As the debate rages on regarding whether the U.S. Federal Trade Commission should or could begin rulemaking on privacy, the commission has signaled it is not willing to wait for a consensus. On Dec. 10, the FTC filed an Advanced Notice of Proposed Rulemaking with the Office of Management and Budget that initiates consideration of a rulemaking process on privacy and artificial intelligence.

The filing describes the FTC's intent as seeking to "curb lax security practices, limit privacy abuses, and ensure that algorithmic decision-making does not result in unlawful discrimination." The Electronic Privacy Information Center brought light to the filing and its inclusion in the FTC's Semiannual Regulatory Agenda.

ANPRMs are aimed at soliciting stakeholder comments before an official rulemaking process is carried out under a Notice of Proposed Rulemaking. The FTC's filing is currently dated for February 2022, meaning it will either commence its solicitation period under the ANPRM then or begin its rulemaking process.

"The FTC is taking steps to use its authority to issue such a rule under Section 18 of the FTC Act, 15 U.S.C. 57a, which enables it to prescribe particular acts and practices as deceptive or unfair, using what are called ‘Magnusson-Moss’ or ‘Mag-Moss’ procedures that are more elaborate than traditional APA notice-and-comment rulemaking procedures," said Perkins Coie Partner Janis Kestenbaum, a former senior legal advisor to former FTC Chair Edith Ramirez. "This is something that some Democratic senators have called on the FTC to do, and something the Democratic commissioners at the FTC have signaled they wanted to do."

What can rulemaking accomplish?

Stakeholders across the board have brought forward many reasons as to why a privacy rulemaking will or won't produce the results. Chief and most obvious among the pros for rulemaking is lack of well-defined and up-to-date rules in the U.S. that keep up with emerging technology.

"Rulemaking allows the Commission to define, prohibit and establish guardrails around unfair and deceptive uses of personal data," EPIC Senior Counsel John Davisson said. "It also unlocks civil penalties against companies that engage in those unlawful practices. Rulemaking is not a quick or easy process, but we think it's a critical step."

Brookings Institution Tisch Distinguished Visiting Fellow Cameron Kerry was pleased to see the FTC take its leap after a perceived "culture of caution" around taking up rulemaking dating back to the 1970s when U.S. Congress made the process more daunting. Kerry believes only time and more transparency into the process will tell whether the concept of stringing together rules will be effective.

"We’ll have to see just how piecemeal. The topics in the notice could encompass a lot of issues," Kerry said, also noting the commission clearly knows what it wants to do after it "signaled its intention to go down this road" months ago.

What Kerry and Davisson don't want to get lost in the rulemaking shuffle is that the need for federal privacy legislation will remain even with new FTC rules in place. The argument against rulemaking has been that it will lead to a perception of diminished value with a federal law. 

"Congress should not read from this that the FTC is on the case and they are off the hook," Kerry said. "Any FTC rules will take time and almost undoubtedly will be challenged in court."

Kerry also noted a federal law would undoubtedly provide the FTC with "clear-cut authority to enforce" any regulation Congress draws up, which may end up proving more powerful and effective than rules. But with an eye toward aforementioned potential of delays on those rules through a lengthy drafting process and legal challenges, Davisson believes this is a path the FTC needs to go down to potentially get Congress' attention.

"Until Congress steps up, the Commission should use every tool at its disposal to regulate commercial data practices, including rulemaking," Davisson said. "If the prospect of an FTC rulemaking finally spurs Congress to pass robust data protection legislation, all the better."

Momentum, philosophy lead to action

The details around this potential rulemaking are scant, but prior actions by the FTC and comments from current and former FTC personnel show the commission's hand.

Whether the commission would take up privacy rulemaking was more of "when" rather than "if" after the FTC voted 3-2 in favor of adjustment to its approach for drawing up new rules for unfair or deceptive business practices under Section 18. Those changes, including giving the FTC chair oversight over a rulemaking process and removing some public comment periods, were aimed at simplifying and expediting a the rulemaking process.

FTC Commissioner Rebecca Kelly Slaughter explained her view on rulemaking in November at IAPP's Privacy. Security. Risk. 2021. Slaughter called rulemaking "an opportunity to develop a public participatory record" while showing its evolved understanding of the issues at hand. She added that rulemaking would allow the commission to issue "specific guidance to industry about requirements of the law that will facilitate compliance and streamline the commission's enforcement burdens, allowing us to use limited resources more effectively."

Back in October, Kestenbaum told the IAPP that she believed the commission was poised to churn out a series of privacy rules in the near future. Kestenbaum opined that potential rules would include "measures that are appearing in proposals in Congress and many state legislatures," noting requirements for reasonable security safeguards and individual privacy rights among the topics lawmakers have covered. 

Photo by ipse dixit on Unsplash