Coincidence is best defined as events or circumstances that casually occur in correspondence with one another. But what looks like coincidence can sometimes turn out to be more coordinated action than anything else. This potential blurred line is something being raised following a flurry of activity involving the U.S. Federal Trade Commission's privacy work.

The FTC has been in the spotlight over recent months with news regarding a potential funding boost, a call to begin privacy rulemaking, personnel moves, and a number of activities pertaining to enforcement. Having all these developments crop up all at once could certainly stir arguments over coincidence versus coordination, but there's no questioning these moves indicate the commission is in for an overhaul.

This type of momentum was expected for the commission when FTC Chairman Lina Khan, a noted antitrust professional, was appointed to her post in June. Whether everything is coming together too quickly to make the proper impact is up for debate, but some former FTC officials see the need to act.

"The reality is we are seeing a necessary response," said California Privacy protection Agency Executive Director Ashkan Soltani, a FTC former chief technologist. "It's not too fast and, if anything, it's much too slow and too late. That's why we saw California step up (with its privacy laws) because really we wouldn't have seen that happen if we felt like things were addressed. I worked on the Facebook, Twitter and Google investigations (while at the FTC) in the 2010s, and we saw what little impact if any that it made on consumer protection or bad practices. Time and time again we see these companies in the news for neglecting to adequately protect consumers or disclose collection practices."

Baker Botts Partner Maureen Ohlhausen, who served as FTC acting chairman and commissioner during her tenure from 2012 to 2018, doesn't think the FTC's work on privacy over the years should go unrecognized. But like Soltani, Ohlhausen understands the opportunity exists for the commission to improve its enforcement work by way of renewed focus or the proposed boosts for resourcing and power.

"We've just reached this point where the FTC's ability to take on the challenges and concerns have outstripped the resources it’s been given, monetarily and statutorily," Ohlhausen said. "We're at the point now of wondering how to move forward."

$1B for privacy, data security through federal bill

Arguably the most transformative change being explored for the FTC is to increase its resourcing, a move that's under consideration by U.S. Congress. In September, the U.S. House Energy and Commerce Committee passed a proposal to increase $1 billion over 10 years to support the creation and staffing of new privacy and data security division. The proposal came as part of a $3.5 trillion spending bill that is still being discussed by federal lawmakers, and there's no indication the measure has been removed during negotiations to this point.

"I think it would be extraordinarily significant, if not monumental," said Perkins Coie Partner Janis Kestenbaum, who served as senior legal advisor to former FTC Chair Edith Ramirez. "A roughly 30% increase that's earmarked for use by a new privacy division. That'd be such an infusion of resources that would really be a gamechanger because the FTC has labored despite doing extraordinary work. I' always wowed to see what they've done with so little, so to see they would have so much more to work with makes me think we'd see such an uptick in its privacy initiatives."

While the funding would likely do more to increase staffing than anything else, Ohlhausen noted more hands on deck will undoubtedly mean more help toward existing efforts on case-by-case enforcement along with reports and studies that help target the commission's actions and guidance. However, Ohlhausen would prefer an eyes-wide-open approach to making hires if the funding comes to fruition.

"Everyone keeps talking about hiring technologists, but I think it makes sense to devote some money to hiring subject matter experts," Ohlhausen said. "Technologists are not fungible and they do not know everything about all aspects of these different technologies. I think they'd be well served to invest in some in-house and some outside expert technologists, but also bring in more lawyers for case-specific enforcement, and economists versed in privacy economics."

Soltani favors the funding, but only if it can help the agency as a whole.

"I'm a little hesitant to recommend it only be allocated to privacy and data security because a lot of the resources and work for the FTC are particularly around things that are technical. That extends across the agency," Soltani said. "I'd hope the agency would use the boost in resources to expand out the Office of Technology Research and Investigation, but the goal of that group is to service all of agency not one aspect of it. … I do recognize data security is more politically viable, but I do hope the agency uses resources to expand in a scalable way across the agency's mission."

Democrats ask FTC to begin privacy rulemaking

One of the benefits to increased funding would be having a full and capable staff to take on more rulemaking, which is being encouraged by federal lawmakers in the absence of federal privacy legislation. Nine Senate Democrats wrote to the FTC in September urging rulemaking alongside continued efforts to pass a federal privacy law. Those calls for action spilled into a Senate Committee on Commerce, Science, and Transportation hearing shortly after the letter was delivered.

During her keynote speech at IAPP's Privacy. Security. Risk. 2021 in San Diego, California, FTC Commissioner Rebecca Kelly Slaughter divulged her views on whether rulemaking was justified and a path worth exploring.

