Federal Privacy Rules on the Horizon? FTC Begins Rulemaking on Commercial Surveillance and Data Security Practices

On August 11, 2022, the Federal Trade Commission (“FTC”) released an “Advance Notice of Proposed Rulemaking” (the “Advance Notice”) proposing to adopt rules regulating “commercial surveillance” and “data security” practices.¹  In the Advance Notice, the FTC confirmed its intention to conduct its rulemaking process pursuant to Section 18 of the Federal Trade Commission Act, more commonly known as Magnuson-Moss (or “Mag-Moss”) rulemaking authority.  With the release of the Advance Notice, it appears that the FTC is fulfilling Chair Lina Khan’s promise that this would be “a busy summer” for the FTC with respect to regulating privacy and data security issues.²  In this client alert, we seek to answer some of the key questions raised by the FTC’s action.

What Is the FTC Proposing to Do?

The Advance Notice does not include specific rule proposals; rather, the FTC lays out a general case for why rules addressing “harmful” commercial surveillance and “lax” data security practices may be justified.³  The scope of the FTC’s Advance Notice — and therefore the scope of the potential rulemaking — is all-encompassing, potentially covering everything from consumer finance, tech, and healthcare to retail, real estate, and education, and expressly includes relationships — like the employer/employee relationship — that have been carved out of many recently enacted comprehensive state privacy laws.  In the Advance Notice, the FTC observes that Americans “surrender their personal information to engage in the most basic aspects of human life” and that companies have developed products and services “to collect and monetize this data.”⁴  The FTC explains that its privacy authority has been developed on a “case-by-case” basis and through general rulemaking under sector-specific statutes, and that these enforcement actions and rulemaking initiatives have raised important questions about commercial surveillance and data security practices across a broad swath of companies and industries, specifically mentioning insurance, consumer finance, and healthcare as important industries in which commercial surveillance and the use of algorithmic decision-making is prevalent and/or where threats to data security are growing.

The Advance Notice then asks about twenty pages of questions seeking public comment on a variety of issues raised by the stated concerns regarding commercial surveillance and data security practices.  These questions include how companies currently surveil consumers; whether and how data minimization and other privacy restrictions hamper algorithmic decision-making and learning; how prevalent algorithmic discrimination is and how such discrimination may affect consumers; and what data security measures companies should implement to protect against risks to the security, confidentiality, or integrity of personal data.

What Is “Mag-Moss” Rulemaking Authority and Why Does It Matter?

Much of the tone and substance of the Advance Notice is driven by the requirements of the Mag-Moss rulemaking procedures.  Unlike other independent agencies, the FTC’s rulemaking authority is limited.  For example, it may conduct specific rulemaking proceedings as directed by federal laws, and such proceedings would be conducted pursuant to the Administrative Procedures Act.  Mag-Moss rulemaking authority gives the FTC some ability to adopt rule outside the context of specific statutory authority, but imposes a higher burden and requires completion of more cumbersome administrative steps, such as an Advance Notice of Proposed Rulemaking, which historically has significantly drawn out rulemakings conducted by the Mag-Moss process.  However, in 2021, Chair Khan led a successful effort to change the FTC’s internal rules to streamline the administrative process for Mag-Moss rulemaking proceedings.⁵  Even under the revised internal rules, however, Mag-Moss rulemaking proceedings remain a difficult and complicated process, and the breadth of the questions asked in the Advance Notice highlights the burden that the FTC faces as it seeks to move forward with rulemaking proceedings concerning issues as complex and controversial as commercial surveillance and data security.

What Did the Other Commissioners Say?

The Advance Notice was adopted on a party-line vote, with each of the five FTC Commissioners releasing a detailed statement outlining their reasons for supporting or opposing the Advance Notice.  The three Democratic members of the Commission — Chair Khan,⁶ Commissioner Alvaro Bedoya,⁷ and Commissioner Rebecca Slaughter⁸ — supported the Advance Notice, while the Republican members — Commissioner Noah Phillips⁹ and Commissioner Christine Wilson¹⁰ — did not.  Of note, both Commissioner Phillips and Commissioner Slaughter provided highly detailed analyses of the pros (Slaughter) and cons (Phillips) of the FTC moving forward with the rulemaking. 

What about Congress and Any Legislative Solutions?

Each Commissioner referenced the potential enactment of a federal privacy law, such as the proposed American Data Privacy Protection Act (“ADPPA”).  The three Democratic Commissioners explained that they hoped the FTC’s action would spur those legislative efforts — with Chair Kahn explicitly noting that enactment of the ADPPA would likely preclude the need for the rulemaking proceeding, and Commissioner Bedoya urging Congress to enact the ADPPA.  On the other side, the two Republican Commissioners argued that the FTC’s rulemaking proceeding is unnecessary, and potentially unlawful, in light of those efforts.  In particular, Commissioner Wilson articulated her concern that the FTC’s rulemaking proceeding may be used “as an excuse to derail the ADPPA.”¹¹  Representative Frank Pallone, Chairman of the House Commerce Committee, issued a statement appreciating the FTC’s action to protect consumers, but Representative Pallone noted that “Congress has a responsibility to pass comprehensive federal privacy legislation.”¹²  Meanwhile, the Ranking Member of the House Commerce Committee, Representative Cathy McMorris Rodgers, released a statement that “the American Data Privacy and Protection Act continues to be the best path forward,” suggesting that she does not support the FTC’s rulemaking proceeding.¹³

What’s Next?

Because the FTC is proceeding under Mag-Moss authority, it must complete several administrative steps.  First, the FTC must undertake a series of public forums designed to ensure broad public participation in the proceeding.  The first such effort will be a virtual public forum on September 8, 2022 to solicit public comment on the topics noted in the Advance Notice and any future rulemaking proceedings conducted by the FTC.  Second, it must ensure that the record includes detailed comments in response to questions designed to address just how prevalent the identified problem is and whether existing regulatory solutions are sufficient to address it.  To that end, the FTC is soliciting written public comments on the Advance Notice — these will be due 60 days after the Advance Notice is published in the Federal Register.  Before the FTC can move forward to a final rule, it must develop, adopt, and release a Notice of Proposed Rulemaking with specific proposed rules, with another public comment period, public forums, and other input from the public and very likely Congress.

This is just the first step in what is potentially a long and winding road to any final rules.  And even if the FTC manages to adopt a set of final rules in this proceeding, it remains to be seen whether such rules could withstand judicial scrutiny, especially in light of the anti-regulatory stance taken by the Supreme Court in recent cases, like West Virginia v. EPA.¹⁴  For now, however, the Advance Notice is so broad and covers so many issues that companies across the economy will need to prepare for a complicated rulemaking proceeding that may produce regulations with broad, significant and lasting effects on companies’ data collection, surveillance and data security practices.