|
Testimony of Chris Murray Senior Counsel Consumers Union Regarding Federal Trade Commission Reauthorization Before the U.S. Senate Subcommittee on Interstate Commerce, Trade, and Tourism; Committee on Commerce, Science and Transportation On September 12, 2007
Subcommittee Chairman Dorgan, Ranking Member DeMint, and members of the Subcommittee, I am grateful for the opportunity to testify before you today representing Consumers Union, the non-profit publisher of Consumer Reports magazine. [1] The Federal Trade Commission (FTC) serves as a key line of defense against unfair and deceptive practices and anti-competitive behavior. Today I will highlight some of the barriers in the Commission’s authority and enforcement powers that hinder its ability to protect consumers as well as note a few priority areas in which the FTC could do more. Given the FTC’s broad authority to protect consumers, Consumers Union intersects with the FTC in many ways. One notable area in which the FTC has led is in the area of “Exclusion Payments,” or “pay for delay” settlements, where generic drug manufacturers are paid by brand name drug makers to keep generic drugs out of a market. The agency prevailed on cases to end the practice of paying off drug competitors not to compete, until it was reversed by the 11 th circuit in the Schering case. [2] We support legislation to end these anti-consumer practices and applaud the FTC for conducting more investigations with an eye towards bringing more cases. These “pay for delay” deals cost consumers billions every year. I hope Congress will also act expeditiously to end this practice. Today I’ll turn my attention primarily to the telecommunications and media sectors, and what can be done to improve the FTC’s ability to protect consumers in these areas. Eliminating the Common Carrier Exemption, Policing Truth in Broadband Advertising First, Congress should eliminate the constraints of the common carrier exemption, as it was crafted for a time when a single monopoly telephone provider was tightly regulated by the Federal Communications Commission (FCC). As the marketplace evolves with a broader array of services, and the FCC steadily backs away from regulating the full bundle of communications that consumers are buying, there is a void that is critical for the FTC to fill—and Congress should provide the FTC authority to fill it. What happens when a telephone company advertises a misleading promotion that bundles a service that is today exempt, such as landline telephone, with a service that is not, such as broadband Internet? We would argue that the agency has authority to deal with the problem, but this would likely be litigated before it is settled, consuming already scarce agency resources. For example, in the Verity case, the agency brought an action against an overseas firm billing illegally for “adult videotext” services that consumers didn’t even know had been accessed through their phone lines. The company attempted to evade FTC jurisdiction by claiming the common carrier exemption. While the FTC eventually prevailed, it required litigation at the district and appellate court levels, and Verity even attempted an appeal to the Supreme Court, but the case was not accepted. When we see carriers using aggressive bundling tactics, advertising “unlimited” services that are sharply limited, and promoting plans that are not reflective of actual costs, the case for FTC jurisdiction could not be more clear. And the FTC should prosecute “unfair and deceptive” practices wherever they may lurk, especially where the agency already has clear authority. We saw recent examples of cable companies offering high-speed Internet to their customers, and terminating those who use “too much” bandwidth. We’re not arguing that consumers should have unlimited bandwidth by any means, just that they should get whatever bandwidth they’ve been sold. If a consumer buys a certain amount of connectivity, then cap them at amount—no more, no less than what was advertised. In a Washington Post article, [3] a spokesman for this particular company wouldn’t even disclose to its subscribers how much is “too much”! They argue that if limits were disclosed, then subscribers would use right up to that maximum capacity. I simply don’t understand how a company can advertise a particular high-speed capacity, and then refuse to tell subscribers what they really bought. If that’s not an unfair and deceptive practice, I can’t imagine what would be. The agency needs to act to ensure that consumers get truth in broadband and communications advertising, and Congress needs to give the FTC clear, concurrent jurisdiction with the FCC to deal with the full range of communications services, whether common carrier or otherwise. Digital Television Transition – Defending against the “Digital Upsell” The digital television transition creates unique vulnerabilities for consumers and therefore unique opportunities for businesses to mislead them. Not only is consumer awareness of the transition low, the transition is confusing for even those consumers who are aware of it?consumers lack clarity on what equipment they'll need under what circumstances. Will cable subscribers need a converter box? For those who need a new television now, do they need a digital television? A digital cable-ready television? An analog set with a converter box? Along with these complexities are strong incentives by a variety of market players to upsell to consumers. Cable companies have an incentive to encourage non-subscribers to purchase their service, and to upsell current subscribers to digital cable. Retailers and manufacturers have an incentive to sell high-end HDTVs rather than more affordable