The FTC has become increasingly focused on what is being termed as the “Internet of Things” (“IoT”). The IoT encompasses all “smart devices” that are connected to the Internet and transmit and receive consumers’ data. Earlier this year, the FTC its own report on the IoT, which has drawn various levels of supporters and detractors in the times since it was released. However, not wanting to leave authority to govern the IoT in limbo, the FTC has recently announced its creation of a new office within its Bureau of Consumer Protection called the Office of Technology Research and Investigation (“OTRI”). The OTRI is the successor to the FTC’s Mobile Technology Unit (“MTU”), an office that was created a few years ago when it became clear that smart devices were here to stay.
The MTU was a small group of FTC staff members that were charged with highlighting consumer protection challenges posed by mobile technologies and developing tools and techniques to protect consumers engaged in mobile commerce, and assisting staff with mobile investigations. The newly formed OTRI is said to be going to build on the work of the MTU as well as expand into an “even broader array of investigative research on technology issues involving all facets of the FTC’s consumer protection mission, including privacy, data security, connected cars, smart homes, algorithmic transparency, emerging payment methods, big data, and the Internet of Things.” According to the FTC, “We believe OTRI will be an instrumental source for research and information on technology’s impact on consumers. I, as well as future Chief Technologists, will work closely with OTRI on these various projects.”
In conjunction with the creation of the OTRI, the FTC has announced a number of new positions that will need to be filled as the office gets off the ground. First, the FTC is purportedly seeking to hire a Technology Policy Research Fellowship, which 2-year term appointment available to recent graduates with that rare education in both technology and policy. The fellow will provide technical expertise to FTC attorneys and investigators, identify and design relevant research projects in the area of consumer technology, and ultimately develop new methods of consumer protection research. Second, the FTC is seeking to hire a full-time Research Coordinator o oversee OTRI’s technology research projects, including project design and execution. The Coordinator also will help translate the findings into clear, actionable guidance to inform policy. Finally, the FTC intends to continue its Technology Research Internship Program this summer, and expand it into semester-long externships throughout the school year. The summer posting is linked above and additional information regarding the year-round externships will be available on the upcoming OTRI webpage.
While the creation of the OTRI only furthers the protection for smart device owners, it begs the question of whether the FTC has the authority to govern smart device makers and mobile app makers’ privacy and data security practices. This question has been squarely on display in the AT&T data throttling case. There, AT&T filed a motion to dismiss the FTC’s charges, claiming the FTC didn’t have jurisdiction over AT&T’s data practices. However, AT&T’s motion to dismiss was recently denied on the grounds that AT&T was not subject to the common carrier exception. The order denying AT&T’s motion stated, “Contrary to what AT&T argues, the common carrier exception applies only where the entity has the status of common carrier and is actually engaging in common carrier activity.” The court also rejected any notion that the recent FCC order classifying all mobile broadband internet access service as common carriage under Title II of the Communications Act prevented the FTC from pursuing past conduct that occurred before the reclassification took place. While the reclassification does no good for AT&T in its fight against the FTC, it will be interesting to see what impact it has on mobile device privacy and data security questions in the future. Even in light of the reclassification, the FTC is not standing still in the fight to protect smart device consumers. It is pretty easy to surmise that this isn’t the last we have heard about the IoT, the OTRI, and the authority to govern smart device privacy and data security questions.