On June 23, Commissioner Christine Wilson, a Republican appointee, confirmed that she has agreed to use the Federal Trade Commission’s (FTC) rulemaking authority to craft comprehensive data privacy regulations. With Commissioner Wilson’s agreement, there is an even stronger chance that the FTC will engage in privacy-related rulemaking, especially since recently appointed FTC Chair Lina Khan has been a vocal supporter of more FTC rulemaking, as we reported here.

Over the last several years, both Republican and Democratic FTC commissioners have urged Congress to pass comprehensive federal privacy legislation. But that has not happened. Instead, states have taken the lead, with California and Virginia enacting comprehensive privacy legislation and with Colorado, as we reported here, now poised to become the third state to enact a comprehensive privacy law.

In the absence of congressional action and in light of a growing patchwork of state privacy laws, Commission Wilson has reluctantly agreed to support FTC rulemaking. In voicing her support, she noted that privacy-related rulemaking was not her “first or second choice” or “even the third best option for how this should be handled.” But “in the absence of Congressional action,” she noted, she has “reluctantly come to consider whether we should begin a privacy rulemaking proceeding at the Federal Trade Commission.”

Commissioner Wilson noted that her prior opposition to privacy-related rulemaking was a product of her concern that rulemaking tends to “stifle innovation and competition,” and reflected her belief that Congress is in the best position to craft a federal privacy framework. But she noted that the growing patchwork of state privacy laws is also problematic, as it increases complexity and related compliance costs for affected industries.

Our Take. The FTC will likely engage in significantly more rulemaking under newly appointed Chair Lina Khan. Privacy-related rulemaking at the federal level would not bar additional states from enacting privacy laws, nor would it address the key issues that have divided Congress, like whether a federal privacy regime should include a private right of action or preempt state privacy laws. But it could discourage additional states from enacting privacy laws, and that would be a true gain for privacy professionals and companies struggling to comply with the growing number of state privacy laws.