Lost in translation? Privacy and unfair or deceptive acts or practices in commerce in the United States

Abstract

The United States has led technological innovation in the Internet space. New business models and practices, including social networking and search engines, have proliferated, based on the use of personal information. The adequacy of the United States regime governing data privacy in this new arena is therefore of relevance globally. This has largely relied on the Federal Trade Commission’s enforcement of the prohibition against unfair or deceptive acts or practices in or affecting commerce. The article examines the publicised settlements which have mostly resulted from actions brought by the Federal Trade Commission under this provision. It explores whether the conduct involved can be addressed by privacy principles such as those contained in the Privacy Act 1993. Despite finding that the conduct can also be brought within these principles, the article finds their application in some areas to be strained and argues for new principles, such as privacy by design or default, as well as a principle of strict liability to be introduced for “Trojan Horse” technologies. Finally, the article recommends that proposals to reform the Act in New Zealand also address deceptive practices involving the use of privacy enhancing technologies and privacy assurance services.