Slaughter unveils multi-pronged approach to privacy enforcement

More aggressive enforcement, possible new rules and additional outreach. That’s the three-part strategy acting Federal Trade Commission Chairwoman Rebecca Slaughter is implementing for dealing with privacy issues.

While Slaughter is hoping for additional powers under privacy legislation, she also thinks existing laws allow the agency to be creative and do more when it comes to enforcement.

In a recent speech, Slaughter cited the agency’s consent decree with Flo, the developer of a fertility and period tracking app, which includes a provision requiring the company to tell users that it broke its promise and shared their data with Facebook, Google and other companies.

“There’s a fundamental equity issue here: many people — including those who most need to know — won’t hear about the FTC’s action against a company they deal with unless the company tells them. So, I’ll be pushing staff to include provisions requiring notice in privacy and data security orders as a matter of course,” she said.

But Slaughter thinks the agency could take further steps.

In a joint opinion with FTC Commissioner Rohit Chopra that was partially concurring and partially dissenting of the agency’s 5-0 decision in the Flo case, the two said the agency should have charged the company for violating the FTC’s Health Breach Notification Rule.

More broadly, in her speech Slaughter advocated for using the rule to punish violations involving data not covered under the Health Insurance Portability and Accountability Act.

The rule, which the agency is reviewing, took effect in 2009. It requires consumer-facing vendors of personal health records not otherwise covered under health data regulations to notify individuals, the FTC, and the media — whenever more than 500 people are affected — of any breach of information. The agency can assess civil penalties for violations.

Slaughter also vowed the agency would continue to draw on a novel disgorgement remedy used in a settlement with photo app Everalbum. The FTC required the company to delete facial recognition models and algorithms that it developed with improperly obtained user photos and videos.

Slaughter’s ability to implement changes could be hampered by several challenges, including the fact that she will soon be presiding over a commission with a Republican majority, assuming Chopra is confirmed as director of the Consumer Financial Protection Bureau. She wouldn’t have a Democratic majority until President Joe Biden nominates two people to fill the vacancies at the agency and they are confirmed by the Senate.

Her efforts could be helped by additional support from the White House. Columbia University law professor Tim Wu, a critic of Big Tech and an advocate of stronger antitrust and privacy enforcement, is likely to join the staff of the National Economic Council, according to media reports.

But the agency is facing limited resources, even though Congress increased its funding last year.

Those challenges, which will likely mean a continued hiring freeze and limits on its ability to pursue some litigation, were laid out in a memorandum from its executive director David Robbins, obtained by MLex.

The agency’s enforcement efforts will take place as Congress once again tries to pass comprehensive privacy legislation. Democratic chairs of the relevant House and Senate committees have expressed cautious optimism about reaching a compromise.

In case lawmakers don’t act, Slaughter has voiced support for having the agency embark upon more cumbersome rulemaking under the Moss-Magnuson Act.

“The worst-case scenario here is not that a Mag-Moss rulemaking takes years to complete. The worst-case scenario is that years from now, Congress has still not acted and the FTC has still not begun,” she said in 2019.

If Slaughter can round up majority support remains to be seen, but Commissioner Christine Wilson is considering whether to back such a move.

In terms of public outreach, Slaughter said the agency will boost its efforts. An April 29 workshop is described as examining marketplace incentives and “how best to ensure market players do a better job of protecting privacy and securing consumer data.”