FTC sets the wheels in motion for a major data privacy ruling – TechCrunch

The Federal Trade Commission is warming up for a major ruling on data privacy and digital surveillance, a domain it has long enforced case by case but which has reached a stage of crisis it believes must be addressed more comprehensively. The announcement today is only the very earliest step in what could be a multiyear process, but better now than never, which until recently seems to have been the preferred timeline.

Today’s announcement is an “Advanced Notice of Proposed Rulemaking,” essentially the agency saying “we’re thinking about this seriously and are soliciting public input on the idea.” No actual rules are proposed; instead, there is an extensive list of questions that the agency hopes to answer in the process of writing the rules, and everyone from ordinary consumers to advocacy organizations like the EFF and ACLU are encouraged to weigh in.

Some questions may be more suited to legal experts (like what statute or mechanism to use in enforcement) while others need more anecdotal or grassroots-level responses, like whether children and teenagers are susceptible to and/or being targeted by certain manipulative data practices.

You can read the full list of questions here, any one of which is a veritable can of worms waiting to be opened up — part of the reason these rulemakings tend to take a long time.

One thing that doesn’t seem to be in question is the need for strong new rules. Chair Lina Khan summarizes the threat concisely (and with liberal use of em dashes — the mark of a refined mind) in her accompanying statement:

The data practices of today’s surveillance economy can create and exacerbate deep asymmetries of information — exacerbating, in turn, imbalances of power. And the expanding contexts in which users’ personal data is used — from health care and housing to employment and education — mean that what’s at stake with unlawful collection, use, retention, or disclosure is not just one’s subjective preference for privacy, but one’s access to opportunities in our economy and society, as well as core civil liberties and civil rights.

While the FTC already has authority to investigate and pursue companies and practices that break its more general rules, it must do so on a case-by-case basis, an approach that has borne some fruit but clearly has not dissuaded bolder actors from taking advantage of what must be considered a fairly lax regulatory environment.

But it is Commissioner Slaughter, who has pursued this idea for years now, who offers the most substantive justification for what the agency is attempting. The two Republican Commissioners both object to even beginning this proposed rulemaking process for the reason that they would prefer Congress pass a federal privacy rule (indeed it is considering yet another right now), and that the proposal is too broad.

“What we really need is strong federal privacy laws” has been the constant refrain of the status quo for years now whenever they oppose privacy laws at a smaller scope that might actually get passed, like the California Consumer Privacy Act. Yet even the most generous interpretation of this tactic, that they are letting the perfect be the enemy of the good, leads to a worse outcome for ordinary people. And a cynical interpretation of their motives (probably closer to the truth) suggests that, like broadband providers pushing back against net neutrality, their idealism is a facade for their self-interest.

Slaughter cuts right through this tangle of objections:

For years, Congress has nibbled around the edges of comprehensive federal privacy legislation; it is now engaged in the advanced stages of consideration of such legislation.

I not only welcome it — I prefer Congressional action to strengthen our authority. But I know from personal experience that the road for a bill to become a law is not a straight or easy one. In the absence of that legislation, and while Congress deliberates, we cannot sit idly by or press pause indefinitely on doing our jobs to the best of our ability.

The best time to initiate this lengthy process was years ago, but the second-best time is now. Effective nationwide rules governing the collection and use of data are long overdue. As the nation’s principal consumer-protection agency, we have a responsibility to act.

It seems from the context that the decisive and progressive leadership of Khan has provided an opportunity for Slaughter to pursue a years-long ambition to get started on these rules. And for those who say the FTC is biting off more than it can chew in attempting to regulate such a large, diverse, and fast-moving industry, she says this:

“Bigness,” if anything, should compel extra scrutiny of business practices on our part, not a free pass, kid gloves, or a punt to Congress.

The rules being mulled by the FTC may well end up being complementary or even superfluous to federal law, but that is only if by some miracle Congress can pass another major piece of legislation. But if this ends up being the case, consumers will simply be twice as safe.

What happens next is a lot of waiting and submitting of documents; the FTC put together a FAQ on the rulemaking process here, and on September 8 the agency will host a virtual public forum to discuss the proposal.