Updates on the FTC Privacy Rulemaking: Insights from Commissioner Slaughter and Comment Deadline Extension

In August, the FTC launched a groundbreaking privacy and security rulemaking under the FTC Act with an extensive Advanced Notice of Proposed Rulemaking (ANPR) that asks a wide range of questions. The ANPR has generated interest from a wide range of government and private sector stakeholders, given its remarkable breadth and potential impacts on federal privacy policy.

Last week saw two notable developments with respect to the FTC’s rulemaking. First, the International Association of Privacy Professionals (IAPP) conference in Austin, Texas featured a discussion with FTC Commissioner Rebecca Slaughter regarding this broad new rulemaking. The conversation with Commissioner Slaughter touched on next steps in the rulemaking process, how it intersects with potential federal privacy legislation, and what it means for FTC’s agenda in the interim. Second, and shortly after Commissioner Slaughter’s discussion, the FTC granted an extension of the deadline for comments in response to the ANPR.

As companies and organizations are considering their engagement with the FTC in this proceeding, now due by November 21, 2022, below are the top takeaways we heard from Commissioner Slaughter’s discussion:

• Federal privacy rules are needed. Commissioner Slaughter underscored her belief that the FTC’s case-by-case enforcement framework had reached its limits in the area of privacy, which she believes is evidenced by the lack of change in market behavior. Accordingly, she believes there is a necessity for the present rulemaking, particularly in the continued absence of any federal legislative action. However, she also urged the U.S. Congress to pass federal privacy legislation and indicated that any FTC rulemaking would be appropriately curtailed in the event such legislation is passed.
• The FTC is moving as fast as statutorily possible. Commissioner Slaughter emphasized the FTC is seeking to move as quickly as statutorily possible to complete the rulemaking and implement privacy rules. During this discussion, Commissioner Slaughter hinted at the extension that ultimately was granted at the end of last week. Even with this short extension, Commissioner Slaughter pushed back against the concept that the full rulemaking may take as many as 10 years, saying that the agency has a real urgency to move faster.
• The FTC is highly focused on building a robust record. Commissioner Slaughter discussed the importance she saw in building a robust record about the issues addressed in the privacy rulemaking. She emphasized her view that the breadth of the ANPR was essential to make sure the Commission gained a deeper understanding of interconnected privacy issues. She further emphasized that the breadth of the ANPR may not ultimately be reflected in any final rules promulgated by the FTC.
• Commissioner Slaughter expressed skepticism around the effectiveness of privacy policies. Commissioner Slaughter took aim at the current privacy policy regime, contending that the current privacy policy regime is ineffective. As an example, she argued that even sophisticated consumers do not read, nor have time to understand, companies’ privacy policies. She further argued that the current privacy policy regime creates an asymmetry in power because even if a consumer took the time to understand a company’s privacy policy, to the extent a consumer disagreed with the policy, there is little recourse or alternative for the consumer.

***

Wiley’s Privacy, Cyber & Data Governance Team has helped entities of all sizes from various sectors proactively address risks and compliance with new privacy laws and advocate before government agencies. Please reach out to any of the authors with questions.