FTC Focuses on Consumer Privacy, Security and Automated Decision Making at Annual PrivacyCon | Media Pyro

On November 1, the FTC held its annual PrivacyCon event, featuring research presentations on a wide range of consumer privacy and security issues. Opening the event, FTC Chair Lina Hahn emphasized the importance of hearing from the academic community on a number of privacy issues that the FTC and other government agencies may be overlooking. Khan emphasized that regulators cannot wait until new technologies are fully developed to think about ways to implement new laws to protect consumers. “The FTC needs to be on top of this emerging industry before problematic business models take hold,” Hahn said, adding that the FTC is constantly working on privacy issues and “prioritizing the use of creative ideas from academia in [its] bread-and-butter work’ to develop better means to reflect what is really going on. She noted the recent enforcement action taken against an online liquor market and its CEO for failing to take reasonable steps to prevent two major data breaches (reported here by InfoBytes). Khan noted that while the settlement’s requirements, such as requiring multi-factor authentication and destroying unnecessary user data, may not seem “very advanced,” they are a big step forward for state law enforcement. Chief Technology Officer Stephanie Nguyen, who is responsible for integrating technologists into various areas of the FTC’s work, including consumer privacy, discussed the work of these technologists (including AI and security experts, software engineers, designers and data scientists). to help develop remedies in data security enforcement actions and push companies to not only do the bare minimum to fix areas such as lax data security, but to model best practices for the industry. “We want the wrongdoers to face real consequences,” Nguyen said, adding that the FTC wants to hold corporate executives accountable, as it did in the enforcement actions cited by Khan. In addition, Nguyen emphasized that there is also a need to address systemic risk by forcing companies to delete illegally collected data and destroy any algorithms derived from that data.

The one-day conference included several panel sessions covering a range of topics related to consumer surveillance, automated decision-making systems, children’s privacy, devices that listen to users, augmented/virtual reality, interfaces and dark patterns, and advertising technologies. Topics discussed during the panels include (i) the requirement for data brokers to provide accurate information; (ii) understanding how data inaccuracy can disproportionately affect minorities and those living in poverty, and why reliance on data can lead to discriminatory practices; (iii) exploring the risks of bias and discrimination when engaging in emotional artificial intelligence; (iv) an understanding of automated decision-making systems and how the quality of these systems affects the population they are intended to represent; (v) recognizing the lack of transparency associated with the collection and use of children’s data and the impact on collection/use of various privacy laws, including the Children’s Online Privacy Rule, the General Data Protection Regulation, and the California Consumer Privacy/Personal Sharing Act data; (vi) identifying issues related to cookie consent interfaces and dark patterns; and (vii) examining how targeted online advertising, both in the United States and abroad, affects consumers.