lower definition, smaller-screen digital sets. And they have no incentive to inform consumers that their analog sets will continue to receive digital broadcasts as long as they have a converter box. The combination of low consumer awareness, technological complexity, and financial incentives to upsell creates a situation ripe for deceptive practices. For vulnerable populations—such as the elderly or low-income households—the potential for being misled, intentionally or unintentionally, is significant. Last week the cable industry launched a $200 million ad campaign to educate consumers about the DTV transition. The ads, which urge cable customers to relax because “cable will take care of them” in the digital transition, fail to indicate whether cable will convert all digital broadcast signals, or whether consumers will need to pay more for a set top box or other services that make it possible for consumers to continue using their analog cable services. The cable industry has made a voluntary commitment to offer both digital and analog signals to their customers for three years—but they have not committed to do this nationwide. Their public statements indicate that they would not provide these signals to customers in a significant part of the country, including rural areas. After this three year dual carriage period ends, it is not clear that consumers will not have to purchase new equipment or pay more for digital cable service. Congress and the FTC should take an aggressive stance to ensure that consumers are not taken advantage of. In the last Congress, this Committee reported (in the Communications Opportunity Promotion and Enhancement Act) an amendment offered by Sen. Nelson of Florida that imposed on retailers the duty to adequately inform consumers, and made it a violation of law to fail to adequately inform consumers about the availability of digital-to-analog converter boxes or to provide misleading information about the availability and cost of such converter boxes. Consumers Union supported that provision and encourages Congress to make such failure a violation of Section 5 of the FTCA subject to civil penalties. Rulemaking & Enforcement Authority Despite its broad jurisdiction to take action against unfair and deceptive practices by most types of businesses and its broad rulemaking authority to issue specific trade rules, the Commission faces significant procedural and judicial hurdles in proposing and adopting new rules and in taking enforcement action against unlawful practices. Preventative Rules: The Commission faces significant statutory restrictions in proposing and adopting rules to prevent unfair and deceptive practices before they occur. First, rulemaking is encumbered by significant procedural requirements, including judicial review according to a higher review standard than most agencies face. Second, in order to propose such rules, the Commission must make a showing that the practice it seeks to correct is prevalent or widespread. The apparent internal Commission policy not to issue such rules, coupled with its theoretically broad but practically cramped authority, means that consumers cannot rely on FTC rules to prevent unfair and deceptive practices before they occur. Thus, Congress must be more aggressive in ensuring that consumers are protected by mandating that the Commission develop rules that protect consumers from unfair and deceptive practices in the emerging priority areas, some of which are outlined below. Enforcement Authority: The Commission's enforcement authority is likewise constrained. Section 5 of the FTCA empowers the FTC to take action against those who engage in unfair and deceptive practices. For example, the Commission has authority to seek civil penalties against those businesses and individuals that violate Section 5, but only after it has issued a cease and desist order, a court has enjoined a practice and the order or injunction has been violated. [4] This slap on the wrist approach sends a clear message: "It's OK to break the law until you get caught, and when you do, just don't do it again." The combination of few preventative rules and enforcement limitations encourage those who engage in unfair or deceptive practices to roll the dice in hopes that FTC resources and enforcement limitations will limit their financial exposure, assuming they are ever caught. Congress must step in to ensure that at least for high priority issues, the Commission is fully empowered to prevent consumer harm by mandating that FTC issue tough regulations or making explicit that certain practices violate Section 5 explicit and by strengthening FTC's enforcement powers by authorizing it to seek strong civil penalties for initial violations. Identity Theft & Privacy: The FTC plays an important role in preventing identity theft, encouraging improved data security measures, and enforcing elements of some key privacy laws. FTC has conducted numerous workshops to explore privacy issues; one important workshop is planned this Fall regarding online collection of consumer behaviorial data for marketing uses. Consumers will pay an increasingly heavy price for the convenience of shopping for goods and services online as marketers, researchers and data-mining companies grow ever closer to creating near-complete profiles of consumer behaviors, easily matched with public data on zip codes and incomes. We also commend FTC for evaluating the important privacy issues raised by the Google-Doubleclick merger, and the growing concern over behavioral tracking. The Commission also manages the Identity Theft Data Clearing House and conducts important consumer education on prevention of ID theft and mitigation of its harms. We