Federal Trade Commission opens public debate on tougher US data protection rules as Congress makes progress with national legislation

The US Federal Trade Commission (FTC) took the debate around data privacy regulation a major step forward this week when it opened a consultation on whether to introduce sweeping new restrictions on how businesses can collect and use consumer data.

The Commission confirmed Thursday that it would open up to public comment on proposals to draft new regulations to push back on what FTC Chair Lina Khan has called “a commercial surveillance industry" in the US. The FTC’s Advance Notice of Proposed Rulemaking (ANPR) wants to hear from members of the public who have suffered harm from the existence of such an industry.

Khan stated:

Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts. The growing digitization of our economy—coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used—means that potentially unlawful practices may be prevalent. Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like.

In a statement, the FTC cited a number of concerns that have been aired, including:

• Companies that fail to adequately secure the consumer data they collect, putting that information at risk of exposure to hackers and data thieves.
• A growing body of evidence that some surveillance-based services may be addictive to children and lead to a wide variety of mental health and social harms.
• The lack of external insight into the automated systems that analyze data companies collect.
• The use of algorithms that are prone to errors, bias, and inaccuracy, which can lead to consumers being discriminated against based on legally-protected characteristics, such as race, gender, religion, and age.
• Companies that require people to sign up for surveillance as a condition for service and deny that service if consumers do not wish to have their personal information shared with other parties.
• Companies that change their privacy terms after the consumer has signed up in order to allow for more expansive surveillance. 
• Companies that increasingly employ dark patterns or marketing to influence or coerce consumers into sharing personal information. 
• And in the wake of the overturning of Roe v Wade, questions of data collection and sharing in relation to abortion and health privacy in general.

First steps

The consultation is only a first step in what would inevitably be a long and highly-contested journey, and seeks only gain and demonstrate support for moving forward with the idea of drafting a new regulatory regime. It’s notable that even this small step divided the Commission along party lines, with the two Republican Commissioners voting against the move, while the three Democrat members were in support.

That said, digital rights advocacy groups, such as The Center for Democracy & Technology (CDT), were enthusiastic, with CEO Alexandra Reeve Givens stating:

People want and deserve meaningful rules to protect their privacy. The FTC’s announcement is an important first step to examine the harms that can result from lax and abusive online data practices. We applaud the FTC for launching this process and engaging on privacy rules more generally. We look forward to engaging in this process and helping develop a strong public record of the need for meaningful privacy protections.

For her part,  Khan clearly thinks it’s a win so far, telling reporters after the vote:

Technological advancements over the last few decades have delivered enormous benefits, but they’ve also delivered tools that now enable persistent tracking and routinized surveillance of individuals. We all know businesses that collect personal data on individuals at a massive scale and in a stunning array of contexts — on our location, our health, what we read online, who we meet, what we buy.

Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts. Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices, and what those rules should potentially look like. We are very, very eager to hear from the public.

She added that these are problems that need to be dealt with now and are not about to go away:

I think in as much as we're seeing the continuing digitization of the economy, the issues that the ANPR focuses on are only going to continue to become even more and more relevant. And I think we all share the goal of being able to be forward leaning and, where we can, be able to nip harms in the bud. And so I think this process overall, at the very least, will help us create a robust public record that will inform both our enforcement, if and when we do decide to ultimately issue final rules, [and] will also strengthen our ability to deter law breaking in the first place. Violations of trade regulation rules come with civil penalties, which can have a much greater deterrent effect than what we're able to do right now for the most part, case-by-case. So I think on all of those fronts, it really is part and parcel of some of our broader goals.

Bigger picture

In a statement after the ANPR vote,  FTC Commissioner Rebecca Slaughter said:

For years, Congress has nibbled around the edges of comprehensive federal privacy legislation; it is now engaged in the advanced stages of consideration of such legislation. I not only welcome it — I prefer Congressional action to strengthen our authority - but I know from personal experience that the road for a bill to become a law is not a straight or easy one.

In the absence of that legislation, and while Congress deliberates, we cannot sit idly by or press pause indefinitely on doing our jobs to the best of our ability. The best time to initiate this lengthy process was years ago, but the second-best time is now. Effective nationwide rules governing the collection and use of data are long overdue. As the nation’s principal consumer-protection agency, we have a responsibility to act.

She said that the ANPR should be seen as  part of wider movement finally being made on the subject of Federal data privacy legislation in the US, with the bi-partisan American Data Privacy and Protection Act (ADDPA), introduced by the House Energy and Commerce Committee in June, looking promising.

She later expanded on her comments, saying:

It is a really important day today, not just for the effort to have effective nationwide data protection rules, but for the FTC more generally. Almost exactly three years ago I gave a speech arguing that case-by-case enforcement for data abuses wasn't effectively protecting users or deterring law breaking, arguing that we need a new Federal law and arguing that until such a law passes, the FTC should use all of its authority under current law, including initiating rule-making proceeding. Today, we're finally kicking that off.

She added that she has been encouraged by action in Congress of late, but that the FTC also has a role to play:

I'm thrilled with the progress Congress is making. I'm incredibly impressed with the American Data and Privacy Protection Act. I know from my time on the Hill that it's a product of tremendous effort, and its passage would mean real protections for consumers and a leap forward in civil rights protections for vulnerable communities. I would like to see it become a law. But I know that the legislative process progress is full of uncertainty. Until there's a law on the books, the Commission has a duty to use all the tools we have under current law to address unlawful behavior. Our effort is complementary, not an alternative to Congressional legislation.

Her remarks were picked up by fellow Commissioner Alvaro Bedoya, who also emphasized that he sees any FTC action as being complementary to the ADPPA:

Some may be concerned that this process may interfere with a bi-partisan privacy legislation. The American Data Privacy and Protection Act [is] the strongest privacy bill that has ever been this close to passing. I hope it passes, I hope it passes soon. This ANPR process is not going to interfere with that effort. Should the ADPPA pass, I will not vote for any rule that overlaps with it.

My take

More power to the FTC! This will get messy inevitably as the lobbyists get stuck in. As the big tech corporates prepare their dutiful pledges of support for more consumer protection, behind the scenes the wheels will be in motion to put as much pressure on legislators to dissent. But with this, plus the ADPPA progress, there’s finally a glimpse of a more robust data protection regime in the US.