"We cannot sit idly by. The FTC does have tools, albeit imperfect ones, to tackle data abuses," Slaughter said. "One-off enforcement cases have their limits on disciplining the market and fundamentally changing business practices. Promulgating clear rules in this area would be beneficial to consumers and businesses alike. Although it is much maligned, the FTC does have rulemaking authority under Section 18 of the FTC Act to address prevalent conduct that is unfair or deceptive."

Slaughter went on to break down how rulemaking would proceed, noting the construction of an "evidentiary record off of which a rule or several rules can be developed." She added that she's heard the arguments against the FTC taking this route and how it would be "inappropriate" to do so due to the "value judgements" it requires.

"This argument rings hallow with me," Slaughter said. "By choosing not to act, we are exercising a value judgement that the market is working absent intervention. Second, it is incumbent on us to use the tools Congress explicitly gave us, which include rule-writing authority to carry out our statutory mission. To do otherwise would be ignoring the will of Congress."

Kestenbaum doesn't oppose taking up rulemaking, but she sees various hurdles. Among the challenges are the prescribing prevalent 'deceptive' or 'unfair' practices instead of implementing requirements, and the realization that the process could take years even under an expedited process.

"I expect the FTC will forge ahead and initiate one or more privacy and data security rulemakings," Kestenbaum said. "I wouldn’t be surprised if the commission did not hold back and sought to impose by rule many of the types of measures that are appearing in proposals in Congress and many state legislatures – greater transparency, requirements for reasonable security safeguards, requirements around data sharing for interest-based advertising, and individual rights like deletion and access."

Ohlhausen is more of a skeptic on rulemaking, due in large to it taking the spotlight from much-needed efforts to get a federal privacy law on the books.

"When you look at what the FTC can do through rulemaking, it can only define with a rule what is a particular unfair or deceptive act or practice," Ohlhausen said. "It must be tied back to the authority it has rather than something new. Things like rights of access, correction or other affirmative obligations on companies … I think it'd be difficult for the FTC to say it's an unfair deceptive act or practice for a company not to provide that. So you'd only be doing a partial job by rulemaking."

Incoming, outgoing staff

Lost in the shuffle of rulemaking and potential funding is the pending appointment of Georgetown University Founding Director of the Center on Privacy & Technology Alvaro Bedoya as FTC commissioner. Bedoya's privacy background has depth, including work as a staffer on the Senate Judiciary Committee's Subcommittee on Privacy, Technology and the Law. His appointment awaits Senate confirmation, which has no declared timeline.

As many onlookers viewed Khan's appointment as a clear warning to antitrust violators, the potential addition of Bedoya may offer the same type of message to anyone undercutting privacy. If Bedoya's nomination is cleared, the FTC will also be adding a champion for consumer equality and fairness, according to Soltani.

"The administration has made pretty clear that equity around social justice and civil rights are top priorities at large across the agency. Alvaro has a track record of looking at technology issues not just from the legal and privacy perspectives, but from the equity and civil rights perspectives as well," Soltani said. "For that reason, I think he's a strong choice and great choice. What really matters is how these practices affect people's lives, and Alvaro is a great person who's incredibly attuned to those issues with regards to how they impact traditionally under-privileged communities, minorities and more."

Kestenbaum expects Bedoya's potential presence to "supercharge" the FTC's existing privacy work due to "an expertise and experience that is so deep." Reading the tea leaves, Kestenbaum certainly sees a connection between the proposed privacy and data security division and Bedoya's nomination.

"It's hard to know, but it could be intended to get everybody excited," Kestenbaum said. "Just to be able to say that with this new department there will be somebody at the commission level that's a privacy scholar and notable figure."

In addition to Bedoya's nomination, Khan recently announced she brought on Olivier Sylvain as her senior advisor. Sylvain, a professor at Fordham law school, is expected to advise on rulemaking and emerging technology.

Bedoya's hire, however, raises questions with Ohlhausen as to whether a wider net should've been cast for commissioner candidates. "Bedoya does bring privacy interest and focus to the table. The FTC proceeds through general case-by-case enforcement and it'd be good to also strengthen the agency’s litigation experience," Ohlhausen said. "Bedoya is a knowledgeable person overall, but it remains to be seen whether Chairman Khan will turn to him for advice."

The additions to the FTC's staff don't come without some departures. Digiday reports the FTC lost Bureau of Consumer Protection Deputy Director Daniel Kaufman, Division of Privacy and Identity Protection Associate Director Maneesha Mithal, and Chief Technologist Erie Meyer. The outgoing staff raises questions regarding retention tactics and general goals current leadership is trying to set.

"You need skilled, knowledgeable people to carry out your agenda. If those people aren't on hand then it's going to make it more difficult," Ohlhausen said. "You're going to need people with a deep experience to make things stick."

Photo by ipse dixit on Unsplash