Cheat Sheet: New rules and funding for FTC could be on the way

“We urge the Commission to undertake a rulemaking process with the goal of protecting consumer data,” wrote several Democrats in the U.S. Senate in a letter sent this week to Khan. In conjuring new rules, they wrote, the FTC “should consider strong protections for the data of members of marginalized communities, prohibitions on certain practices (such as the exploitative targeting of children and teens), opt-in consent rules on use of personal data, and global opt-out standards.” Additional rules, they said, would complement potential federal privacy legislation. However, there are few signs that any proposed nationwide privacy law has enough momentum to pass this year.

Groundwork for new rules: laid!

Even before Khan took the helm, the FTC began laying groundwork toward easing the rulemaking process. FTC commissioner Rebecca Slaughter established a rulemaking group within the FTC’s Office of the General Counsel in March while she was serving as acting chair of the commission. The goal was to enable the commission to “strengthen existing rules and to undertake new rulemakings to prohibit unfair or deceptive practices and unfair methods of competition.”

In July, the agency took another step, easing procedures for how it initiates rulemaking and altering its process for how members of the public participate in making rules. Slaughter wrote at the time that the change would give more clear guidance to help “honest businesses comply” and would enable the agency “to issue timely rules on issues ranging from data abuses to dark patterns to other unfair and deceptive practices widespread in our economy.”

Existing rules: enforcement coming?

The FTC made yet another move during its most recent open meeting Sept. 15 when it clarified its intent to enforce a rule it has yet to apply in any decision: the Health Breach Notification Rule. When applied, that rule requires companies to notify people affected by a breach of health-related data, such as data gathered by fitness trackers, period-tracking apps or other apps used to monitor health. Violating the Health Breach Notification Rule could pack a punch — resulting in fines of more than $43,000 for each violation per day.

There remains some dispute over just what types of health data the rule should apply to — and that may have been a reason why the agency did not apply it in its recent settlement with Flo Health, maker of the period tracker, Flo. “Flo was improperly sharing extremely sensitive data with Facebook, Google and others, but rather than sending a clear message, that the text of the Health Breach Notification Rule covers this activity, we demonstrated again that we would be unwilling to enforce this law as written,” said FTC Commissioner Rohit Chopra during the meeting.

More FTC funding: proposed!

Congress this year has made moves to provide more funding to the FTC to build staff and resources needed to enable meaningful oversight of the rapidly-paced tech industry and its data practices. A Senate antitrust reform bill co-sponsored in February by five of the legislators who sent Khan the letter encouraging more FTC rulemaking — Sens. Richard Blumenthal of Connecticut, Cory Booker of New Jersey, Minnesota’s Amy Klobuchar, Ed Markey of Massachusetts and Hawaii’s Brian Schatz — would nearly double the FTC’s annual budget.

More recently, a proposal tacked onto President Joe Biden’s jobs and economic recovery plan, which got initial passage on September 15 by a House committee, would — if it makes its way into final legislation — allocate $1 billion to the FTC to use over a period of ten years. The cash infusion is intended to staff a new bureau addressing unfair or deceptive practices related to privacy, data security, identity theft and other data abuses. 

Meanwhile, a bipartisan House bill included in a package of antitrust legislation proposed in June would boost merger filing fees as a means of providing more funding for the federal government’s two antitrust oversight agencies, the Department of Justice and FTC. As the FTC mulls new ways of integrating data monetization considerations into its approach to assessing marketplace competition, data privacy could come into play in its antitrust deliberations.

Pushback: expect it!

But despite a general consensus among lawmakers on both sides of the aisle that the FTC does not have sufficient staff or resources to address today’s data-centric tech industry, efforts to get more funding for the agency have met with blockades. Republican lawmakers have pushed back against giving the agency, which is comprised of unelected commissioners, more power or unrestricted funding. 

Then there’s the advertising industry, which has long fought more FTC rulemaking power. When legislation proposed in 2010 could have given the FTC more rulemaking authority, the Association of National Advertisers cheered its demise and argued that the “changes would have serious implications for every ANA member.” At the time, Dan Jaffe — who still leads the organization’s government relations office — wrote, “ANA and the entire marketing community won a major victory on the day after we celebrated our 100th anniversary!” He concluded, “While our victory in the conference committee is important, it is clear that these issues will not go quietly into the night.”