The Federal Trade Commission (FTC), on a split party vote on August 11, approved an Advanced Notice of Proposed Rulemaking (the Notice) that focuses on potential new rules and requirements that could apply to entities engaged in targeted advertising or other forms of personal information gathering and sharing. Once this Notice is published in the Federal Register, the public will have 60 days to comment on the merits of the proposed new rules. There is also a public forum on the Notice slated to take place on September 8. The FTC’s action comes on the heels of legislative attempts to codify federal privacy protections that have yet to come to fruition.
In a public statement, FTC Chairwoman Lina Khan asserted that the “growing digitization of our economy – coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used – means that potentially unlawful practices may be prevalent. Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like.”
Both Republican Commissioners dissented to the adoption of the Notice, suggesting that the agency would be better served to await the outcome of potential federal legislation than to begin its own complex and lengthy quasi-legislative process. Moreover, on the substance of the Notice itself, Commissioners Wilson and Phillips suggested that its discussion on several topics strayed beyond the scope of enforcement the FTC has taken to date with data brokers and other collectors of personal information and that scope of the Notice itself is so broad as to provide little actual notice of what specific conduct would be regulated or permitted under new rules.
Entities that use data brokers for actionable information, those who use collected information for automated commercial decision making and consumer groups are all likely to be active participants in the FTC’s advanced rulemaking. While it remains to be seen whether the FTC will adopt rules, its activity in this area underscores the perceived need for federal standards enunciating privacy protections for personal information either by means of legislation or via FTC regulation.
