Earlier this week, the Federal Trade Commission (FTC) announced that it was initiating a rulemaking to "crack down on harmful commercial surveillance and lax data security." More specifically, the agency issued an Advance Notice of Proposed Rulemaking (ANPR) on Commercial Surveillance and Data Security and announced a related workshop on the topic. This rulemaking will be conducted pursuant to the FTC's organic rulemaking process, which is known as Mag-Moss rulemaking. There is quite a lot to digest about this new undertaking, and here are nine things you should know at the outset.
- The ANPR is notable for the enormous breadth of
issues that it covers. The document seeks comment on 95 different
questions, and the issues covered are broad and extensive. The
agency seeks information on issues ranging from potential harms to
children and teenagers from "commercial surveillance or lax
security" to questions involving competition and innovation to
issues involving biometrics and the use of algorithmic
decision-making and inquiries about consent, notice and the value
of certifications. Indeed, if there is a privacy or security issue
that you have pondered recently, there is a good chance that it is
mentioned in the ANPR.
- Although the ANPR discusses and seeks comment on dozens and
dozens of topics, there is an overall theme that emerges that is
primarily focused on questions about how data is collected from
consumers and how that data is then monetized through "[a]n
elaborate and lucrative market for the collection, retention,
aggregation, analysis, and onward disclosure of consumer
data." Although the ANPR attempts to, at times, take a
balanced view of the beneficial uses of consumer data, the ANPR
overwhelmingly focuses on the perceived harms.
- Mag-Moss rulemaking is complicated and time-consuming and
imposes significant restrictions on the kinds of rules the FTC can
promulgate. It generally takes far longer for the FTC to do a
Mag-Moss rule than to make rules through other techniques. Some of
the challenges of Mag-Moss rulemaking can be found here, but probably the most
important consideration is that the FTC can only issue rules
regarding practices that are either deceptive or unfair and that
are prevalent in the market. In short, the FTC can't just issue
a rule on practices that it may prefer; the rule must be premised
on deception or unfairness. And to show that a practice is unfair,
that practice must cause or likely cause substantial injury to
consumers that is not reasonably avoidable and that is not
outweighed by countervailing benefits to consumers or competition.
Demonstrating that a practice is unfair is not a simple
exercise.
- The rulemaking was voted out on party lines with a 3-2 vote.
Commissioners Wilson and Phillips (who has announced that he is leaving the agency this fall) both issued
dissenting statements. Commissioner Wilson, a "self-described privacy hawk," dissented because of misgivings about the
rulemaking's potential impact on federal privacy legislation
efforts as well as concerns about regulatory outreach. She calls
out the fact that "[m]any practices discussed in this ANPRM
are presented as clearly deceptive or unfair despite the fact that
they stretch far beyond practices with which we are familiar, given
our extensive law enforcement experience." As for Commissioner Phillips, his core concern is
that Congress, not the FTC, is "where national privacy law
should be enacted." He also calls out the fact that the ANPR
provides "no notice whatsoever of the scope and parameters of
what rule or rules might follow."
- The partisan divide on this rulemaking is notable and somewhat
surprising given that there has been fairly broad bipartisan
support in Congress for privacy legislation. Not surprisingly,
there is already at least
some initial concern being raised on the Hill about this
rulemaking. Realistically, the lack of bipartisan support is not a
great initial signal for success.
- Technically, we do not have a date certain for comments yet.
Comments will be due 60 days after the ANPR is published in the
Federal Register, and it has not yet been published. (Sometimes the
lag before publication is just a few days, and other times it can
be weeks before things are published in the Federal Register and
the clock starts ticking.)
- The next public discussion on the rulemaking will occur at an
FTC Workshop that is being held virtually on
September 8. In connection with that event, the agency is asking
members of the public to sign up and speak. A preliminary agenda
indicates that all three Democrat commissioners will be speaking,
and there will be a panel on industry perspectives and a panel on
consumer advocate perspectives.
- We are quite literally years away from the FTC issuing any sort
of final rule in connection with this rulemaking, and at this
point, we have no idea what that rule or rules will resemble or
address. It could focus on a small sliver of the issues raised in
the ANPR, or it could be much broader. It is also possible for the
agency to eventually bifurcate this rulemaking into multiple
smaller rulemakings.
- Finally, once a final rule is eventually issued (if that happens), it can be and will likely be challenged in the U.S. Court of Appeals for the District of Columbia within 60 days of promulgation. The court may "hold unlawful and set aside" a rule if the court finds that "the Commission's action is not supported by substantial evidence in the rulemaking record ... taken as a whole." The court can also set aside the rule if it decides that there were certain procedural infirmities in the way that the rulemaking was conducted, particularly in the informal hearings portion. In effect, the appeals process provides both substantive and procedural checks, requiring the agency to be quite mindful of the many Mag-Moss procedural requirements from the outset.
This rulemaking will be going on for a long time, and we will keep you up to date as developments occur.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
