The Federal Trade Commission (FTC) has been putting the squeeze on businesses since its Chair Lina Khan was sworn into office.  Her announcement on July 1, 2021, that the agency was abandoning the consumer welfare standard to educate its decisions was just the opening salvo.  She has made the agency’s activities far less transparent, and has also become adept at taking advantage of Congress’s inability to agree on bills that impact consumers. 

The latest example of agency overreach was on August 10, 2022, when Chair Khan pushed forward a proposedadvance notice of proposed rulemaking (ANPRM) on the “prevalence of commercial surveillance and data security practices that harm consumers.”  Consumer data privacy is a critical issue affecting every single business and consumer across the country, and Congress has been working on legislation to address the environment created by a multitude of state laws that have made compliance difficult and increased costs.  It is up to Congress to carefully craft a nationwide privacy framework that preempts existing state laws and does not provide trial lawyers with a field day of litigation.  A single agency, particularly this FTC under Chair Khan’s control, should not be preempting or usurping legislative action. 

In her dissenting statement on the ANPRM, FTC Commissioner Christine Wilson noted several issues that gave her pause in considering her vote.  She wrote, “First, in July 2021, the Commission made changes to the Section 18 Rules of Practice that decrease opportunities for public input and vest significant authority for the rulemaking proceedings solely with the Chair.  Second, the Commission is authorized to issue a notice of proposed rulemaking when it ‘has reason to believe that the unfair or deceptive acts or practices which are the subject of the proposed rulemaking are prevalent.’”  She further recognized that the “ANPRM wanders far afield of areas for which we have clear evidence of a widespread pattern of unfair or deceptive practices.  Third, regulatory and enforcement overreach increasingly has drawn sharp criticism from courts.  Recent Supreme Court decisions indicate FTC rulemaking overreach likely will not fare well when subjected to judicial review.  And fourth, Chair Khan’s public statements give me no basis to believe that she will seek to ensure that proposed rule provisions fit within the Congressionally circumscribed jurisdiction of the FTC.  Neither has Chair Khan given me reason to believe that she harbors any concerns about harms that will befall the agency (and ultimately consumers) as a consequence of her overreach.”

Commissioner Wilson is accurate that this rulemaking could very well be overturned by judicial review.  The June 30, 2022, Supreme Court decision in EPA vs. West Virginia, which addressed the “major questions” doctrine and found that when an agency claims authority on an issue with vast economic and political significance, and Congress did not give the agency the power to take such action, the rulemaking is invalid.  The decision should sound a warning bell to all federal agencies not to overextend their jurisdiction and impose unwarranted or unconstitutional mandates beyond the scope of their statutory authority.  Federal decisions and rulemaking should be educated by fact, and Congress, not the FTC, should develop a strong consumer data privacy framework that covers the entire country.  The FTC should not be speaking for all federal and state entities.

As noted by Senate Commerce, Science and Transportation Committee Ranking Member Roger Wicker (R-Miss.), “To get real consumer data privacy protections, Congress must act.  FTC commissioners have acknowledged that legislation, not regulation, is the preferred way to achieve these protections.”

Congress is already working on developing a national framework for privacy protection through H.R. 8152, the American Data Privacy and Protection Act (ADPPA), which was ordered to be reported to the House by a vote of 53-2 in the Judiciary Committee on July 20, 2022.  The ADPPA has some positive provisions and some that are likely, as currently drafted, to make data privacy protection even more complex, confusing, and costly, including unclear definitions that could lead to lawsuits, language that exceeds current FTC guidance on privacy (not the proposed rulemaking), failure to preempt state laws, and the inclusion of a private right of action that will increase the number of frivolous lawsuits, the cost of which will be passed on to consumers.  While the bill has its flaws, it is a good start to negotiating a compromise agreement that will provide consumers and businesses alike a standardized path forward in protecting privacy in all their dealings.  While the bill is unlikely to be enacted into law before the end of the 117th Congress, particularly in light of objections to some provisions of the bill by Senate Commerce, Science and Transportation Committee Chair Maria Cantwell (D-Wash.) and many California Democrats, these issues do not create the need for the FTC to take over the job of Congress and devise its own privacy regulations.

The FTC has already abandoned the consumer welfare standard and is now operating as a rogue enforcement agency that is in the process of promulgating overreaching regulations that are likely to be found in violation of its authority.  Congress must act on consumer data privacy not only because it would stop the FTC in its tracks, but also because it has the authority to enact laws that must be followed throughout the entire country.