Commercial surveillance and data abuse: The FTC is kicking off a yearslong process to potentially address it

The Federal Trade Commission is stepping into the intensifying debate over digital privacy, an action that could ultimately lead to new rules on commercial surveillance, data gathering and algorithmic bias.

On Tuesday, the agency issued an Advance Notice of Proposed Rulemaking, asking for comment on how businesses track and use consumer data and whether it should create rules to govern them. The agency’s action comes a little over a month after President Joe Biden signed an executive order directing the FTC to help combat digital surveillance and protect reproductive services in the wake of the Supreme Court’s overturning of Roe v. Wade.

The agency’s announcement is the first step in an extended rule-making process that can take years. The final result could have significant implications for industries from technology to advertising. The U.S. has few nationwide privacy protections, in stark contrast to sweeping privacy laws like the European Union’s General Data Protection Act — instead relying on a patchwork of state laws.

But that is not a substitute for strong, comprehensive federal privacy legislation, with Commissioner Rebecca Slaughter saying she saw the FTC’s efforts as “complementary, not an alternative to, congressional legislation.

“Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts,” said FTC Chair Lina Khan in a statement Tuesday. “The growing digitization of our economy — coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used — means that potentially unlawful practices may be prevalent. Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like.”

Maneesha Mithal, a partner at Wilson Sonsini who spent more than 20 years at the Federal Trade Commission, where she led privacy policy reform and enforcement in emerging technology industries, said the start of the rule-making process was “hugely significant.”

“The FTC is the one federal agency that has jurisdiction over a broad range of sectors of the economy and has the expertise and capability to be considering a rule on privacy issues that affect really the national economy,” said Mithal. “And so I think it’s a very big milestone.”

Limited powers

The FTC announcement highlights the actions the agency has taken against companies for issues such as improperly sharing health-related data with third parties, using sensitive data for targeted advertising, and failing to have reasonable security protections for Social Security numbers.

The agency argues that it needs to create new rules to protect consumer data because enforcing its current authorities under the Federal Trade Commission Act, which gives it the power to investigate unfair practices and protect consumers, is insufficient.

The FTC lays out a couple of reasons for this, including that it is blocked from imposing civil penalties for first-time violations of Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.” But if it develops a new rule, it can hand down civil penalties to anyone who violates it. The agency also argues that creating a new rule would set clearer expectations for companies, as opposed to making the policy through enforcement actions retroactively.

“The FTC’s ability to deter unlawful conduct is limited because the agency generally lacks authority to seek financial penalties for initial violations of the FTC Act,” said the agency in its announcement. “By contrast, rules that establish clear privacy and data security requirements across the board and provide the Commission the authority to seek financial penalties for first-time violations could incentivize all companies to invest more consistently in compliant practices.”

The long road ahead

But developing a new rule is a complex undertaking. The FTC can’t just declare new practices illegal — it has to find that they meet the definition of unfair deceptive practices under the FTC Act, Mithal said. Tuesday’s request for comment begins this process by asking for public input that can help the agency make the case that certain practices are unfair or deceptive.

The agency is seeking comment on a wide array of areas, from harms stemming from discrimination by automated systems to “a growing body of evidence that some surveillance-based services may be addictive to children and lead to a wide variety of mental health and social harms.”

Questions the agency is posing to the public include “How prevalent is algorithmic discrimination based on protected categories such as race, sex, and age?” and “To what extent should the Commission consider rules that require companies to make information available about their commercial surveillance practices?”

Cynthia Khoo, a senior associate at the Center on Privacy and Technology at Georgetown Law, said she welcomed the wide scope of the action, given that issues like privacy, data security, civil rights, discrimination and workers’ rights often overlap.

Current FTC Commissioner Alvaro Bedoya was the founding director of the Center on Privacy and Technology at Georgetown Law before he was appointed to the FTC.

Khoo said that employee data has often been exempted from privacy legislation, for example. “Workers’ data is left out in the cold when it comes to protecting their privacy — even though, when you think about it, workers are even more vulnerable to technology companies or to employers using technological products to surveil and control them than consumers in some cases.”

Casting a wide net also allows the FTC to receive a wider range of comments, allowing more people and organizations to be involved in the feedback process.

“Data practices-based harms have accumulated over the past few years with really almost nothing being done to stem the tide,” said Khoo. “And despite efforts in other venues, seeing this rule-making proceeding finally happening from an agency that is well placed to address the issue and that seems willing to address the issue in a way that is meaningful and substantive is really promising.”

Biden’s July executive order directs the FTC to “to consider taking steps to protect consumers’ privacy when seeking information about and provision of reproductive health care services” and “consider options to address deceptive or fraudulent practices, including online, and protect access to accurate information.”

Sam Levine, director of the FTC’s Bureau of Consumer Protection, told reporters that some of the discussion around the Supreme Court’s recent decision striking down the national right to an abortion just underscores “what many people have been saying for a long time.”

“Consumer privacy is not just an abstract issue,” he said. “It really has real-world consequences for our freedom to worship, our ability to get healthcare or ability to be free of surveillance in the workplace and other spheres.”

Earlier this week, for example, news broke of a case in Nebraska of a woman and her teenage daughter being prosecuted over the daughter’s abortion — based in part on private messages law enforcement obtained from Facebook.

How and whether any rule-making will address privacy issues related to digital data, such as text or direct messages and web searches, remains to be determined by the rule-making process.

“What I see happening here when Biden says, ‘FTC, focus more on protecting privacy,’ I think that aligns with something Chair Lina Khan already had been doing since she got over there a year ago, which is returning to the FTC rule-making authority, which is not something that the FTC has done a lot of, certainly not in the last couple of decades,” said Thomas Kost, a former staff attorney with the FTC’s Bureau of Consumer Protection, in July shortly after Biden signed the executive order.

Kost said that the FTC has been more recently focused on investigations and fraud cases related to violations of current rules rather than developing new policies because the rule-making process is more cumbersome and the agency has historically been fairly cautious.

“I think rule-making is the best way to implement the president’s goals in part because, unlike these fraud cases, rule-making authority, once exercised, would apply to all companies in the industry subject to FCC jurisdictions — it’s really the only way to have like a market-wide impact.”

The rule-making process averages about five years from start to finish, and it can be prolonged by litigation. Mithal said that one source of legal challenges, and general uncertainty, stems from the Supreme Court’s decision in West Virginia v. EPA in June. In that ruling, which addressed the Environmental Protection Agency’s ability to regulate greenhouse gases, the court invoked the “major questions doctrine” — that if Congress intended agencies to make sweeping, economywide changes via regulation, the relevant legislation must say so specifically and clearly.

“I think there’s almost certainly going to be litigation over this [FTC] rule in any event, and with the EPA decision, I think that’s even more likely to happen,” said Mithal.

But the lengthy rule-making process is still a promising development, she added. “There’s no doubt about it,” said Mithal. “It’s a huge milestone for the FTC, for businesses and for consumers. And it’ll be interesting to see how that shakes out.”

Comments may be submitted up to 60 days after the notice is published in the Federal Register, which will occur in the coming days. A virtual public forum will be held on Sept. 8.

This article has been updated. Thanks to Lillian Barkley for copy editing this article.