At a virtual news conference last Thursday, the FTC announced the adoption of an Advance Notice of Proposed Rulemaking (ANPR) on "commercial surveillance" (that is, the use of personal information) and "lax" data security practices.
Over forceful objections from the two Republican Commissioners, and in the face of significant congressional progress on a bipartisan, bicameral federal comprehensive data privacy bill, this action by the majority initiates a "Magnuson-Moss" rulemaking pursuant to Section 18 of the FTC Act.
The ANPR:
[I]nvites comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive.
It poses a total of 95 wide-reaching questions, grouped into the following broad categories:
- The extent to which personal data practices and security measures harm consumers, particularly children and teenagers;
- The appropriate way to balance costs and benefits; and
- Whether the FTC should regulate prevalent data privacy and security practices.
In just one troubling example of the ANPR's explicit bias against the prevailing notice-and-consent paradigm – a point of view that Commissioner Noah Phillips in his dissent characterizes as "a rather dystopic view of modern commerce" – question 74 asks under "which circumstances, if any, is consumer consent likely to be effective" and question 77 seeks input on "[h]ow demonstrable or substantial must consumer consent be if it is to remain a useful way of evaluating whether a commercial surveillance practice is unfair or deceptive" (emphases added).
In her Dissenting Statement, Commissioner Christine Wilson objected to the ANPR primarily on the basis of the risk it poses to the continued progress of the American Data Privacy and Protection Act (ADPPA). As I noted two weeks ago in a Perspectives from FSF Scholars, an amended version of the ADPPA on July 20, 2022, cleared the House Commerce Committee on a 53-1 vote.
Emphasizing her unwavering preference for congressional, rather than agency, action, Commissioner Wilson made plain that "[t]he momentum of ADPPA plays a significant role in [her] 'no' vote" – and that she is "gravely concerned that opponents of the bill will use the [ANPR] as an excuse to derail the ADPPA."
Commissioner Wilson did acknowledge that, at an earlier point in time, she "became willing to consider whether the Commission should undertake a Section 18 rulemaking to address privacy and data security."
However, for a litany of reasons – including "changes to the Section 18 Rules of Practice that decrease opportunities for public input and vest significant authority for the rulemaking proceedings solely with the Chair" and "Chair Khan's public statements [that] give [Commissioner Wilson] no basis to believe that she will seek to ensure that proposed rule provisions fit within the Congressionally circumscribed jurisdiction of the FTC" – the Commissioner has had an abrupt change of heart.
I documented this evolution in a series of posts to the Free State Foundation's blog.
In his Dissenting Statement, Commissioner Phillips reiterated a similarly longstanding conviction that Congress, rather than the FTC, "is where national privacy law should be enacted." In that vein, he wrote that he is "heartened to see Congress considering just such a law today" and hopes that "this Commission process does nothing to upset that consideration."
Taking issue with the ANPR's foundational terminology, Commissioner Phillips labeled the phrase "commercial surveillance" an "academic pejorative," one that is "defined so broadly (and with such foreboding) that it captures any collection or use of consumer data" – and one that "trades a serious attempt to understand business practices it would regulate for the chance to liken untold companies large and small to J. Edgar Hoover's COINTELPRO."
Expanding upon this concern, Commissioner Phillips makes the following additional points:
- The ANPR "provides no notice whatsoever of the scope and parameters of what rule or rules might follow" – thereby "undermining the public input and congressional notification processes" required by Section 18.
- It exceeds the FTC's congressionally delegated Section 5 authority over "unfair or deceptive acts or practices" and "signal[s] the majority's view that the scope of the rules passed by the unelected commissioners of an independent agency should be on par with statutes passed by elected legislators." Referencing (1) "personalized" or "targeted" advertising, and (2) consent, which he refers to as "one of the traditional bedrocks of privacy policy," he argues that the ANPR portends regulating "common business practices we have never before even asserted are illegal."
- Overstepping the limits of the FTC's jurisdiction, "[i]t seeks to recast the agency as a civil rights enforcer, contemplating policing algorithms for disparate impact without a statutory command."
- It "shortchanges data security, one area ripe for FTC rulemaking."
Critically, Commissioner Phillips highlights how the ANPR in practice could result in consumer harm: "Reducing the ability of companies to use data about consumers, which today facilitates the provision of free services, may result in higher prices – an effect that policymakers would be remiss not to consider in our current inflationary environment."
On September 8, 2022, the FTC will host a virtual public forum on the ANPR.
Posts
