Federal Privacy and Data Security Regulation on the Horizon: The FTC Announces Proposed Rulemaking

The Federal Trade Commission ("FTC") announced on August 11, 2022, that it is seeking comments on whether to issue regulation to address "commercial surveillance and lax data security." The FTC defined commercial surveillance as "the business of collecting, analyzing, and profiting from information about people." According to the announcement, this surveillance heightens "the risks and stakes of data breaches, deception, manipulation, and other abuses." By filing its Advanced Notice of Proposed Rulemaking ("ANPR"), the agency opens a comment period designed to develop a public record to inform whether the Commission should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like. 

Given that the FTC's ability to deter conduct is limited because the agency generally lacks authority to seek monetary remedies for initial violations of the FTC Act, the Commission acknowledged that enforcement of the FTC Act alone, in its view, may not be enough to protect consumers. As a result, the Commission views promulgation of rules that establish privacy and data security requirements as arguably providing the FTC the authority to seek financial penalties for first-time violations and thereby driving compliance. 

The ANPR provides no notice of the scope or parameters of what rules might follow. Instead, it poses 95 questions and various topics intended to be addressed in the course of the rulemaking review. The focus of the questions range from data security to the impact of vast data collection on children, and artificial intelligence.

Rulemaking, if commenced, will certainly take time and may be challenged in court. 

While the FTC solicits comments regarding potential rulemaking, Congress has been considering the proposed American Data Privacy and Protection Act. FTC Chair Lina Khan noted that if Congress passes a federal privacy law, the Commission would "reassess the value-add of this work and whether it remains a sound use of resources." 

The deadline for submitting comments will be 60 days after the notice is published in the Federal Register in the coming days. The agency will also hold a virtual public forum on September 8, 2022. More information on how to join the public forum can be found on the FTC website.