Comments of TechFreedom Hearings on Competition & Consumer Protection in the 21st Century Topic 11: The agency’s investigation, enforcement and remedial processes Berin Szóka,1 Graham Owens2 & James E. Dunstan3 Overview TechFreedom is a non-partisan think tank dedicated to promoting the progress of technol- ogy that improves the human condition. To this end, we seek to advance public policy that makes experimentation, entrepreneurship, and investment possible, and thus unleashes the ultimate resource: human ingenuity. Wherever possible, we seek to empower users to make their own choices online and elsewhere. 1 Berin Szóka is President of TechFreedom, a nonprofit, nonpartisan technology policy think tank. J.D. Univer- sity of Virginia School of Law; B.A. Duke University. He can be reached at [email protected]. 2 Graham Owens is a Legal Fellow with TechFreedom. J.D. George Washington University School of Law; B.A. University of Virginia. He can be reached at [email protected]. 3 James Dunstan is General Counsel of TechFreedom. J.D. Georgetown University Law Center; B.A. Claremont McKenna College. He can be reached at [email protected]. 1 Since its launch in 2011, TechFreedom has spoken often on the FTC’s regulation and en- forcement of antitrust, unfairness, and consumer protection laws. We welcome the oppor- tunity to once again interact with FTC staff as it works through these issues in a changing world where technological innovation has brought huge benefits to consumers, but has also raised novel questions related to privacy, data security, and unfair business practices. On June 20, 2018, the FTC announced that the agency will hold a series of public hearings on whether broad-based changes in the economy, evolving business practices, new tech- nologies, or international developments might require adjustments to competition and consumer protection enforcement law, enforcement priorities, and policy.4 In preparation for those hearings, the FTC seeks public comment on eleven (11) issues, through the filing of separate comments on each topic. TechFreedom is pleased to submit comments on five (5) of these topics: • Topic 1: The state of antitrust and consumer protection law and enforcement, and their development, since the Pitofsky hearings5 • Topic 2: Competition and consumer protection issues in communication, infor- mation, and media technology networks6 • Topic 5: The Commission’s remedial authority to deter unfair and deceptive con- duct in privacy and data security matters7 • Topic 10: The interpretation and harmonization of state and federal statutes and regulations that prohibit unfair and deceptive acts and practices8 • Topic 11: The agency’s investigation, enforcement and remedial processes9 4 Press Release, Fed. Trade Comm’n, FTC Announces Hearings on Competition and Consumer Protection in the 21st Century (June 20, 2018), https://www.ftc.gov/news-events/press-releases/2018/06/ftc- announces-hearings-competition-consumer-protection-21st. 5 Comments of TechFreedom, Hearings on Competition & Consumer Protection in the 21st Century: Topic 1: The state of antitrust and consumer protection law and enforcement, and their development, since the Pitofsky hear- ings (Aug. 20, 2018), http://techfreedom.org/wp-content/uploads/2018/08/ftc-august-2018-workshop- comments-topic-1.pdf 6 Comments of TechFreedom, Hearings on Competition & Consumer Protection in the 21st Century: Topic 2: Competition and Consumer Protection Issues in Communication, Information, and Media Technology Networks (Aug. 20, 2018), http://techfreedom.org/wp-content/uploads/2018/08/ftc-august-2018-workshop- comments-topic-2.pdf 7 Comments of TechFreedom, Hearings on Competition & Consumer Protection in the 21st Century: Topic 5: The Commission’s remedial authority to deter unfair and deceptive conduct in privacy and data security matters (Aug. 20, 2018), http://techfreedom.org/wp-content/uploads/2018/08/ftc-august-2018-workshop- comments-topic-5.pdf 8 Comments of TechFreedom, Hearings on Competition & Consumer Protection in the 21st Century: Topic 10: The interpretation and harmonization of state and federal statutes and regulations that prohibit unfair and de- ceptive acts and practices (Aug. 20, 2018), http://techfreedom.org/wp-content/uploads/2018/08/ftc-august- 2018-workshop-comments-topic-10.pdf 2 This last topic is perhaps the most important area of the Commission’s inquiry. We dis- cussed these questions at length in testimony before the Senate Commerce Committee last year10 and in greater detail in a 2016 white paper, submitted as testimony to the House Commerce Committee and co-authored with Geoff Manne of the International Center for Law & Economics.11 We include both for inclusion in the record here, and summarize our conclusions