September 30, 2022

Volume XII, Number 273

Advertisement

September 29, 2022

Subscribe to Latest Legal News and Analysis

September 28, 2022

Subscribe to Latest Legal News and Analysis

September 27, 2022

Subscribe to Latest Legal News and Analysis

The FTC Seeks Public Comments Following Introduction of Federal Privacy Bill

Data privacy and security are again taking center stage in Washington, DC. On the heels of Congress’s introduction of the American Data Privacy and Protection Act (ADPPA), the Federal Trade Commission (FTC) announced on August 11, 2022, that it was seeking public comments on 95 questions in an Advance Notice on Proposed Rulemaking for a Trade Regulation Rule on Commercial Surveillance and Data Security (ANPR). While members of the FTC have supported the ADPPA, they continue to express an interest in rulemaking that ultimately complements any legislation that may pass.

For the FTC, any final rule would be promulgated under its power to regulate unfair and deceptive trade practices. Public comments provided in response to this ANPR will help direct the FTC as to which topics, if any, warrant inclusion in a final rule. While this ANPR does not bind the FTC to include certain topics in a final rule or even bind the FTC to finalize any rule at all, it seems likely that the FTC will try to finalize some privacy regulations before the end of the Biden administration. In fact, one of the primary drivers for regulating privacy appears to be the FTC’s desire to be able to penalize first-time offenders without first providing a warning as would be required following a Section 5 investigation.

IN DEPTH

HIGHLIGHTING FTC PRIORITIES

The ANPR provides valuable insight into what members of the FTC ultimately hope to include in a final rule and indicates that the FTC may be interested in addressing a wide array of activities, practices and potential enforcement authority. Specifically, input has been requested related to “data security” and “commercial surveillance.” “Data Security” includes breach risk mitigation, data management and retention, data minimization, and breach notification and disclosure practices. “Commercial surveillance” includes the collection, aggregation, analysis, retention, transfer or monetization of consumer data and direct derivatives of that information, including information actively provided by and passively collected from consumers.

The FTC’s 95 questions invite discussion on a range of topics—from the effectiveness of current privacy and data security requirements and balancing the costs and benefits of regulation, to the harm to children and teenagers that potential commentators believe results from current business practices. Several strategies appear under consideration to address these practices. This ANPR requests input on data minimization; stronger consumer consent; and principles of notice, transparency and disclosure. Perhaps one of the more interesting aspects of the ANPR is the FTC’s floating of a trial balloon to enlist non-FTC, private entity assistance to administer and enforce any new regulations. Where standards for data practices, commercial surveillance and automated decision-making are considered, the FTC also requests input on whether the FTC or a third-party entity would be better suited for certifying compliance.

KEY TAKEAWAYS

Through the series of questions and an introduction setting the stage for this rulemaking, one key theme emerges: Despite questions regarding its authority to regulate in the manner it proposes and resource restraints potentially hindering the FTC’s enforcement activities, the FTC wants to establish clear requirements or benchmarks to incentivize companies to invest in compliance and privacy-protective measures. Here are the things we are keeping a close eye on as this rulemaking continues:

  • The FTC’s definitions of “data security” and “surveillance” are very broad, encompassing practices that are outside of the traditional understanding of those phrases. This could mean that the FTC’s rules could dictate appropriate practices for a company’s entire privacy program.

  • These questions provide the opportunity for companies and other stakeholders to comment on how they use information and how an FTC rule could impact their operations.

  • The FTC is considering the impact of existing laws, like the Children’s Online Privacy and Protection Act and the Gramm-Leach-Bliley Act, and the forthcoming regime of state privacy laws taking effect in 2023. These are smart and important questions, as the FTC’s rules should not be adopted in a vacuum lest they serve little more than to complicate an already challenging and growing mosaic of privacy laws applicable to companies in the United States.

The ANPR will soon be published in the Federal Register; stakeholders will then have 60 days to submit their comments. The FTC is also hosting a virtual public forum for the issues raised in its ANPR on September 8, 2022. The plans for and, ultimately, contents of a potential final rule remain a mystery for now, but this ANPR invites all stakeholders to weigh in and provide valuable insights for the FTC in shaping this rule.

© 2022 McDermott Will & EmeryNational Law Review, Volume XII, Number 230
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

David Sorenson Associate McDermott Will & Emery
Associate

David Sorenson focuses his practice on global privacy & cybersecurity matters.

During law school, David served as an editor of the Southern California Interdisciplinary Law Journal. He was also executive director of the People’s Tax Page, a tax policy nonprofit.

310-788-6091
Amy C. Pimentel, Global Privacy Staff Attorney, McDermott Will & Emery Law Firm
Associate

Amy Pimentel is an associate in the law firm of McDermott Will & Emery LLP and is based in the Firm’s Boston office.  Amy is a member of the Firm’s Global Privacy and Data Protection Affinity Group.  She focuses her practice on consumer protection, privacy, information security and international law.

Amy received her J.D. in 2014 from Northeastern University School of Law.  While in law school, Amy worked at the U.S. Department of Justice in the Office of International Affairs and interned for a judge at the International Criminal Tribunal...

617-535-3948
Advertisement
Advertisement
Advertisement