The Federal Trade Commission is under mounting pressure to kick off long-anticipated federal rules protecting personal information collected by companies amid delays with President
Advocacy groups are looking to the commission for policy action amid years of stalled negotiations in Congress over a national privacy law and a growing patchwork of state laws imposing new compliance obligations on companies.
But with two Democrats and two Republicans on the commission, having the votes to launch a potentially years-long rulemaking process likely depends on Senate confirmation of Alvaro Bedoya, the Georgetown University law professor Biden’s picked to fill the FTC’s empty fifth seat.
Bedoya has said he supports the agency’s pursuit of data protection rules. He’s expected to be confirmed as an FTC commissioner, though it’s unclear when his nomination might be reach the Senate floor, after one Commerce, Science, and Transportation Committee vote was postponed and another tied.
A spokesperson for the commission declined to comment on potential new agency rules. The commission advocated for using its policy tools, including new rules, to protect people’s privacy in a September report to Congress.
The challenge, for those pushing the FTC to establish such rules, is to start the proposal process as soon as possible to reduce the threat of any action being dropped or overturned if a Republican wins the White House in 2024. The FTC added the topic of consumer data protection to its regulatory agenda for the first time in December.
“That’s why we’re pushing the FTC to act because they have to get this process started if there’s a hope to get it finished,” said Alan Butler, executive director and president of the nonprofit Electronic Privacy Information Center.
The FTC, in the past, has deferred to Congress to sort out a framework for a comprehensive set of federal protections, focusing its own work on case-by-case enforcement of privacy violations. For decades, it has limited its regulatory action to areas where Congress has granted the agency specific authority, like children’s privacy.
After Democrat Lina Khan became chair in June, privacy advocates began ramping up calls for the agency to make better use of its existing privacy protection powers, despite limited data-protection resources and staff.
Now, the FTC is open to putting its resources into time-consuming rulemaking procedures, Janis Kestenbaum, a partner at Perkins Coie LLP who was senior legal adviser to a former FTC chair, said.
“That’s the sea change,” she said. A proposal would also test Khan’s drive to dust off the agency’s long-dormant rulemaking capabilities, an issue she previously pressed as an academic.
Rebecca Kelly Slaughter, a Democrat, laid the groundwork for a privacy proposal when she launched a rulemaking initiative last March during her time as acting FTC chair. Groups pushing for privacy rules are hopeful that sitting Republican commissioner Christine Wilson would get on board if the agency moves forward before Bedoya joins.
In the past, Wilson has shown a willingness to advance privacy rules in the absence of congressional action, but she would likely favor a more scaled-back approach than what advocates are suggesting or what Khan might propose.
Wilson’s office declined to comment on whether she would support launching a rulemaking on privacy.
The FTC’s other Republican commissioner, Noah Phillips, has said that policymaking on privacy should be left to Congress, rather than the commission.
EPIC has issued a white paper with Consumer Reports urging the commission to mandate that companies such as
Another advocacy group, Accountable Tech, submitted a petition to the FTC that calls for a outright ban on what it dubbed “surveillance advertising,” the practice of tracking consumers online to deliver personalized ads. The petition faces opposition from the Association of National Advertisers, a trade group representing 20,000 brands that collectively spend $400 billion in marketing and advertising each year.
VIDEO:Digital Privacy Laws: California and Beyond
Advocacy groups have set out two possible paths to writing privacy rules, one based on the commission’s consumer protection powers and the other involving its competition authority.
EPIC and Consumer Reports are suggesting the FTC rely on its authority to police unfair and deceptive business practices. That would allow the commission to draw from its record of enforcement actions that have alleged privacy violations as part of its consumer protection work.
Such an approach could include adding protections for certain kinds of sensitive data, including information on a person’s location or health.
“That would be much more consistent with FTC enforcement,” said Maureen Ohlhausen, a former Republican commissioner who’s now a partner at Baker Botts LLP. “Rulemaking is supposed to be a codification of case-by-case enforcement.”
That strategy would require a cost-benefit analysis showing that the alleged harms of companies’ unregulated data collection and use outweigh related benefits to consumers or competition, according to Jessica Rich, a former director of the FTC’s Bureau of Consumer Protection who’s currently of counsel at Kelley Drye & Warren LLP.
This “balancing test” is one of many steps that the agency would have to follow for a consumer protection rulemaking on privacy, she said.
To use the consumer protection approach, the FTC would have to employ the Magnuson-Moss process, an elaborate series of steps imposed by Congress decades ago in response to complaints about FTC overreach. Even though Khan’s FTC has sought to streamline the process, it remains cumbersome, with requirements for giving Congress notice of plans for a rule and giving stakeholders opportunities to weigh in.
“It’s really an uphill climb to do this in any efficient time period,” Rich said.
Accountable Tech suggests, instead, that the FTC write data privacy rules using its authority over unfair methods of competition, arguing that dominant digital platforms are built on a business model of pervasive tracking and profiling for personalized ads.
Biden highlighted privacy’s ties to competition when he issued an executive order in July urging the FTC to write rules governing big tech platforms’ “surveillance of users.”
A consumer privacy rulemaking could “explore the bounds” of the agency’s mostly untested ability to write rules concerning competition, said Jesse Lehrich, co-founder of Accountable Tech, which took aim in its petition at data usage by Big Tech, including Google, Facebook, and
That petition has already drawn opposition from the Association of National Advertisers, which said in comments to the agency that it ignores the benefits data-driven ads to both consumers and brands. Moreover, the FTC already has enforcement mechanisms to deter anti-competitive conduct, it said.
“A ban would be the most extreme and aggressive form of regulation they could possibly take,” said Chris Oswald, the advertising association’s head of government relations.
The industry group also warned that a competition-oriented privacy rule may not withstand eventual legal challenges, questioning whether the FTC even has the authority to issue such a regulation. The agency has used its unfair competition rule authority only once to regulate tailored clothing, according to the group’s comments.
One benefit of any FTC proposed rule, said EPIC’s Butler, is that it could offer a “testing ground” for ideas that could advance the legislative debate and force Congress to step up efforts toward negotiating a national privacy law.
Any proposed FTC rule on privacy is also likely to be tested in court with a legal challenge.
“It’s inevitable,” said Austin A.B. Ownbey, counsel at Foley Hoag LLP who previously worked as a FTC staff attorney. “If they push too far, they’ll get pushback from Congress and they’ll get pushback from the courts.”