade Commission (FTC) has regulated privacy and data security through its authority to police deceptive and unfair trade practices as well as through powers conferred by specific statutes and international agreements. Recently, the FTC’s powers for data protection have been challenged by Wyndham Worldwide Corporation and LabMD. These recent cases raise a fundamental issue, and one that has surprisingly not been well explored: How broad are the FTC’s privacy and data security regulatory powers? How broad should they be?
In this article, we address the issue of the scope of FTC authority over privacy and data security, which together we will refer to as "data protection" We argue that the FTC not only has the authority to regulate data protection to the extent it has been doing, but it also has the authority to expand its reach much more. Normatively, we argue that the FTC’s current scope of data protection authority is essential to the United States data protection regime and should be fully embraced to respond to the privacy harms unaddressed by existing torts, contracts, and statutes. For example, the FTC can regulate with a much different and more flexible understanding of harm that one focused on monetary or physical injury.
Thus far, the FTC has been quite modest in its enforcement, focusing on the most egregious offenders and enforcing the most widespread industry norms. The FTC should push the development of the norms a little more (though not in an extreme or aggressive way). We also discuss steps the FTC should take to change the way it exercises its power, such as greater transparency and more nuanced sanctioning and auditing.
