The Federal Trade Commission (FTC) has called for public input into how data privacy and surveillance issues should be regulated, taking a key first step in rethinking the rules that govern how companies handle personal data.
FTC Chair Lina Khan expressed concern on Thursday that the “massive scale” of data collection online was causing “a host of harms” to consumers.
While the European Union has had data protection laws requiring companies to get user consent for most forms of online data collection since 2018, the US has lagged behind. The decision to proceed with the rulemaking process was taken in a 3-2 vote won by the FTC’s three Democratic Commissioners.
The Advance Notice of Proposed Rulemaking (ANPR) initiated last Thursday announced the FTC is “exploring rules to crack down on harmful commercial surveillance and lax data security”. Under the FTC Act, the Commission has the power to issue rules prohibiting “prevalent”, “unfair or deceptive” trade practices.
In a press release, the FTC showed the organisation is open to rulemaking on a wide range of issues. Algorithmic discrimination, practices that foster social media addiction in children and commercial surveillance that “may discriminate against consumers based on legally protected characteristics like race, gender, religion, and age” were among the issues raised.
In a press conference held by the FTC’s three Democratic Commissioners, Chair Khan said that the “enormous benefits” technological advancement over the last few decades has brought have been accompanied by “tools that now enable persistent tracking and scrutinised surveillance of individuals”.
“We all know that businesses now collect data on individuals at a massive scale and in a stunning array of contexts: on our location, our health, what we read online, who we meet, what we buy,” she said.
Khan argued that the widespread “host of harms” caused to consumers today means the FTC’s traditional approach of “using our existing enforcement tools to combat privacy violations and data security breaches” may now “fail to adequately deter law-breaking or remedy the resulting harms”.
Before new rules can be issued, the Commission will look to create a large “public record” to “inform our assessment of whether rulemaking is worthwhile”. The FTC will also be holding a virtual public forum on September 8th where people will be able to contribute ideas and concerns.
“We are very very eager to hear from the public,” said Khan. “These comments will be critical for documenting specific harmful business practices and their prevalence and the magnitude and extent of any resulting harm.”
On her broader strategy as FTC Chair, Khan said she was “really eager to identify harms that are systemic.”
Commissioner Alvaro Bedoya added that while “our nation is the unquestioned leader in the world on technology, we are almost alone in our lack of meaningful protections for this infrastructure.”
“We don’t have a modern data security law,” he said. “We don’t have a baseline privacy rule. We don’t have civil rights protections suitable for this era and all of this landscape is ripe for abuse.”
Bedoya said it was important the Commission began the process by asking questions. “How prevalent is algorithmic discrimination? Does research link excessive time on social media to depression, anxiety and self-harm among certain groups of kids or teens? How do we protect against stalking apps? How do we protect privacy when a snapshot of a person’s voice or face is enough to identify them?” he asked.
Both Republican FTC Commissioners opposed last week’s ANPR. In the dissenting statement on the move, Commissioner Noah Joshua Phillips wrote that it is “Congress—not the Federal Trade Commission FTC where national privacy law should be enacted”.
Phillips also criticised the lack of clear direction in the ANPR, which he said “provides no notice whatsoever of the scope and parameters of what rule or rules [sic] might follow”, adding that the Commission was “undermining the public input and congressional notification processes.”
“It is the wrong approach to rulemaking for privacy and data security,” he said.
Phillips, who dissented against the Commission’s antitrust case against Meta in December 2020 and has called Joe Biden’s administration “as hostile to mergers and acquisitions (M&A) as any in my lifetime”, plans to resign his role later this year.
Noting the partisan divide in the FTC’s move, Commissioner Bedoya said he wanted “to extend a word of thanks to my Republican colleagues for their feedback and their candour. We may disagree on the vote today, but I will continue to seek them out for their feedback and their insight and whenever I can I will follow it.“
In fact, the Commission’s move towards overarching data and privacy regulations comes at a time of rare bipartisan appetite for legislation in the area. A new version of the American Data and Privacy and Protection Act (ADPPA) has both Democratic and Republic support in the House and Senate, but still faces challenges including from California representatives who feel the bill may undermine existing legislation in their state.
All three Democratic FTC Commissioners support ADPPA, with Commissioner Rebecca Slaughter saying in the press conference that regardless of new Commission rules, “we need a new federal law”. While the Republican members argue the process set out by the FTC interferes with the responsibilities of Congress, Commissioner Bedoya committed not to vote for any new rules which overlap with potential federal legislation.
“Until such a law passes,” Slaughter said, “the FTC should use all of its authority under current law, including initiating rulemaking proceedings.”
“I’m thrilled with the progress congress is making,” she said. “I’m incredibly impressed with the American Data and Privacy Protection Act. Its passage would mean real protections for consumers and a leap forward in civil rights protections for vulnerable communities. I would like to see it become a law.”
“But I know that the legislative progress is full of uncertainties. Until there is a law on the books, the Commission has a duty to use all the tools we have under current law. I see our efforts as complementary, not an alternative to congressional legislation.”