are pleased that the FTC has updated its website to provide information about state "security freeze" laws?state laws giving consumers the right to freeze access to their credit files?that 39 states have now enacted. The security freeze is a key tool in preventing new account fraud. Given the essential nature of this protection, more prominent placement of freeze rights information would strengthen FTC educational efforts. And finally, the Commission has taken enforcement action under Section 5 against databrokers, retailers and other businesses who fail to live up to their privacy promises to protect and secure consumers’ personal information, or who fail to employ reasonable and appropriate security practices. [5] While the Commission's action to date to improve data security and deter deceptive privacy disclosures is laudable, more must be done to protect consumer privacy both by the Commission and by Congress. Continued reliance of FTC's Section 5 authority, with its significant enforcement limitations (discussed above), leave consumers vulnerable to deceptive and unfair practices that put them at significant risk of ID theft. Unfortunately, currently the Commission has explicit authority to issue data security rules only for those entities regulated under the Gramm-Leach-Bliley Act. Except under its general rulemaking authority?which, as noted above, the Commission is reluctant to use?the FTC does not have an explicit Congressional mandate to issue rules governing the privacy and data security practices of non-GLBA entities. We urge Congress to provide the FTC with new enforcement authority for new federal data security mandates for any business operating in interstate commerce that collects, stores, or otherwise uses consumers' sensitive personal information. S. 1178, reported by the Senate Commerce, Science and Transportation Committee earlier this year, takes an important first step in applying FTC's GLBA data security rules adopted by FTC to all such businesses. If the rule is violated, the Commission will have authority to seek civil penalties for the initial violation, creating greater incentives to secure data. Unfortunately, despite the generality of the data security requirements under S. 1178 and FTC's GLBA data security rules, the legislation also displaces state data security safeguard rules that require stronger or more explicit security measures. We urge the Committee not to displace stronger state protections in this area, or to significantly strengthen data security safeguard mandates. But data security requirements are not enough. Consumers also deserve notice when the security of their sensitive personal information held by others has been breached so they can take steps to protect themselves. Consumers Union strongly supports the security freeze provisions of S.1178 and urges their adoption. We urge, however, that Congress strengthen the notice of breach requirement in the bill. Under the legislation, notice obligations are not triggered unless the breached entity determines that there is a reasonable risk of identity theft. Such "trigger" notice will leave consumers in the dark when there is inadequate data for the breached entity to evaluate the level of risk. Moreover, the legislation weakens existing protections because it displaces far stronger state notice laws that now protect more than half of all American consumers. The more consumer protective approach to notice of breach provided in S. 495 better ensures that businesses cannot evade notice when the security of sensitive consumer data has been breached. Finally, it is essential that both Congress and the FTC step up protection of consumers Social Security Numbers (SSNs). SSNs provide the key to a consumer's financial identity. As a result, the widespread availability and use of SSNs by the private and public sector increases consumers' vulnerability to ID theft by making it easier for thieves to obtain the information. In comments filed last week by CU before the Commission as part of its inquiry regarding private sector use of SSNs, CU reported that in its recent national consumer survey, nearly four in five adults reported that they had been asked for their SSN by a business or government entity in the last year. Most consumers clearly understood the dangers of providing the number but feared the consequences of refusing to provide it. And nearly all survey respondents supported new laws that would restrict the use, sale, purchase, and solicitation of their SSNs. Consumers Union encourages adoption of laws creating new federal protections for SSNs to reduce consumers' vulnerability to identity thieves. The SSN protection provisions of S.1178 provide a starting point, but we have strong concerns that the numerous exceptions provided to prohibitions on solicitation, sale, purchase and display swallow the rule and leave consumers unprotected. We also urge the FTC take more aggressive action under its existing Section 5 authority to prevent collection, use, sale and purchase of SSNs except for credit, investment, tax and employment purposes. Spam/Spyware Consumers Union, in its 2007 "State of the Net" survey found that more than 34 percent of survey respondents reported a spyware infection in the prior six months. The chances of being infected with spyware is one in three. One of every eleven consumers infected suffers serious damage. In addition to hardware and software damage, spyware poses grave risks to consumer privacy. Consumers will pay an increasing personal price for the convenience of shopping for goods and services online as marketers, researchers and data-mining companies grow ever closer to creating near-complete profiles of consumer