Now that the curtain has been pulled back on Facebook's privacy missteps, questions persist about the U.S. Federal Trade Commission and whether it has the proper enforcement authority to keep companies in line.

A hearing on Capitol Hill came to the conclusion that it does not — at least, not yet. The FTC commissioners were called to the Senate yesterday to face inquiries from lawmakers on whether the agency has the resources and powers it needs to tackle privacy violations in the current data ecosystem. There was wide agreement the FTC needs more firepower to do its job properly, but lawmakers also offered sharp criticism about the agency's failure to use the enforcement powers it already has to regulate big tech and expressed frustration that the agency hasn't indicated publicly progress on its most notable investigations.

All five FTC commissioners spoke in front of the U.S. Senate Subcommittee on Consumer Protection, Product Safety, Insurance and Data Security at the hearing titled "Oversight of the Federal Trade Commission."

FTC Chairman Joseph Simons and Commissioners Rohit Chopra, Noah Phillips, Becca Kelley Slaughter and Christine Wilson answered questions on a variety of topics. The majority of the hearing was devoted to data privacy.

Specifically, much of the questioning focused on the prospects of a U.S. federal privacy law. Sen. Jerry Moran, R-Kan., who heads the committee, said the EU General Data Protection Regulation and the passing of the California Consumer Privacy Act of 2018 have shown the U.S. needs a federal privacy rule, a sentiment the commissioners shared.

The FTC hopes such a law would give it powers it does not currently possess. Simons said while the FTC exerts all the enforcement authority it currently has, Section 5 of the FTC Act is ultimately an "imperfect tool." A federal privacy law could give the agency the ability to seek civil penalties and jurisdiction over nonprofits and common carriers. The agency does not want, however, a federal privacy rule to limit commerce.

"While we remain committed to vigorously enforcing existing privacy-related statues, we are hopeful that Congress can craft legislation that would more seamlessly balance consumers’ legitimate concerns regarding collection, use and sharing of their data, while providing the flexibility to foster competition and innovation to the benefit of consumers," Simons said.

Phillips said it is important for Congress "to be clear and frank about the wrongs you seek to right" within a potential law. He calls privacy a "nebulous concept," as different parties will find some risks to be more important to address than others.

"It is critical that Congress decide what the harms are, and then target tools to address those harms. I don’t think that the liability standard, what harms we are addressing, can be separated from the civil penalties," Phillips said. "You have to think about the two together, what you are enforcing and how."

While the commissioners agreed on the need for federal privacy rule, the question about preempting state laws raised some debate. Simons said a strong federal statute could help eliminate confusion around a patchwork of laws. Phillips believes one unifying set of rules will help smaller companies that do not have the resources to keep tabs on the requirements of different state laws.

Chopra urged lawmakers to take caution when considering preempting state laws, adding the preemption of state rules in the mortgage market was "catastrophic." Slaughter said she would support preempting state laws only if the federal rule did not replace current legislation with stronger privacy protections.

As it stands today, some lawmakers feel the FTC could be doing more with the powers it has. Sen. Richard Blumenthal, D-Conn., said the agency has not performed to its capabilities on some of the more notable privacy cases over the past couple of years.

Blumenthal said while the agency does need more resources to help in its efforts, the agency's shortcoming are more from a lack of will. Blumenthal cited Facebook as an example of these shortcomings.

"Any rules that we pass need to be enforced. That FTC consent decree should have prevented Cambridge Analytica," Blumenthal said. "The FTC can’t claim to be surprised. If we let Facebook and Google police themselves, they will always come short. We need a commitment from you to end this cycle of impunity."

Blumenthal brought up Facebook again later in the hearing to ask about an update to the FTC's investigation, one that it started eight months ago. The FTC announced in March it would look into whether the social media platform violated a 2011 consent decree. The senator noted the U.K. Information Commissioner's Office has already fined Facebook for the Cambridge Analytica situation, and the U.K. Parliament recently obtained internal documents on Facebook's privacy practices.

In response, Simons repeatedly said he was not able to comment on any ongoing nonpublic investigation. The chairman offered a similar answer when asked by Sen. Ted Cruz, R-Texas., about Google's recent privacy issues.

"We need to know when you will have some results, because these continuing violations clearly show that we have something more than a single bad actor, and it’s not only Facebook," Blumenthal said.

The commissioners answered questions about other privacy topics, as well. Sen. Ed Markey, D-Mass., pressed the commissioners to continue fighting for children's privacy, while Sen. Shelley Capito, R-W.Va., asked about what the agency was doing to curb robocalls.

But in order to take on all these different avenues, the agency will need more resources, many seem to agree. Moran wants to ensure the agency has what it needs to protect consumers, and it will take the FTC's requests into consideration as a federal privacy law is developed.

Slaughter called for the FTC to be granted resources for more technologists and employees to help the agency's ever-increasing workload. Specifically, she said, the agency should have staff levels that rival what the agency had during the Reagan administration. 

Chopra agreed with the sentiment. The commissioner said the largest firms in the U.S. economy are gathering large amounts of data and are looking to monetize the information they collect. As long as that movement continues to grow, Chopra explained, the FTC's resources will need to grow, as well.