Over the last few months, a hot topic of privacy enforcement action has undoubtedly been the $5 billion U.S. Federal Trade Commission settlement with Facebook over the company’s alleged violation of a prior 2012 FTC consent order. While the high price tag of noncompliance has been the source of much discussion in privacy circles, the FTC settlement also makes a very strong statement in terms of the possible standard against which all companies’ privacy management programs may be measured going forward.
That standard is rooted in organizational accountability. Of course, this is not new; many of accountability’s key features have been spelled out over the years in multiple FTC consent decrees. What is new, however, is the fact that the FTC is much more clear about and places a greater emphasis on the requirements of a comprehensive accountable privacy management program in its latest settlements. A similar set of requirements was outlined in the FTC’s recent $575 million settlement with Equifax over its 2017 data breach.
Of course, the requirements imposed on Facebook and Equifax are, in many ways, unique to their respective businesses and the context of the issues being investigated. Yet, they share a common theme: They are in line with the essential elements of accountability of leadership and oversight, risk assessment, policies and procedures, transparency, training and awareness, monitoring and verification, and response and enforcement. They also reflect the expectations of the FTC on organizational accountability as a means for achieving and demonstrating privacy and security compliance. Hunton Andrews Kurth's Centre for Information Policy Leadership examined these requirements and how they align with the elements of accountability in a recent discussion paper.
The FTC’s approach to organizational accountability in the settlements, on the one hand, reflects global trends in accountability (for example, accountability requirements in the EU General Data Protection Regulation, regulatory guidance from international data protection authorities, and the accountability indicators put forward in a 2018 Global Privacy Enforcement Network sweep on “privacy accountability”). On the other hand, the settlements elevate privacy accountability to the level of financial controls that has not been seen previously and will likely result in a step change in organizational focus on and investment in accountability.
Looking beyond the nuances and rigor of some of the requirements outlined in the settlements, we can distill a key message. That is, in any enforcement action going forward, the FTC will likely look at corporate efforts to integrate measures that effectuate the essential elements of accountability through privacy management and compliance programs. For instance, the FTC might ask with respect to each element:
- Have appropriate personnel responsible for privacy and security compliance been designated to oversee the privacy program, and is there accountability and governance at board and senior management level? (Leadership and oversight)
- Has the organization conducted appropriate risk assessments for its products, services and projects? Has it assessed, documented and mitigated the risks of its processing operations and updated the program in light of any new risks that are identified? (Risk assessment)
- Has the company designed and implemented policies and procedures that operationalize legal requirements? (Policies and procedures)
- Has the organization provided appropriate and accurate notice to customers and business partners? (Transparency)
- Have employees been trained to ensure awareness of the program and their duties in ensuring compliance? (Training and awareness)
- Has the organization regularly monitored and tested the implementation and effectiveness of the privacy program, and can it demonstrate this? (Monitoring and verification)
- Has the company put in place procedures to report breaches, address complaints and enforce against internal noncompliance? (Response and enforcement)
These are just a handful of signals that the FTC may watch out for.
Some companies may ask themselves how an enforcement action specific to another company is relevant to their business. Undoubtedly, FTC consent orders can set a precedent. This is inherent in the FTC’s enforcement model, which is to select and prioritize cases that have such value beyond the immediate target of the investigation. In addition, the requirements imposed by the FTC via consent orders constitute what it believes is necessary for the company in question to achieve compliance with relevant legal obligations and provide guidance for other companies on best practices. That is not to say that an organization would be required to copy the whole string of measures imposed by the FTC in any given consent order. Rather, organizations must develop the specifics of their program based on their unique business context, but such specifics must cover all core elements of accountability.
By implementing a corporate privacy compliance program based on the elements of accountability, organizations in all industries, regardless of their size and type of business, are setting themselves up for global compliance with privacy and security laws no matter where they are located.
In the U.S., companies will also be setting themselves up for accountability’s next chapter in U.S. privacy compliance. Members of Congress are currently exploring organizational accountability in connection with a new federal privacy law and will likely be scrutinizing the FTC settlement requirements carefully when codifying accountability into such a law. State legislators are including various elements of accountability in state privacy bills. Finally, the recent transformative changes of FTC consent orders have further reaffirmed and clarified the importance of accountability’s role in creating comprehensive privacy and security management programs and likely constitute a permanent change in the level of detail and structure of FTC consent orders going forward.
As a result, the next time we see another major FTC consent order or settlement, companies should be closely examining the order, looking first and foremost for the valuable guidance it provides on accountability and avoiding the blinding siren lights of high fines.