behaviors, easily matched with public data on zip codes and incomes. Badware at best assaults consumers computers with unwanted pop-up advertising and, at worst, may unknowingly render their computers a tool for cybercriminals who use thousands of infected machines to steal identities, rob banks, and even cripple the Internet with malicious denial-of-service attacks. We commend FTC for its aggressive stance on spyware, bringing at least eleven actions in the past two years, although some settlements have produced disappointingly low fines. But more must be done to protect consumer privacy. In addition to new authorities for FTC, the agency, despite its good work, can take yet a more aggressive stance beyond enforcement of Section 5 violations. It should investigate the online marketplace in light of new developments in the field, expose marketing practices that compromise user privacy, issue the necessary injunctions to halt current practices that abuse consumers, and craft policies and recommend federal legislation that prevents such abuses in the future. National Do Not Call Registry Finally, I’ll note that the National Do Not Call Registry is required to purge its numbers every 5 years, meaning all consumers who signed up for it will have to sign up for it again, unless Congress takes action. Consumers who signed up for this enormously popular program will again encounter the annoyance of advertising at the dinner table, beginning in June 2008. And with this will come another round of marketing expenditures for the federal government to publicize the availability of the List and necessity of signing up yet again. 132 million citizens put their home and mobile telephone numbers on the list, and I’m confident those voters will be distressed to find out that they are again facing telemarketing calls unless Congress acts. Congressman Doyle announced this week that he will introduce a vehicle in the House to make the Do Not Call Registry permanent; it is my hope that members of this Committee will introduce a parallel bill, and seek its expeditious passage. The Federal Trade Commission is a critical line of defense against unfair and deceptive practices and anti-competitive behavior. The Committee should act to improve the agency’s ability to accomplish its mission, especially by eliminating the common carrier exemption. We look forward to supporting the agency’s efforts on consumer privacy, spam and spyware, the Do Not Call List, and would urge the agency to take a closer look at advertisements concerning the Digital Television Transition to ensure that consumers are not misled. Thank you Chairman Dorgan.
[1] Consumers Union is a nonprofit membership organization chartered in 1936 under the laws of the State of New York to provide consumers with information, education and counsel about goods, services, health, and personal finance. Consumers Union's income is solely derived from the sale of Consumer Reports, its other publications and from noncommercial contributions, grants and fees. In addition to reports on Consumers Union's own product testing, Consumer Reports (with approximately 4.5 million paid circulation) regularly carries articles on health, product safety, marketplace economics and legislative, judicial and regulatory actions that affect consumer welfare. Consumers Union's publications carry no advertising and receive no commercial support. [2] Schering-Plough Corp. v. Federal Trade Commission, 2005 U.S. App. LEXIS 3811, (11th. Cir. 2005). [3] Hart, Kim. “Shutting Down Big Downloaders,” Washington Post (September 7, 2007). [4] Although the Commission's Section 13(b) authority allows it to avoid the lengthy administrative enforcement process by filing a case directly in federal district court, except where explicitly authorized by statute, rule or court decree, the Commission cannot seek civil penalties for initial violations. Examples of these enforcement difficulties abound. When the Commission filed its complaint against ChoicePoint for its security breach, it was able to seek civil penalties against the company only because they were authorized under the Fair Credit Reporting Act.[4] Had the complaint been premised solely on the company’s Section 5 violations, the Commission could have sought only equitable and monetary relief?damages suffered in cases where the breach caused ID theft. Without the threat of FCRA-based civil penalties, it is unlikely that the Commission would have successfully achieved its record-setting $15 million settlement agreement. And in some cases, the actual monetary damages to consumers may be limited, difficult to assess and prove or otherwise inadequate to provide for a strong deterrent to unlawful actions. One such example is telephone pretexting, an issue which this Committee attempted to address in the 109th Congress. The Commission has sought explicit civil penalty authority from Congress to enforce violations of this type of deceptive practice.[4] Such authority is important because when consumers phone records are obtained through pretexting, although there may be a severe privacy invasion (as in the case of the Hewlett-Packard board members whose phone records were obtained), monetary damages may be scant. In such cases, Section 13(b) provides little deterrence effect and thus is as limited as FTC's administrative enforcement options. Borrowing the words of Commissioner Liebowitz in his dissent in FTC's DirectRevenue case, in such cases, FTC enforcement action becomes merely "a cost of doing business."[4] [5] For an accounting of FTC's actions against companies that fail to comply with their own privacy policies, see http://www.ftc.gov/privacy/privacyinitiatives/promises_enf.html.
|
