New Data Privacy Rules Loom for Businesses as Bedoya Joins FTC

Consumer data protections are poised to be a priority for the Federal Trade Commission’s newly minted Democratic majority, now that Alvaro Bedoya is joining the industry regulator.

The Senate voted Wednesday to confirm the Georgetown University law professor’s nomination to the FTC, breaking a partisan deadlock at the agency. Filling his seat means the five-member commission is likely to launch a rulemaking that would put limits on companies’ collection and use of consumer data and set standards for how such data must be secured.

“That may be where his addition to the commission could really make a difference,” said Maureen Ohlhausen, a former FTC commissioner who’s now a partner at Baker Botts LLP.

FTC Chair Lina Khan has called for data protection rules, though until now she’s lacked the three votes needed to get started on what is expected to be a years-long and potentially contentious process of writing regulations. Bedoya brings a background in privacy and data security, with a focus on facial recognition technology, and he wants to strengthen protections for children’s digital data.

A pending update to the commission’s rules for following the Children’s Online Privacy Protection Act, known as COPPA, could provide an opportunity to boost oversight of educational technology tools in particular amid a boom in digital learning.

Industry-wide data privacy rules may concentrate on limiting the use of personal information for advertising to consumers online and guarding against potentially discriminatory ads, according to former FTC officials. The commission also is expected to ramp up its efforts to protect people’s data through enforcement actions that demand more of companies seeking settlements, the former officials said.

The challenge will be advancing privacy priorities alongside Khan’s aggressive antitrust agenda, while relying on the agency’s limited resources and staying within the confines of its authority over consumer protection.

Focus Areas

There are opportunities for a commission rule to impact data privacy, especially when it comes to businesses using information about consumers to tailor advertising to them.

“One area within privacy that’s likely to get called out is the practice of targeted advertising,” said Maneesha Mithal, a partner at Wilson Sonsini Goodrich & Rosati who previously led the FTC’s Division of Privacy and Identity Protection.

Regulatory efforts could concentrate on whether consumers ought to give explicit permission to receive targeted ads, Mithal said. The commission could also look at ad targeting based on personal characteristics that warrant heightened protections, such as a race, gender, or sexual orientation.

Safeguarding children’s digital data is another area where the FTC could step up its existing rules regime under COPPA. The agency put an update to COPPA rules on its regulatory agenda but has yet to issue a proposal.

The FTC could update its rules to “adapt to changing technology,” in education as more schools use digital learning tools from the private sector, said Stacey Gray, who directs legislative research and analysis at the nonprofit Future of Privacy Forum.

Agency Authority

Privacy advocates are pushing for a new FTC bureau focused on privacy as a way for the commission to hire more technologists and other staff to keep pace with increasing industry interest in consumer data.

“Privacy rules won’t work without meaningful enforcement,” said Justin Brookman, a former FTC policy official who directs consumer privacy and technology policy for Consumer Reports.

Democrats in Congress have floated a proposal to establish a privacy bureau at the agency, though it’s unclear whether Republicans would get on board with the idea. A legislative package that included such a bureau foundered on other partisan divides.

Aside from resource issues, the FTC lacks legal authority to police data privacy the way a federal law could.

The commission could prohibit forms of data collection or use that are considered unfair or deceptive using its consumer protection powers under the FTC Act. But the FTC may not be able to require privacy impact assessments or grant data rights like giving consumers the ability to access, correct, or transfer information collected about them.

The scope of the FTC’s authority would be a point of debate during a privacy rulemaking, said Janis Kestenbaum, a partner at Perkins Coie LLP who served as a senior legal adviser to a former FTC chair.

“That is an open question,” Kestenbaum said.