below, with reference to the relevant portions of these filings. Our fundamental concern with how the FTC has operated in tech-related consumer protec- tion is that the agency has, through effectively settling all such cases, effectively circum- vented the process of judicial review by which the FTC itself — to say nothing of Congress — envisioned that the courts would check the agency’s interpretation of its elastic unfair- ness and deception authority. We believe that this has happened principally because of the dynamics (and costs to companies) of the FTC’s investigative, enforcement and remedial processes. Simply put: restoring the proper constraints upon the Commission’s substantive discretion requires procedural constraints. 11.a. Whether the agency’s investigative process can be improved with- out diminishing the ability of the Commission to identify and prosecute prohibited conduct We note that the FTC did announce a slate of modest reforms to the CID process in January 2017.12 While we applaud these reforms, none addresses our fundamental concerns. This is unsurprising, given that the Commission failed to seek public comment on the issue, or on draft reforms. We discuss this issue in detail in our 2016 white paper.13 9 Comments of TechFreedom, Hearings on Competition & Consumer Protection in the 21st Century: Topic 11: The agency’s investigation, enforcement and remedial processes (Aug. 20, 2018), http://techfreedom.org/wp- content/uploads/2018/08/ftc-august-2018-workshop-comments-topic-11.pdf 10 Testimony of Berin Szóka & Graham Owens, TechFreedom, before the Senate Commerce, Science, & Trans- portation Committee Subcommittee on Consumer Protection, Product Safety, Insurance, & Data Security, hearing on FTC Stakeholder Perspectives: Reform Proposals to Improve Fairness, Innovation, and Consumer Welfare, September 26, 2012, http://docs.techfreedom.org/Szoka_FTC_Reform_Testimony_9-26-17.pdf. 11 See BERIN SZ KA & GEOFFREY A. MANNE, THE FEDERAL TRADE COMMISSION: RESTORING CONGRESSIONAL OVERSIGHT OF THE SECOND NATIONAL LEGISLATURE 57-60 (2016), http://docs.house.gov/meetings/IF/IF17/20160524/104976/HHRGO� -114-IF17-Wstate-ManneG-20160524- SD004.pdf [hereinafter White Paper]. 12 Press Release, Fed. Trade Comm’n, Acting FTC Chairman Ohlhausen Announces Internal Process Reforms: Reducing Burdens and Improving Transparency in Agency Investigations (July 17, 2017), https://www.ftc.gov/news-events/press-releases/2017/07/acting-ftc-chairman-ohlhausen-announces- internal-process-reforms. 13 White Paper supra note 11 at 31-48. 3 There are many reasons why companies do not litigate privacy and data security cases. Some of them are beyond the control of FTC or Congress — for example, the extreme sensi- tivity of these issues for companies. Studies by the Ponemon Institute found that “[d]ata breaches are more concerning than product recalls and lawsuits,”14 with a company’s stock price falling an average of 5% after a data breach is disclosed.15 Witness the 30% hit Equifax took to its stock price upon revelation of its data breach.16 Perhaps most illustra- tive of the sensitivity of these issues was the case of LabMD — a medical testing company and one of the handful of companies who dared litigate against the FTC — which ultimately went out of business due to litigation costs and reputational damage, even though the judge ultimately found that no consumer was injured.17 But a very significant, if not the biggest, reason why companies reflexively, almost invariably settle their cases is that the process of the FTC’s investigation can be punishment enough to make settlement seem more attrac- tive. After enduring a burdensome investigative process, companies (especially start-ups) frequently lack additional resources to defend themselves and face an informational asymmetry given the intrusiveness inherent in the FTC’s current process. Even Chris Hoof- nagle, who has long advocated that the FTC be far more aggressive on privacy and data se- curity, warns, in his new treatise on privacy regulation at the agency, that, [T]he FTC’s investigatory power is very broad and is akin to an inquisitorial body. On its own initiative, it can investigate a broad range of businesses without any indication of a predicate offense having occurred.18 This onerous process inevitably leads to more false-positives, as FTC staff tends to becomes invested in fishing expeditions and force such consent decrees regardless of the actual 14 PONEMON INST. LLC, FOURTH ANNUAL STUDY: IS YOUR COMPANY READY FOR A BIG DATA BREACH? 6 (2016), http://www.experian.com/assets/data-breach/white-papers/2016-experian-data-breach-preparedness- study.pdf. 15 See Help Net Security, After a data breach is disclosed, stock prices fall an average of 5% (May 16,