Ex-FTC Officials Urge Congress to Pass Privacy Law, Avoid Agency Rule

The agency announced plans to advance a privacy rulemaking in its spring 2022 regulatory agenda (see 2206220053), a development expected with the addition of Commissioner Alvaro Bedoya (see 2204180049). Former officials told us Congress provides the best path forward because the agency won’t reach bipartisan compromise on comprehensive protection for the entire economy.

“It is telling to me that Congress can’t come up with something that will pass, and I’m not sure why the FTC should be comfortable that they can enact a rule that properly takes account of the different interests,” said former FTC Office of Policy Planning Director Bilal Sayyed, now senior adjunct fellow at TechFreedom. “It’s not usually good when the FTC steps outside of its clear authority. It becomes somewhat like a legislative body. Even if it were their role, I don’t think they’d do it very well. So they should be careful.”

“I really favor doing the congressional approach,” said ex-FTC acting Chairman Maureen Ohlhausen, now co-chair of the 21st Century Privacy Coalition. “Particularly if Congress passes the law, the FTC will have enough on its hands, and Congress will have spoken very clearly about what the parameters are.” The agency has done well establishing privacy precedent through case-by-case enforcement, but the House Commerce Committee’s bipartisan bill (see 2206230064) has a lot of “positive obligations” for tech companies, she said.

“It’s not tenable to have different states adopting different privacy laws,” said Crowell & Moring's Andrew Gavil. “California got out there, but we need some kind of standardized privacy rule. The FTC, unlike Congress, doesn’t have the authority to preempt the states.” Given Bedoya’s background, it’s likely the agency’s privacy rulemaking would focus on several issues, including discrimination, he said, calling it privacy “with a twist.” It could benefit the agency because the FTC won’t have to rely on consent decrees case by case, he added: “If you succeed, at least you have a set of practices that apply across” different sectors.

Rulemaking authority is “well-established” within the agency’s statutory language for consumer protection, said former FTC General Counsel Alden Abbott, now a researcher at George Mason University. “Not saying whether it’s good or bad” if the FTC pursues a rule, “or whether it will be well done,” but “legally I think they’re on much stronger ground” than pursuing competition rules, he said. Chair Lina Khan expressed interest in pursuing both. An FTC privacy rulemaking might spur Congress to act because members don’t want to leave such major policy decisions to the agency, said Brookings Institution tech fellow Mark MacCarthy in a recent blog.

Common Sense Media supports the bipartisan House privacy bill as a vehicle for advancing the discussion, said Policy Counsel Irene Ly: But aspects of the bill, particularly protections for children, need to be strengthened. “A lot more of us would get on board if certain things could be tightened up a little bit,” she said. “So I wouldn’t say we only support it as a means to keep talking about privacy. We do want this to happen. We just want it to be strengthened before we see it passed.”

Privacy observers have differing views on the strength of the House bill. The American Data Privacy and Protection Act (ADPPA) (HR-8152) is more in line with the EU’s general data protection regulation than with the privacy law in Virginia, said Consumer Federation of America Senior Fellow Susan Grant. Some view Virginia’s law as business-friendly. Virginia Citizens Consumer Council President Irene Leech said the ADPPA is closer to the law in California than in Virginia: “It's going to be interesting to see how this plays out. I know the industry wants the weakest law possible.”