FTC Probes Stricter Data Privacy Rules

WASHINGTON — The Federal Trade Commission is asking the public if they’d like more privacy shields to protect them from “commercial surveillance” and poor data security.

The commission announced an Advance Notice of Proposed Rulemaking Thursday that kicks off the solicitation of public comment that seeks to build “a rich public record” of how people want to see data privacy handled in the United States, according to Chair Lina Khan. 

“The FTC for many years, over two decades now, has really been on the front line of using our existing enforcement tools to combat privacy violations and data security breaches. But we’ve seen now that the growing and continuing digitization of our economy means that some of these practices may now be irrelevant and that case-by-case enforcement may fail to adequately deter law breaking or remedy the harms,” Khan said at a press conference announcing the commission’s next steps.

She was joined by the two other Democratic members, Commissioners Rebecca Slaughter and Alvaro Bedoya, of the five-person commission. 

They plan to use the commission’s own rule-making powers to further protect Americans’ data, from basic contact information to location data and shopping habits.

The commission’s notice specifies looking into “commercial surveillance” because of the “breadth and the pervasiveness of the information collection processes we are seeing,” said Samuel Levine, the director of the Bureau of Consumer Protection.

Monitoring data from wearable fitness trackers to phones and smart appliances connected to the internet, a “growing number of businesses rely on surveillance as part of their business model,” Levine said. “And that means consumers … are subject to information collection, often without the knowledge of control.”

This action also comes on the heels of privacy advocates raising the alarm about how personal data could be used to prosecute people in the wake of the Supreme Court’s Dobbs decision to overturn Roe v. Wade if states criminalize abortion.

President Joe Biden issued an executive order earlier this summer instructing the commission to establish rules on data privacy as part of “promoting competition.”

The U.S. has no specific online data privacy rule that applies to everyone. The only law that addresses online data collection is the Children’s Online Privacy Protection Act of 1998, which protects children up to the age of 13. There is movement in the Senate to raise the age, protecting all children under 18.

Bicameral, bipartisan privacy legislation to grant everyone online privacy protection is currently pending in the House, which all the commissioners applauded. 

In lieu of having any specific data privacy law, the commission is looking to see what Americans perceive as deceptive practices, the Democrats on the commission said.

“We are committed to following Congress’ direction,” Slaughter said.

Bedoya agreed, promising, “I will not vote for any rule that overlaps with it.”

The two Republicans on the commission, Commissioners Noah Phillips and Christine Wilson, released dissenting statements, instead urging Congress to take a legislative approach instead of the commission proceeding on its own. They also argued that the commission’s rule-making could delay or overstep Congress’ progress on the legislation.

“Regulatory and enforcement overreach increasingly has drawn sharp criticism from courts. Recent Supreme Court decisions indicate FTC rulemaking overreach likely will not fare well when subjected to judicial review,” Wilson said in a statement citing the recent decision that limited the Environmental Protection Agency’s regulations for power plants.

The Democrats on the commission believe it is fully within their power to make rules through this process.

They specifically cited their Section 18 rule-making authority that states “the commission may use rule-making to address unfair or deceptive practices or unfair methods of competition that occur commonly, in lieu of relying solely on actions against individual respondents.”

The commission’s broad rule-making notice is to solicit information so that commissioners can “have an open mind and really rely on the record,” Slaughter said.

The notice seeks a wide variety of feedback and the commission is set to hold a public hearing about potential data privacy rules in September.

The rule-making process is also lengthy, so Congress could act faster, the commissioners said.

“The process we initiated today is not the substitute for strong, comprehensive federal privacy legislation,” Levine said. “Congress has stronger tools. Congress has broader tools. Congress has faster tools to protect consumers’ privacy. I think there’s a shared recognition on the commission and on the Hill that we want to address, so I want to be very clear that Congress is in the best position to quickly and effectively protect consumers’ privacy.”

Madeline can be reached at [email protected] and @MadelineHughes