Biden urged the FTC to write rules governing “the surveillance of users” in a wide-reaching executive order on competition, singling out unfair data collection practices that could damage competition and consumer privacy.
The commission laid the groundwork for launching a data privacy proposal when it recently streamlined its process for writing rules. The effort gives the agency an opportunity to push forward with privacy protections through regulation, as federal legislative proposals have failed to gain traction and U.S. states pursue laws of their own.
“The inclusion of privacy in an executive order focused on competition underscores increasing awareness by policymakers that you can’t isolate these two really important issues,” said Rory Van Loo, a law professor at Boston University whose research focuses on the intersection of business, technology, and regulation.
He said the order demonstrates that the Biden administration is thinking more broadly about competition policy than past approaches that focused more on pricing than privacy. The FTC’s new chair, Lina Khan, is expected to scrutinize consumer data collection as part of her focus on the dominance of U.S. tech giants.
“When businesses have control over large amounts of data, it’s easier for them to block competitors or lock consumers in,” Van Loo said.
A rulemaking is expected to take years to complete because the FTC must follow a more complicated process than the average agency.
Still, privacy rules could be a “game-changer” for the federal regulator’s ability to enforce consumer data protections, said Kristin Madigan, a partner at Crowell & Moring LLP who previously worked on privacy and data security as an FTC attorney.
Without rules to implement, the FTC has been policing consumer data privacy primarily through enforcement actions against companies from social media platform
Critics say privacy enforcement lacks teeth, since the agency generally can’t fine a company for a first misstep. Privacy advocates argue that rules could give companies clearer expectations for compliance.
Rules centered on the collection and use of consumer data could also give the commission more enforcement power, “depending on how the FTC acts on this call to action and how the rulemaking goes,” Madigan said.
While it’s unclear what an FTC rule on consumer data privacy might look like, the commission could start by classifying certain types of data as sensitive, such as information on a person’s health, finances, or location.
Then rules could put “strictures” around companies’ ability to collect and use such data, said James Cooper, a former FTC official who now teaches at George Mason University’s law school. Limits could include more robust rules for giving consent to collecting sensitive data or mandates to only collect data that’s necessary and to delete data that’s no longer needed, he said.
Biden’s executive order raises broader questions about whether efforts to promote tech company competition can sideline privacy and vice versa.
“There’s a tension there,” Cooper said.