Several advertising groups recently filed comments with the Federal Trade Commission (“FTC”) urging the organization to pursue enforcement actions only against security and privacy practices that cause “concrete injuries” to consumers. The comments were solicited by the FTC in advance of a planned “Informational Injury” workshop, which is to be held on December 12, 2017. The purpose of the workshop is to examine consumer injury in the context of privacy and data security.
In their comments, the advertising groups argue that a concrete harm standard for informational injuries creates predictability for businesses. The advertising trade associations collectively represent thousands of companies that collect data about consumers. They note that any expansion in the definition of informational injury would limit the collection and use of data, which would harm the consumers who benefit from ad-supported content. The associations also note that self-regulatory programs, such as Digital Advertising Alliance, are flexible, effective in bringing companies into compliance, and retain the option of referring unresolved enforcement actions to the FTC.
The Center for Democracy & Technology (“CDT”), a privacy advocate, also filed comments, arguing that the risks arising from the processing of personal information include “not just economic loss but also diminished capacity for autonomy and self-determination, discrimination (legal or otherwise), and a generalized loss of trust.” The CDT argues that, due to a lack of control over their information, users experience subjective privacy harms consisting of “pervasive fears, discomforts, and other chilling effects,” but also admits that such privacy violations are difficult to quantify.
The FTC may find the advertising associations’ argument more persuasive, given that acting FTC Chair Maureen Ohlhausen has said previously that the agency should focus on cases with “objective, concrete harms such as monetary injury and unwarranted health and safety risks,” rather than “speculative injury, or on subjective types of harm.”
As the FTC seeks consensus on how to characterize and evaluate privacy injuries, federal courts of appeal remain split after the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins on what constitutes a sufficiently “concrete” harm for the purposes of Article III standing. In a petition for writ of certiorari filed on Monday, October 30, health insurer CareFirst urged the Supreme Court to resolve the circuit split and hold that an increased risk of future identity theft is not an “imminent” injury and does not confer standing. As data breaches become increasingly prevalent—even inevitable—the case presents an opportunity for the Supreme Court to stem the growing tide of class action lawsuits filed by plaintiffs who suffer subjective and emotional, but not concrete or imminent, harms.
