Last Friday—on March 25, 2021—Acting FTC Chairwoman Rebecca Kelly Slaughter announced the creation of a new rulemaking group within the FTC’s Office of the General Counsel. With this group, the FTC is poised to create new rules as well as strengthen existing ones across its vast consumer protection and competition portfolio. This is significant because it signals that the FTC is ready to strengthen its enforcement reach and may start the rulemaking process for a comprehensive privacy rule that is not sector specific, and that could stretch beyond what we typically think of as “privacy” in order to reach related competitive harms caused by companies’ data practices.
For the past several years, FTC commissioners have vocally supported federal privacy legislation and, in its absence, have been asking Congress for civil penalty authority, something they generally do not have for first time violations of Section 5 of the FTC Act. Congressional inaction in both of these areas has resulted in the FTC actively looking for ways to maximize its enforcement reach through the strategic deployment of existing remedies and tools. To that end, the FTC has recently gotten creative with its remedies, requiring companies to delete allegedly ill-gotten data (Everalbum) and provide notice to consumers (Flo Health). It has also used its Section 6(b) authority to examine the data practices of social media and video streaming services and the privacy practices of broadband provides, and two of the commissioners have suggested stretching existing trade regulation rules—specifically the Health Breach Notification Rule—to activities where their application is not immediately obvious.
Given the continued uncertainty around whether and when we might see congressional agreement on a federal privacy bill, the creation of this new group is likely the FTC’s first step towards moving forward with privacy rulemaking under the FTC’s Section 18 authority. This authority, which is also referred to as Magnuson-Moss rulemaking, establishes the process for FTC rulemaking undertaken without direct congressional authorization. However, it is rarely used because it is more burdensome than Administrative Procedure Act notice and comment rulemaking.
This new rulemaking group is also a reaction to AMG Capital Mgmt., LLC v. FTC, a case before the Supreme Court in which the court is deciding whether or not the FTC can properly seek monetary relief under Section 13(b) of the FTC Act. Section 13(b) allows the FTC to seek an injunction to prevent unfair or deceptive acts affecting commerce, and the FTC has long relied on this authority to provide monetary redress to consumers in consumer protection cases.
The creation of this new rulemaking group should not be a surprise to anyone who has been paying attention to the commissioners’ recent focus on improving the effectiveness of the FTC’s existing remedies and using all the tools at its disposal to pursue perceived instances of consumer harm. The FTC also likely sees little downside to beginning the rulemaking process for a comprehensive privacy rule at this time. Congress does not appear close to federal privacy legislation and many states are have moved ahead with their own laws or are posed to do so. Either this is a move that, in combination with activity in the states, could galvanize Congress to finally act, or it will move the FTC closer to obtaining the clear enforcement authority that it has been seeking in the privacy space.
