EPIC Unlikely to Prevail in Challenge to FTC Stance on Google Privacy

A federal judge in the U.S. District Court for the District of Columbia agreed earlier this month to fast-track a lawsuit by a privacy group against the Federal Trade Commission, arguing that the FTC has failed to enforce the terms of a settlement agreement it reached with Google last year after the FTC accused Google of violating privacy regulations in the launch of Google Buzz.

Last year, Google and the FTC agreed on a settlement stemming from allegations that Google violated its own privacy promises to consumers when it launched its social network, Google Buzz. That investigation began with a complaint filed by the Electronic Privacy Information Center (EPIC), the same group that is the plaintiff in this current case. EPIC is not suing Google and was not a party to the settlement reached between Google and the FTC. At the time of the settlement, the FTC said it “bars the company from future privacy misrepresentations, requires it to implement a comprehensive privacy program and calls for regular, independent privacy audits for the next 20 years.” 

We wrote earlier about Google’s new privacy policy, set to take effect on March 1, that would streamline and consolidate about 60 disparate policies of Google products and services.  As part of the new policy Google will aggregate data it collects on users across its products, with the exception of Google Wallet and Google Books, and develop a mega-profile on each user. The data collection includes a user’s Google searches, Gmail message content, contacts, YouTube favorites, and physical location.

On February 17, the FTC filed a memorandum in opposition to the EPIC suit and a motion to dismiss it. The agency asserted that EPIC has no legal ground for its attempt to compel it to enforce the settlement and that the lawsuit “seeks to deprive the Commission of the discretion to exercise its enforcement authority.”

EPIC’s reply, filed February 21, asserted that Google’s privacy policy changes violate the FTC’s consent order and that irreparable injury is “likely.” EPIC’s brief also suggested that there is precedent allowing for judicial review of agency rulings.

Earlier this month the European Union’s data protection authorities asked Google to delay the release of its new privacy policy until it has verified that it does not violate the EU’s data protection laws. Google responded to the EU request by sending a letter saying that it has no intention of delaying the March 1 implementation of its new policy changes.

Also earlier this month Rep. Mary Bono Mack (R-Calif.) and Rep. G.K. Butterfield (D-N.C.), the top ranking Republican and Democrat on the House Energy and Commerce Committee Subcommittee on Commerce, Manufacturing and Trade, which has jurisdiction over data-privacy issues, wrote to Google asking for more answers about changes to its privacy policy.

Earlier this week, more than 30 state attorneys general wrote to Google CEO Larry Page saying that the new Google policy forces consumers to allow information to be shared across several forums without the ability to opt out or choose their preferences for how their personal information is used. The letter also points out that Google has become known as a company that put a premium on the offering users choice in the use of their information, but now that information is being “held hostage.”

EPIC alleged in its complaint that Google has misrepresented its intention to use combined data for behavioral advertising. EPIC also alleges that the agreement gives the FTC the power to stop Google from making the planned privacy changes and that Google’s new policy requires the users’ consent. A key issue in the protests against the new policy had been that account holders will not be able to opt out of it.

Google has rejected the claims by EPIC, stating that the company has taken extra steps to notify users of the changes to the privacy policy. Google also maintains that it is not changing how any personal information is shared outside of Google and that it has created a stringent compliance policy.

A key issue in this case will be whether EPIC, a non-party to the agreement, can force the FTC to take action against Google. EPIC did not bring this action under the Federal Trade Commission Act, which is the source of the vast majority of FTC enforcement actions. Instead, this suit was brought under a section of the Administrative Procedures Act allowing challenges to agency action that is “unlawfully withheld.” 

There may be strong precedent against EPIC in this case. The Supreme Court stated in 1985 in Heckler v. Chaney that “an agency decision not to enforce often involves a complicated balancing of a number of factors which are peculiarly within its expertise . . . The agency is far better equipped that the courts to deal with the many variable involved in the proper ordering of its priorities.”

Although EPIC brings an interesting argument, it is not likely to prevail. However, with the ability of Google to unilaterally enforce its privacy changes against users and Congress and the FTC failing to take action to protect consumers, it becomes unclear who will stand up to protect privacy interests of consumers. We will continue to follow any new developments in this case.