FTC & Privacy: Will the FTC’s Rulemaking Push Result in New Privacy Rules?

The Federal Trade Commission (FTC) is laying the groundwork to test the scope of its rulemaking authority. On March 25, 2021, FTC Acting Chairwoman Rebecca Slaughter (D) formed a group within the agency’s Office of the General Counsel to centralize FTC rulemakings. In announcing the change, Slaughter said that it was “time for the Commission to activate its unfair methods of competition rulemaking authority” and that she is “excited for this new rulemaking group to explore all the possibilities.”[1]

In a recent speech setting out part of her vision for the new group, Slaughter stated that rulemakings are a “powerful tool” that have been “underappreciated.” She will task the group, which will be led by one of her former advisors, with updating current rules and developing new ones.[2] Slaughter promised to streamline the FTC’s rulemaking process, which she acknowledged could be lengthy and cumbersome.[3]

The Supreme Court’s recent decision in AMG Capital Management v. Federal Trade Commission,[4] which curtailed the FTC’s ability to obtain equitable monetary relief, gives Slaughter’s push for rulemakings added urgency. In her speech, Slaughter specifically noted that establishing rules allows the FTC to seek to impose civil penalties upon finding a violation, even for a first-time violator.[5] She emphasized that “rules create strong incentives to comply with the law” and that “[p]owerful deterrence makes for lawful markets that are good for consumers and businesses alike.”[6]

She also hinted that the group’s likely initial focus would include “areas where our rules of the road simply did not keep up with rapid changes in technology or markets, leaving Americans’ privacy exposed or their market choices limited while deceptive and unfair practices get algorithmically supercharged.”[7]

While many of the details remain unclear, Slaughter’s proposal could mark a dramatic shift for the development of U.S. data privacy and security law from a common law approach to a more European-style regulatory regime. Since data privacy and security have become a consumer protection focus for the FTC , most substantive developments have occurred incrementally, on a case-by-case and enforcement‑action-by-enforcement-action basis.

Any debate over direction is likely to skew towards a rules-based regime, in light of President Biden’s nomination of Lina Khan to serve as an FTC Commissioner. The Senate Commerce Committee held a hearing on her nomination in late April and is scheduled to vote on her nomination later this week. If and when Khan is confirmed, the Democrats would have a three to two majority on the FTC, with all three of the Democratic Commissioners on the record favoring rulemakings in principle. Slaughter clearly would have allies in any substantive rulemaking. (That majority may be short-lived, however, given President Biden’s nomination of Commissioner Rohit Chopra to lead the Consumer Financial Protection Bureau.)

Uncertainty Squared

The FTC’s foray into rulemaking could lead to a period of uncertainty and legal challenges in those areas touched by a new agency rule. There is likely to be significant debate over the scope of the FTC’s authority, the particulars of the rulemaking process, the substance of any proposed rules, and, when tested in court, the extent of Chevron deference to which the agency is entitled.

Opportunities to weigh in on the process and any proposed rules should abound. In her recent speech, Slaughter stated that new general data privacy rules would have to be developed under Section 18 of the Magnuson-Moss Warranty—Federal Trade Commission Improvements Act of 1975.[8] This would allow “the FTC to write new rules that prohibit or regulate any unfair or deceptive practice that is prevelant in interstate commerce,”[9] but it requires more process than participatory notice-and-comment rulemaking in accordance with the Administrative Procedure Act.[10] This process includes the right for any interested party to request and make oral presentations before an independent hearing officer.[11] Slaughter acknowledged that the FTC has shied away from this type of rulemaking in the past “because of fear about whether the process is too burdensome to result in timely and effective rules,”[12] but rejected these fears as “if not wholly mistaken, then quite overblown.”[13] Slaughter vowed to streamline the FTC process to “revive[]” the “efficient, democratic spirit of section 18’s text.”[14]

Once adopted, new rules—both substantive and procedural—could be challenged in federal court on several bases, including that the FTC failed to follow the appropriate procedures, that the new rules exceeded the authority Congress granted the FTC, or that the new rules violate some other constitutional or statutory right.

Conclusion

The FTC is taking steps that could result in substantive rulemaking activity, fundamentally changing the landscape of privacy law enforcement in the United States. Although debate around such rulemaking likely will revolve around digital platforms and tech companies, the agency’s rules could be far reaching and touch all areas of the economy.

[1] Press Release, Fed. Trade Comm’n, “FTC Acting Chairwoman Slaughter Announces New Rulemaking Group” (March 25, 2021), https://www.ftc.gov/news-events/press-releases/2021/03/ftc-acting-chairwoman-slaughter-announces-new-rulemaking-group.

[2] Rebecca Slaughter, Acting Chairwoman, Fed. Trade Comm’n, “Keynote Remarks at the Consumer Federation of America’s Virtual Consumer Assembly 1” (May 4, 2021) (Slaughter Speech), https://www.ftc.gov/system/files/documents/public_statements/1589607/keynote-remarks-acting-chairwoman-rebecca-kelly-slaughte-cfa-virtual-consumer-assembly.pdf; Press Release, Fed. Trade Comm’n, “FTC Acting Chairwoman Slaughter Announces New Appointments to Agency Leadership Positions” (May 5, 2021), https://www.ftc.gov/news-events/press-releases/2021/05/ftc-acting-chairwoman-slaughter-announces-new-appointments-agency.

[3] Slaughter Speech at 4–7.

[4] 131 S. Ct. 1341 (2021).

[5] Slaughter Speech at 2.

[6] Id.

[7] Id. at 1–2.

[8] Id. at 4.

[9] Id.

[10] Id.

[11] Id. at 6.

[12] Id. at 5.

[13] Id. at 6.

[14] Id. at 7.