Privacy pros crossing their fingers that they don't receive one of the U.S. Federal Trade Commission's dreaded CIDs likely breathed a slight sigh of relief if they were in attendance at the IAPP's Global Privacy Summit in Washington last week, where Acting FTC Chairman Maureen Ohlhausen discussed with former FTC Commissioner Julie Brill her priorities for the agency while she's at the helm. 

Ohlhausen, designated as Acting Chairman by President Trump in January, is a Republican and currently leads just one other commissioner, Terrell McSweeny, a Democrat. The commission's three remaining seats have yet to be filled. In fact, no one as yet been put forward for the vacant seats. 

To start, Ohlhausen said she's put together an in-house group to look at what the FTC should be focusing on moving forward. One question she has is how the agency should measure success. 

"Having a lot of cases is one measure," she said. "But in a way, that's like a doctor saying, 'I performed a lot of operations so I'm successful, but I didn't do a lot of preventative care.'" 

While enforcement is a key part of the agency's mission, Ohlhausen emphasized in the session that consumer education is essential, as she has reiterated in recent appearances in Washington circles. 

"We're better off if consumers know how to protect themselves," she said. "If businesses who want to obey the rules know the rules and meet them, consumers are better off, business is better off, and we can use our limited resources on really bad actors." 

That approach to enforcement colored much of Ohlhausen's talk Thursday: Enforcement should happen when a company's actions have caused or are likely to cause substantial injury that the consumer cannot reasonably avoid.

Asked by Brill whether, in the cyber arena, a breach must necessarily have occurred for there to be some sort of agency enforcement action, the acting chairman said, "We need to be sure it causes or is likely to cause harm. That's a statutory requirement. We should be directing our resources where there's likely injury." 

"We need to be sure it causes or is likely to cause harm. That's a statutory requirement. We should be directing our resources where there's likely injury." -Maureen Ohlhausen, Acting FTC Chairman

In addition, Ohlhausen is leading the charge to look at what she called "process reform," particularly around what are known as CIDs, or a "civil investigative demands." CIDs are the FTC's tool for collecting information from a company it's concerned may have conducted deceptive or unreasonable acts. Companies that receive one have 14 days to respond to the CID's demands. 

Ohlhausen didn't spell out what reform would look like, but she did hint she had concerns about the burden CIDs create for companies. 

"[The FTC's] core mission ... is to protect consumers, without unduly affecting business," she said. Process reform, then, "goes back to that question. We want to protect consumers and we want to maintain competition, but we also  have to be sensitive to burdens on legitimate business." 

She worries that between the Bureau of Consumer Protection and the Bureau of Economics, "are our requests for information more burdensome than they need to be? Can we streamline some of these things?" (For more on what to do if you receive a CID, see here.) She added that, particularly in data security, the FTC closes a lot of those cases before enforcement action is necessary. She wonders is there's something to be learned from some of those closed cases that could prevent them from being opened in the first place. 

Some of Ohlhausen's additional plans were outlined in an FTC press release last week. While not discussed in the session, they include the agency's goal to "identify unnecessary regulations that are no longer in the public interest," as well as working with the bureaus of Consumer Protection and Economics to "integrate economic expertise even earlier in FTC investigations to better inform agency decisions about the consumer welfare effects of enforcement actions."

Of course, no interview with the FTC's acting chairman would be complete without a question on the recent rollback of the Federal Communication Commission's broadband privacy rules. For Ohlhausen, who favored the rollback, it comes down to competition. 

"The question becomes, 'Do consumers have a choice in this market?' This is a market where competition seems to be growing," she said, noting consumers have shifted from using the Internet solely on a desktop to accessing the Internet via their mobile devices, broadening the competition space in terms of providers. "So why do different rules apply if you have that many wireless competitors? It doesn't make sense, carving out ISPs as specific providers, because there are more competitors in this ecosystem that have fewer competitors, and the FCC's rules don't apply to them." 

She said consumers don't think about common carriers in such a segmented way, and it's the same data being used whether it be their desktop provider or their wireless providers, so in some sense, "to say we're going to put these [protective] layers on this one portion ... is giving consumers a false sense of protection." 

Ohlhausen said she's in favor of the FTC gaining authority back over common carriers — authority it had until the 2015 Open Internet Order revoked its jurisdiction — and said that would create a level approach for all players. 

"We do have the expertise, we have been very aggressive in enforcement and staying ahead in these issues," she finished. "I think the FTC has shown its capabilities here, and I'd like to see us continue in this space." 

photo credit: eli.pousson via photopin cc