Movement on All Sides Toward Broader Data Privacy and Security Oversight by FTC

Earlier this month, we reported on two Senate privacy bills reintroduced from last year’s legislative session. These reintroductions are part of a broader wave of federal privacy bills, none of which are making meaningful progress toward becoming law. While the prospect of a comprehensive federal privacy law in the near term remains unlikely, a recent appropriation proposal and the nomination of longtime privacy advocate Alvaro Bedoya indicate that Democrats are attempting to empower the Federal Trade Commission (FTC) by providing the resources and leadership necessary for more aggressive data privacy and information security enforcement.

FTC Privacy Bureau Appropriation

On September 14, the House Committee on Energy and Commerce voted to appropriate $1 billion over 10 years to the FTC to establish and operate a new privacy bureau. Rep. Jan Schankowsky (D-IL) proposed the appropriation, highlighting the privacy abuses of large tech companies and stating that the appropriation would enable the FTC to “hold companies accountable for failing consumers.” The purpose section of this proposed appropriation states that these funds will be used “to accomplish the work of the Commission related to unfair or deceptive acts or practices relating to privacy, data security, identity theft, data abuses, and related matters.”

These additional funds would represent a significant increase to the FTC’s budget. For fiscal year 2021, the FTC was appropriated $351 million,[1] $196 million of which has been allocated toward protecting consumers. Of this $196 million, the FTC allocated about $13 million to privacy and identity protection activities. Rep. Schankowsky’s proposed appropriation is significantly larger than the one-time $100 million appropriation in the Setting an American Framework to Ensure Data Access, Transparency, and Accountability (SAFE DATA) Act and the one-time $350 million appropriation in Rep. Suzan Delbene’s (D-WA) Information Transparency & Personal Data Control Act.

Also, the potential establishment of an FTC privacy bureau represents a very significant development. Currently, the FTC’s work is divided among three bureaus: (1) Bureau of Consumer Protection, (2) Bureau of Competition, and (3) Bureau of Economics. The Bureau of Consumer Protection has been designated to handle data privacy and security-related enforcement actions under its claimed authority via the FTC Act Section 5 to enforce against unfair or deceptive acts or practices. Presumably, this enforcement function would be transferred to the new privacy bureau.

New federal statutes could allocate further privacy-related authority to this bureau. Recent bills, such as the aforementioned SAFE DATA Act and Senator Amy Klobuchar’s (D-MN) Social Media Privacy Protection and Consumer Rights Act of 2021, would allocate such authority to the FTC, while other bills, such as the Data Protection Act of 2021 and the Online Privacy Act of 2019, take the approach of establishing a separate federal data protection agency.

In some instances, federal data privacy and security oversight is also carried out by other agencies. For example, under the Dodd Frank Act, the Consumer Financial Protection Bureau (CFPB) obtained the power to enforce against unfair, deceptive, or abusive acts in the context of consumer financial products and services. The CFPB used this enforcement authority to bring a data security-related enforcement action against Dwolla, Inc. in 2016. Also, sector-specific privacy laws are currently enforced by other federal agencies, and this appropriation proposal would not affect their jurisdiction or enforcement efforts.

Nomination of Alvaro Bedoya

On September 13, President Biden nominated Alvaro Bedoya to serve as an FTC commissioner. Bedoya has authored numerous works related to privacy and is the founding director of Georgetown Law’s Center on Privacy and Technology. Collectively, this leadership change and increased privacy funding could lead to far more federal activity and oversight. Bedoya’s prior work may shed light into the new bureau’s priorities.

For more analysis on Bedoya’s nomination, please visit here.

Conclusion

These moves are clear indications of the Democrats’ intent to bolster federal privacy oversight via the existing FTC infrastructure rather than through legislation. This possible expansion of federal oversight comes as many businesses struggle to comply with an increasingly complex and growing set of state-level privacy requirements. Troutman Pepper’s privacy professionals have extensive litigation and compliance experience and are ready to help businesses navigate this difficult regulatory environment. We will also continue to monitor and provide updates on these major developments.

[1] See here.