FTC explores rules cracking down on commercial surveillance and lax security
&gt;The Commission voted 3-2 to publish the notice in the Federal Register. Chair Khan, Commissioner Rebecca Kelly Slaughter and Commissioner Alvaro Bedoya issued separate statements. Commissioners Noah Joshua Phillips and Christine S. Wilson voted no and issued dissenting statements.<p>That is a very interesting spread.<p>Statements from each (notable excerpts)<p>Chair Linda M Kahn. <a href="https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Statement of Chair Lina M. Khan on Commercial Surveillance ANPR 08112022.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Statement of%...</a><p>&gt;The data practices of today’s surveillance economy can create and exacerbate deep
asymmetries of information—exacerbating, in turn, imbalances of power. And the expanding
contexts in which users’ personal data is used—from health care and housing to employment and
education—mean that what’s at stake with unlawful collection, use, retention, or disclosure is not
just one’s subjective preference for privacy, but one’s access to opportunities in our economy
and society, as well as core civil liberties and civil rights.
The fact that current data practices can have such consequential effects heightens both the
importance of wielding the full set of tools that Congress has given us, as well as the
responsibility we have to do so. In particular, Section 18 of the FTC Act grants us clear authority to issue rules that identify specific business practices that are unlawful by virtue of being
“unfair” or “deceptive.”10 Doing so could provide firms with greater clarity about the scope of
their legal obligations. It could also strengthen our ability to deter lawbreaking, given that firsttime violators of duly promulgated trade regulation rules—unlike most first-time violators of the
FTC Act11—are subject to civil penalties. This would also help dispense with competitive
advantages enjoyed by firms that break the law: all companies would be on the hook for civil
penalties for law violations, not just those that are repeat offenders.
Today’s action marks the beginning of the rulemaking proceeding. In issuing an Advance
Notice of Proposed Rulemaking (ANPR), the Commission is seeking comments from the public
on the extent and effects of various commercial surveillance and data security practices, as well
as on various approaches to crafting rules to govern these practices and the attendant tradeoffs.
Our goal at this stage is to begin building a rich public record to inform whether rulemaking is
worthwhile and the form that potential proposed rules should take. Robust public engagement
will be critical—particularly for documenting specific harmful business practices and their
prevalence, the magnitude and extent of the resulting consumer harm, the efficacy or
shortcomings of rules pursued in other jurisdictions, and how to assess which areas are or are not
fruitful for FTC rulemaking. ... At minimum, the record we will build through issuing this ANPR and seeking public
comment can serve as a resource to policymakers across the board as legislative efforts continue.  ... [categories include (Procedural protections, Administrability, Business models and incentives, Discrimination based on protected categories, Workplace surveillance)]<p>Rebecca Kelly Slaughter <a href="https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;RKS ANPR Statement 08112022.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;RKS ANPR St...</a><p>&gt;Conclusion
The path the Commission is heading down by opening this rulemaking process is not an
easy one. But it is a necessary one. The worst outcome, as I said three years ago, is not that we
get started and then Congress passes a law; it is that we never get started and Congress never
passes a law. People have made it clear that they find this status quo unacceptable.46 Consumers
and businesses alike deserve to know, with real clarity, how our Section 5 authority applies in the
data economy. Using the tools we have available benefits the whole of the Commission’s
mission; well-supported rules could facilitate competition, improve respect for and compliance
with the law, and relieve our enforcement burdens.
I have an open mind about this process and no certainty about where our inquiry will lead
or what rules the record will support, as I believe is my obligation. But I do know that it is past
time for us to begin asking these questions and to follow the facts and evidence where they lead
us. I expect that the Commission will take this opportunity to think deeply about people’s
experiences in this market and about how to ensure that the benefits of progress are not built on
an exploitative foundation. Clear rules have the potential for making the data economy more fair
and more equitable for consumers, workers, businesses, and potential competitors alike.
I am grateful to the Commission staff for their extensive work leading up to the issuance<p>Alvaro Bedoya <a href="https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Bedoya ANPR Statement 08112022.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Bedoya ANPR%2...</a><p>&gt;Our nation is the world’s unquestioned leader on technology. We are the world’s
unquestioned leader in the data economy. And yet we are almost alone in our lack of meaningful
protections for this infrastructure. We lack a modern data security law. We lack a baseline
consumer privacy rule. We lack civil rights protections suitable for the digital age. This is a
landscape ripe for abuse.
Now it is time to act. Today, we are beginning the hard work of considering new rules to
protect people from unfair or deceptive commercial surveillance and data security practices.
My friend Commissioner Phillips argues that this Advance Notice of Proposed
Rulemaking (“ANPR”) “recast[s] the Commission as a legislature,” and “reaches outside the
jurisdiction of the FTC.”1 I respectfully disagree. Today, we’re just asking questions, exactly as
Congress has directed us to do.2 At this most preliminary step, breadth is a feature, not a bug. We
need a diverse range of public comments to help us discern whether and how to proceed with
Notices of Proposed Rulemaking. There is much more process to come.<p>Noah Joshua Phillips. <a href="https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Commissioner Phillips Dissent to Commercial Surveillance ANPR 08112022.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Commissioner ...</a><p>&gt;Legislating comprehensive national rules for consumer data privacy and security is a
complicated undertaking. Any law our nation adopts will have vast economic significance. It will
impact many thousands of companies, millions of citizens, and billions upon billions of dollars in
commerce. It will involve real trade-offs between, for example, innovation, jobs, and economic
growth on the one hand and protection from privacy harms on the other. (It will also require
some level of social consensus about which harms the law can and should address.) Like most
regulations, comprehensive rules for data privacy and security will likely displace some amount
of competition. Reducing the ability of companies to use data about consumers, which today
facilitates the provision of free services, may result in higher prices—an effect that policymakers
would be remiss not to consider in our current inflationary environment.1<p>Christine S. Wilson <a href="https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Commissioner Wilson Dissent ANPRM FINAL 08112022.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ftc.gov&#x2F;system&#x2F;files&#x2F;ftc_gov&#x2F;pdf&#x2F;Commissioner ...</a><p>&gt;Throughout my tenure as an FTC Commissioner, I have encouraged Congress to pass
comprehensive privacy legislation.1 While I have great faith in markets to produce the best
results for consumers, Econ 101 teaches that the prerequisites of healthy competition are
sometimes absent. Markets do not operate efficiently, for example, when consumers do not have
complete and accurate information about the characteristics of the products and services they are
evaluating.
2 Neither do markets operate efficiently when the costs and benefits of a product are
not fully borne by its producer and consumers – in other words, when a product creates what
economists call externalities.3 Both of these shortcomings are on display in the areas of privacy
and data security. In the language of economists, both information asymmetries and the presence
of externalities lead to inefficient outcomes with respect to privacy and data security.