We’re interested in a recent article published on the Brookings Institution site by Jessica Rich, Distinguished Fellow,Institute for Technology Law and Policy, Georgetown University Law Center. Rich spent 26 years with the Federal Trade Commission (FTC) up until 2017 and has suggested five reforms the FTC can undertake now to strengthen the agency.
This is particularly interesting to us because the FTC is the agency charged with protecting consumer privacy in the US. But, Rich says the 108-year old institution faces significant challenges across the board, which include the agency “badly need[ing] a stronger federal law to protect the privacy of the American public.”
We, like many, believe a US national privacy law is now more likely than ever before, but we’re not there yet. So while the FTC, and the rest of us, wait for that, here are three things Rich believes the FTC could do right now in relation to consumer data protection and privacy.
Establish a new bureau of data protection
Rich cites the worsening global data privacy crisis with its flourishing data surveillance and data economy, frequent significant data breaches and widespread data abuse, and growing issues of anti-trust as reasons for the FTC to create a new bureau of data protection. She envisions the new bureau staffed with people from both the existing FTC Bureau of Consumer Protection (BCP) and Bureau of Competition (BC), and unified in a focus on data protection.
Rich says, “The new bureau would be responsible for privacy and security enforcement and related policy initiatives. It also would handle issues at the intersection of competition and privacy, such as mergers involving large amounts of consumer data, or practices like blocking “third party” cookies that appear to place privacy and competition in conflict. Significantly, the new bureau would not just protect “privacy,” but would also address broader data protection concerns, including anticompetitive data practices and the use of data for fraud, racial profiling, and discrimination. While increased legal authority and resources (including more technologists) will be needed to fully realize the potential of the new bureau, there are good reasons to create this bureau now.”
Issue a commission policy statement on consumer harm
Rich would like to see clarity around what constitutes consumer harm for purposes of FTC law enforcement and policy. She points to the FTC’s “most definitive discussion of the issue”, the Unfairness Policy Statement, written in 1980, and argues it no longer serves the modern Internet and the data-driven digital age.
“The FTC’s unfairness statement has proved to be surprisingly durable, but its discussion of consumer harm is woefully outdated. Notably, it focuses mostly on economic harm and doesn’t discuss the many other forms of injury enabled by modern technology, particularly in the area of privacy and data security … A new policy statement on consumer harm would update old thinking, educate the public, and lay the foundation for stronger FTC enforcement and policy efforts,” Rich says.
Convene a public workshop on privacy “third rails”
We agree with Rich when she says, “Without a strong federal privacy law, the FTC will continue to be hampered in its efforts to protect the privacy of American consumers.”
She refers to the FTC’s repeated assertions that “the laws it now enforces contain many gaps in protection and does not allow the FTC to seek civil penalties for violations in most instances.”
Rich says Congress has debated whether to pass a national privacy law for two decades “but keeps getting stuck on the same issues—in particular, whether the federal law should preempt state privacy laws and whether to authorize private rights of action. Many stakeholders view these issues in “yes” or “no” terms, and have not sufficiently explored potential middle grounds.”
Rich points to an earlier article on the Brookings Institution site which discusses a June 2020 report that exploresthese “middle grounds” — to “unfreeze the privacy debate” between Democrats and Republicans.
Rich proposes the FTC host a public workshop to find potential solutions to issues of preemption and private rights of action.
You can read the full article here.