Companies need federal cybersecurity guidelines, candidate for FTC chair says

29 March 2017. By Amy Miller.

States and federal regulators need to do a better job of setting "nimble" cybersecurity guidelines and standards that help companies, said Utah Attorney General Sean Reyes, a leading candidate to chair the US Federal Trade Commission.

Companies are in a difficult position because they're dealing with a wide array of online vulnerabilities while navigating a patchwork of state and federal laws, and they can't be wrong, Reyes said at a conference* in Palo Alto, California, on Wednesday.

"There aren't clear guidelines," Reyes said. "I will do whatever I can in whatever position I have to makes sure there's more reliability for cybersecurity standards."

Reyes said he'd like to see legislation creating federal cybersecurity standards that state AGs could then follow and enforce. Guidlines that can be updated and tweaked as technology evolves would provide much-needed certainty for businesses, he said.

But he also cautioned against regulatory overreach and said regulators need to practice "regulatory humility," a phrase used often by acting FTC Chairman Maureen Ohlhausen, a Republican.

Companies will be more willing to work with regulators if they don't think regulators are just gathering data for a "fishing expedition," he said.

"Harms have to be real," Reyes said.

Reyes offered one tip for companies dealing with a data breach now: Make sure their first concern is how to protect its customers.

Regulators are "rooting" for companies, he said, "even as we go after bad actors."

Reyes, a surrogate for the Trump campaign Utah and Nevada, emerged as a leading candidate for FTC chairman in February. He made consumer protection a priority during his tenure as attorney general. He teamed up with District of Columbia Attorney General Karl Racine, a Democrat, last year in urging the federal government to reopen its investigation into Google's search practices.

Reyes said Wednesday that he has been in communication with the Trump administration and is still interested in the position. But he said he doesn't know when the FTC chair will be named.

*"Emerging Technologies and Torts of the Future," US Chamber of Commerce, Palo Alto, California. March 29, 2017