Recent comments by the Federal Trade Commission (FTC) Commissioner Rohit Chopra should have companies on notice for increased enforcement actions across the board. During the “Privacy. Security. Risk.” Conference in Texas last week, Chopra made comments regarding his views on increasing enforcement, including the imposition of greater civil monetary penalties. “I’ve already raised concerns about settlements we do with no monetary penalties. I want to see monetary consequences for egregious breaking of the law” said Chopra as reported by the IAPP during a live podcast taping. Chopra also stated that he was troubled by current federal enforcement action in the United States, the answer to which appears in part to come with heftier fines.
While the FTC hopes to have a bigger bite, it appears that Congressional action, or lack thereof, is in many ways muzzling the agency. During a House Subcommittee hearing in July, FTC officials indicated that while they were aggressively pursuing action regarding data and privacy security, they also said that their hands were tied in regard to bringing more aggressive enforcement. As stated by Chairman Joe Simmons, “In my view, we need more authority. I support data security legislation that would give us three things: (1) the ability to seek civil penalties to effectively deter unlawful conduct, (2) jurisdiction over non-profits and common carriers, and (3) the authority to issue implementing rules under the Administrative Procedure Act. And we should consider additional privacy authority as well….” In part, Chairman Simmons may be referencing Congress’s failure to pass a comprehensive data protection law, particularly in the shadow of the European Union’s GDPR standards, which are continuing to impact American companies.
These comments come at a time where companies face ever increasing risk as the economy becomes more and more data-centric. Across the country, companies and their boards are faced with an ever more complex business decision on how to make cyber-security make business sense. On the one hand, investing in a robust cyber-security program, both in terms of designing a compliance strategy and investing in technology, is balanced with the risk and cost of a data breach. While the risks appear to be increasing, the cost of such a breach may also be increasing as well. In addition to a loss of revenue due to a drop in consumer confidence, Chairman Simmons and Commissioner Chopra’s comments should make companies aware that enforcement and increased civil monetary penalties may also be more of a threat towards business’s bottom lines.