August was shaping up to be the month U.S. privacy professionals might catch their breath while fluid discussions around the proposed American Data Privacy and Protection Act pause during U.S. Congress' summer recess. But now the U.S. Federal Trade Commission has everyone holding their breath once again.
The agency voted 3-2 on party lines to file an Advanced Notice of Proposed Rulemaking that will explore rules to "crack down on harmful commercial surveillance and lax data security." The filing to the Federal Register opens a 60-day public consultation period that seeks comments on "harms stemming from commercial surveillance and whether new rules are needed to protect people’s privacy and information." This is the third ANPR filing by the FTC in the last year but its the first to be publicly acknowledged and expanded upon by the FTC.
"The growing digitization of our economy — coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used — means that potentially unlawful practices may be prevalent," FTC Chair Lina Khan said. "Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like."
Notably, all five FTC commissioners wrote in their opinions that they prefer Congress pass the current federal privacy framework instead of having the agency draft rules.
The goal
In it's ANPR filing, the FTC described its intention to consider "trade regulation rules or other regulatory alternatives" that concern the ways in which organizations "collect, aggregate, protect, use, analyze, and retain consumer data" and how they "transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive." The agency added the proposed rulemaking stems from its recent enforcement work, media reports and research, which all suggest new rules may better protect consumers and "could also foster a greater sense of predictability for companies and consumers and minimize the uncertainty that case-by-case enforcement may engender."
FTC Commissioner Rebecca Kelly Slaughter pointed to more specific areas the ANPR covers beyond data collection, including "algorithms, ad-delivery, demographic data, engagement, and the ecosystem’s effects on kids and teens." She said the broad nature of the agency's inquiry should not be surprising and that "the record will alert us, and Congress, to widespread harms that may otherwise have not reached our attention."
While the consultation will ultimately shape rulemaking, FTC personnel previously spoken at length about the positive impacts new rules could have. Chief among impacts is the ability to set a new standard for consumer protection and prevent harms before they happen instead of serving punishment after the damage is done.
"We can show that our understanding of what isn't fair has evolved in response to these prevailing market practices and give specific guidance to industry about requirements of the law that will facilitate compliance and streamline the commission's enforcement burdens," Slaughter said at the IAPP Privacy. Security. Risk. 2021.
Khan added to those sentiments months later at the IAPP Global Privacy Summit 2022, noting how "market-wide rules could help provide clear notice and render enforcement more impactful and efficient." She also may have hinted at how potential rules would emphasize increased limitations around data practices.
"Going forward I believe we should approach data privacy and security protections by considering substantive limits rather than just procedural protections, which tend to create process requirements while sidestepping more fundamental questions about whether certain types of data collection and processing should be permitted in the first place," Khan said.
Rulemaking vs. federal legislation
From a high level, moving forward with rulemaking in the face of Congress' work on federal privacy legislation appears counterproductive. If lawmakers find a way to work through differences and the current federal bill prevails, the FTC would immediately drop its rulemaking and shift to its proposed enforcement role under the American Data Privacy and Protection Act.
"To get real consumer data privacy protections, Congress must act," Senate Committee on Commerce, Science and Technology Ranking Member Roger Wicker, R-Miss., said in public statement. Wicker is one of three co-sponsors of the current federal framework being debated. "FTC commissioners have acknowledged that legislation, not regulation, is the preferred way to achieve these protections. I hope today's action by the FTC helps underscore the urgency for the House to bring the American Data Privacy and Protection to the floor and for the Senate Commerce Committee to advance it through committee. The time to move on ADPPA is now."
During the press conference to announce the ANPR, FTC Commissioner Alvaro Bedoya said he would not vote for any potential rules that would overlap with the proposed ADPPA if it were to pass. Commissioner Slaughter said rulemaking "will not clip the wings of Congressional ambition" and the agency's work "is complementary to Congress’ efforts."
The view that a rulemaking launch could incentivize Congress to re-establish compromise and move toward final passage of legislation is logical, and it's been a thought on people's minds even before the American Data Privacy and Protection Act was in play.
"Until Congress steps up, the commission should use every tool at its disposal to regulate commercial data practices, including rulemaking," Electronic Privacy Information Center Senior Counsel John Davisson told The Privacy Advisor in December 2021 following the FTC's initial ANPR filing. "If the prospect of an FTC rulemaking finally spurs Congress to pass robust data protection legislation, all the better."
One source with knowledge of the FTC's workings told The Privacy Advisor in June that rulemaking was widely viewed as "a type of insurance" the agency could quickly fall back on if Congress was unable to work through current discrepancies stalling the ADPPA. But, as Wicker noted, potential FTC rules likely won't have the same impact federal legislation could.
FTC Commissioner Noah Phillips, who recently announced plans to resign from the commission this fall, said in his dissenting opinion to the filing that a federal law carries more strength and the commission is going beyond its abilities and jurisdiction.
"I would have supported an ANPR for a data security rule. I would have been more sympathetic to an ANPR that was focused on consumer privacy as reflected in our long record of enforcement and policy advocacy," Phillips wrote. "I cannot support an ANPR that is the first step in a plan to go beyond the commission’s remit and outside its experience to issue rules that fundamentally alter the internet economy without a clear congressional mandate. That’s not 'democratizing' the FTC or using all 'the tools in the FTC’s toolbox.' It's a naked power grab."
What's the process?
The IAPP Research and Insights team published an infographic following the FTC's initial ANPR in December 2021 to explain how the process works.
According to the graphic, the FTC will provide a 30-day notice to Congress following public comment period under the ANPR. Once the proposed rulemaking is filed, the agency must conduct preliminary analysis and a public consultation on its findings before informal hearings begin on the draft rules.
It's unclear whether steps for drafting, informal hearings and rule finalization include specific timetables for completion. The unknowns bring speculation that a privacy rulemaking would take years to complete, making federal legislation and its expedited timeline a more appealing option. Brookings Institution Tisch Distinguished Visiting Fellow Cameron Kerry told The Privacy Advisor last year that rulemaking "will take time and almost undoubtedly will be challenged in court."
