On September 13, the Federal Trade Commission (FTC) released a report to Congress that highlights the agency’s recent efforts to protect Americans’ privacy, announces the agency’s priorities for future data security and privacy protection efforts, and urges Congress to allocate more resources to the agency so it can expand its data security and privacy protection efforts.

As explained in the report, the FTC intends to focus its data security and privacy protection efforts via four key initiatives:

• Integrating Competition Concerns. The FTC will focus its enforcement and rulemaking activities on the relationship of digital market dominance to consumer protection violations. The FTC’s report argues that “many of the largest players in digital markets are as powerful as they are because of the breadth of their access to and control over user data.” And it suggests that “violations of consumer protection laws may be enabled by market power, and consumer protection violations, in turn, can have a detrimental impact on competition.” Moreover, the FTC believes it has a “structural advantage” in comparison to other federal and state agencies because, unlike those agencies, it focuses on both competition and consumer protection issues. And, accordingly, the FTC intends to look “with both privacy and competition lenses at problems that arise in digital markets” and will, in some consumer protection cases, seek to impose “competition-based remedies.”

• Advancing Remedies. The FTC will focus on crafting strong remedies that protect consumers and deter harmful data security and privacy practices. To protect consumers, it will require companies to disclose data breaches and data misuse. It will also negotiate redress funds for consumers harmed by data breaches and, where necessary, partner with other agencies in order to obtain redress for consumers. Additionally, the FTC will expand nonmonetary relief for affected consumers, for example, by requiring companies to provide identity verification services. As for deterrence, the FTC intends to penalize companies in violation by depriving them of the tools that caused the harm, such as requiring deletion of an algorithm. Per the report, the FTC will implement these remedies through orders issued in enforcement actions.

• Focusing on Digital Platforms. The FTC will keep a close eye on the data practices of market-dominant digital platforms by focusing on order enforcement and conducting additional compliance reviews. Indeed, the FTC’s report notes that the agency “will shift resources to order compliance and enforcement especially against the largest respondents.”

• Expanding Understanding of Algorithms. The FTC will develop greater understanding of algorithms and the consumer protection and competitive risks they may pose. The FTC will also provide more in-depth guidance for businesses on using algorithms and artificial intelligence fairly and equitably. In particular, the FTC would like to understand the ways that algorithms may create racial bias and prevent such uses of algorithms. It will also act to encourage companies to comply with its previously issued recommendation that they “test their algorithms, both at the outset and periodically thereafter, to make sure it doesn’t create a disparate impact on a protected class.”

The FTC’s report also urges Congress to enact comprehensive data privacy and security legislation, to bolster the FTC’s ability to enforce existing data security and privacy laws by clarifying and expanding the scope of the agency’s existing authority, and to provide the FTC with resources to hire at least 100 new employees to focus on protecting Americans’ privacy.

Our Take. The FTC has an ambitious data security and privacy agenda. As we have previously reported, we expect aggressive enforcement and rulemaking efforts (see prior article, prior article), and expect Alvaro Bedoya, a privacy advocate who was recently nominated to serve as an FTC commissioner, to take the lead on many of those efforts (see prior article). And given Chair Lina Khan’s vocal support of increased FTC regulation of Big Tech (see prior article), privacy-related rulemaking will likely be a priority for the agency moving forward, as will a concerted push for the resources needed to support the agency’s expansive agenda (see prior article).