FTC Considers Privacy Regulation Amidst Congressional Inaction

Given the challenges Congress faces in finding agreement on non-controversial measures (like keeping the lights on), it’s little wonder that there’s been minimal effort to tackle controversial topics—like a federal privacy law. Some privacy watchers thought that California’s groundbreaking privacy legislation, the CCPA, would prompt federal action to preempt its more onerous requirements. And similarly comprehensive state-law privacy measures in Virginia and Colorado in the past year (with others waiting in the wings in Washington, Florida, and Oklahoma) may yet push Congress to finally act. But it has not done so yet, and the Federal Trade Commission appears tired of waiting.

Under new chair Lina Khan, the FTC is laying the groundwork for rules that “could impose significant new obligations on businesses across the economy related to how they handle consumer data,” according to the Wall Street Journal. While any rule could take years to finalize, the FTC has multiple paths forward based on its scope of authority, including declaring “certain business practices unfair or deceptive” and policing them accordingly, regulating  what it deems to be “unfair methods of competition,” more broadly enforcing the Children’s Online Privacy Protection Act (COPPA), and even using “its enforcement powers to target individual companies.” [WSJ]

Any action it takes is likely to come only after Senate confirmation of privacy advocate Alvaro Bedoya, whom the Biden administration nominated to serve on the Commission just weeks ago.  In the meantime, based on comments from some lawmakers debating proposed FTC funding increases that could enable this regulatory work, it appears that the mere prospect of a Khan-led Commission taking on privacy regulation may be enough to finally spur bipartisan action on the long-languishing federal privacy law.

The Robins Kaplan Privacy Pulse blog features privacy and cybersecurity litigation topics including the latest news in cybersecurity law and policy, privacy legislation, and other related cyber topics making headlines.