ADventures in Law

Home | ADventures in Law

core/image

Earlier this week, the Federal Trade Commission (FTC) announced that it was initiating a rulemaking to “crack down on harmful commercial surveillance and lax data security.” More specifically, the agency issued an Advance Notice of Proposed Rulemaking (ANPR) on Commercial Surveillance and Data Security and announced a related workshop on the topic. This rulemaking will be conducted pursuant to the FTC’s organic rulemaking process, which is known as Mag-Moss rulemaking. There is quite a lot to digest about this new undertaking, and here are nine things you should know at the outset.

core/paragraph

The <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/commercial_surveillance_and_data_security_anpr.pdf">ANPR</a> is notable for the enormous breadth of issues that it covers. The document seeks comment on 95 different questions, and the issues covered are broad and extensive. The agency seeks information on issues ranging from potential harms to children and teenagers from “commercial surveillance or lax security” to questions involving competition and innovation to issues involving biometrics and the use of algorithmic decision-making and inquiries about consent, notice and the value of certifications. Indeed, if there is a privacy or security issue that you have pondered recently, there is a good chance that it is mentioned in the ANPR.

core/list-item

Although the ANPR discusses and seeks comment on dozens and dozens of topics, there is an overall theme that emerges that is primarily focused on questions about how data is collected from consumers and how that data is then monetized through “[a]n elaborate and lucrative market for the collection, retention, aggregation, analysis, and onward disclosure of consumer data.” Although the ANPR attempts to, at times, take a balanced view of the beneficial uses of consumer data, the ANPR overwhelmingly focuses on the perceived harms.

Mag-Moss rulemaking is complicated and time-consuming and imposes significant restrictions on the kinds of rules the FTC can promulgate. It generally takes far longer for the FTC to do a Mag-Moss rule than to make rules through other techniques. Some of the challenges of Mag-Moss rulemaking <a href="https://www.adventures-in-law.com/ftc/you-do-have-time-for-this-the-new-wave-of-ftc-rulemaking/">can be found here</a>, but probably the most important consideration is that the FTC can only issue rules regarding practices that are either deceptive or unfair and that are prevalent in the market. In short, the FTC can’t just issue a rule on practices that it may prefer; the rule must be premised on deception or unfairness. And to show that a practice is unfair, that practice must cause or likely cause substantial injury to consumers that is not reasonably avoidable and that is not outweighed by countervailing benefits to consumers or competition. Demonstrating that a practice is unfair is not a simple exercise.

The rulemaking was voted out on party lines with a 3-2 vote. Commissioners Wilson and Phillips (who has announced that he is <a href="https://www.politico.com/news/2022/08/08/ftc-commissioner-noah-phillips-step-down-00050293">leaving the agency this fall</a>) both issued dissenting statements. Commissioner Wilson, a “<a href="https://www.politico.com/news/2022/05/11/senate-vote-lina-khan-antitrust-00029129">self-described privacy hawk</a>,” <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/Commissioner%20Wilson%20Dissent%20ANPRM%20FINAL%2008112022.pdf">dissented</a> because of misgivings about the rulemaking’s potential impact on federal privacy legislation efforts as well as concerns about regulatory outreach. She calls out the fact that “[m]any practices discussed in this ANPRM are presented as clearly deceptive or unfair despite the fact that they stretch far beyond practices with which we are familiar, given our extensive law enforcement experience.” As for <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/Commissioner%20Phillips%20Dissent%20to%20Commercial%20Surveillance%20ANPR%2008112022.pdf">Commissioner Phillips</a>, his core concern is that Congress, not the FTC, is “where national privacy law should be enacted.” He also calls out the fact that the ANPR provides “no notice whatsoever of the scope and parameters of what rule or rules might follow.”

The partisan divide on this rulemaking is notable and somewhat surprising given that there has been fairly broad bipartisan support in Congress for privacy legislation. Not surprisingly, there is already at least <a href="https://www.blackburn.senate.gov/2022/8/blackburn-statement-on-ftc-privacy-proceeding#:~:text=U.S.%20Senator%20Marsha%20Blackburn%20Issued,certainty%20for%20consumers%20and%20businesses.">some initial concern being raised on the Hill</a> about this rulemaking. Realistically, the lack of bipartisan support is not a great initial signal for success.

Technically, we do not have a date certain for comments yet. Comments will be due 60 days after the ANPR is published in the Federal Register, and it has not yet been published. (Sometimes the lag before publication is just a few days, and other times it can be weeks before things are published in the Federal Register and the clock starts ticking.)

The next public discussion on the rulemaking will occur at an <a href="https://www.ftc.gov/news-events/events/2022/09/commercial-surveillance-data-security-anpr-public-forum">FTC Workshop</a> that is being held virtually on September 8. In connection with that event, the agency is asking members of the public to sign up and speak. A preliminary agenda indicates that all three Democrat commissioners will be speaking, and there will be a panel on industry perspectives and a panel on consumer advocate perspectives.

We are quite literally years away from the FTC issuing any sort of final rule in connection with this rulemaking, and at this point, we have no idea what that rule or rules will resemble or address. It could focus on a small sliver of the issues raised in the ANPR, or it could be much broader. It is also possible for the agency to eventually bifurcate this rulemaking into multiple smaller rulemakings.

Finally, once a final rule is eventually issued (if that happens), it can be and will likely be challenged in the U.S. Court of Appeals for the District of Columbia within 60 days of promulgation. The court may “hold unlawful and set aside” a rule if the court finds that “the Commission’s action is not supported by&nbsp;substantial&nbsp;evidence&nbsp;in the&nbsp;rulemaking record … taken as a whole.” The court can also set aside the rule if it decides that there were certain procedural infirmities in the way that the rulemaking was conducted, particularly in the informal hearings portion. In effect, the appeals process provides both substantive and procedural checks, requiring the agency to be quite mindful of the many Mag-Moss procedural requirements from the outset.

core/list

This rulemaking will be going on for a long time, and we will keep you up to date as developments occur.

Nine Things You Should Know About the New FTC Rulemaking on Privacy and Targeted Advertising