FTC Contemplates Rules to Protect Against Commercial Surveillance and Lax Data Privacy

The Federal Trade Commission is looking at boosting its efforts to combat commercial surveillance and relaxed data security, in an effort to protect online consumer privacy. 

As part of this effort, the FTC seeks public comment on its Advance Notice of Proposed Rulemaking on online consumer privacy. The FTC is soliciting comments on harms from commercial surveillance and if new rules are necessary to protect people’s privacy and information. 

“Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like,” FTC Chair Lina M. Khan said.

Companies can collect information based on a person’s “online activity, their family and friend networks, browsing and purchasing histories, location and physical movements, and a wide range of other personal details.” This information is then analyzed and used to sell ads or sell products. 

Commissioner Alvaro Bedoya stated that the U.S. is a leader in technology and the data economy, “and yet we are almost alone in our lack of meaningful protections for this infrastructure. We lack a modern data security law. We lack a baseline consumer privacy rule. We lack civil rights protections suitable for the digital age. This is a landscape ripe for abuse. Now it is time to act.”

The notice comes while congress is working on several pieces of legislation to protect Americans’ data privacy, namely the American Data Privacy and Protection Act. 

“I appreciate the FTC’s effort to use the tools it has to protect consumers, but Congress has a responsibility to pass comprehensive federal privacy legislation to better equip the agency, and others, to protect consumers to the greatest extent,” House Energy and Commerce Committee Chairman Frank Pallone, Jr., D-N.J., said. “Ultimately, the American Data Privacy and Protection Act is necessary to establish comprehensive national statutory privacy protections for all Americans and I’m committed to getting it passed and signed into law.”

A few FTC commissioners speaking at a press conference expressed their hope that this legislation passes. 

“I am delighted that Congress appears to be making substantial and unprecedented progress toward a meaningful privacy law, which I am eager to see pass,” Commissioner Rebecca Kelly Slaughter said. “The Commission should not wait any longer than it already has to develop a public record that could support enforceable rules. So I am equally delighted that we are now beginning the Section 18 process by issuing this Advance Notice of Proposed Rulemaking on commercial surveillance and data security.”

“Case-by-case enforcement has not systemically deterred unlawful behavior in this market,” she added. 

The FTC seeks comments on a wide range of topics concerning commercial surveillance activities and practices, such as securing collected data, mental health and other harms, and algorithm errors and biases, among others. The Commission also noted that some corporations make it difficult to avoid commercial surveillance, such as making it a condition of service or requiring customers to pay to protect their personal information. 

The FTC added that it has used its current authority to “bring hundreds of enforcement actions against companies for privacy and data security violations.” However, at the press conference, the commissioners asserted that FTC enforcement action is not enough to protect consumers and its best tool was struck down by the Supreme Court last year.

The public will be able to comment for 60 days after the notice is published on the Federal Register and the public can also comment during a virtual public forum on September 8. 

The Commission voted 3-2 to publish the notice. Khan, Slaughter and Bedoya voted in favor and issued separate statements. Meanwhile, Commissioners Noah Joshua Phillips and Christine S. Wilson voted no and issued dissenting statements. 

“National consumer privacy laws pose consequential questions, which is why I have said, repeatedly, that Congress—not the Federal Trade Commission…—is where national privacy law should be enacted,” Commissioner Phillips said. “I am heartened to see Congress considering just such a law today, and hope this Commission process does nothing to upset that consideration.”

Corporate data collection has also had an impact on law enforcement action. Recently, Facebook gave police data from a user’s private chat about her abortion, which police used to seize her electronic devices.