Dems support FTC privacy bureau but roadblocks remain

Momentum is building among congressional Democrats to give the Federal Trade Commission funding to create a new bureau to focus on data security and privacy matters, but obstacles remain to getting the proposal enacted into law.

The $3.5 trillion Build Back Better bill pending in the House authorizes $100 million in each of the next 10 years to fund the new bureau for the FTC, which has long complained that it lacks the resources to adequately police companies in the ever-growing privacy space.

The funds would supplement the agency’s budget, which is $351 million for this year. But moderates think the $3.5 trillion figure is too high so if the measure is reduced, the funding for the new bureau could be included in another bill.

If the legislation passes the House, there are further challenges in the Senate in light of concerns about the measure’s size expressed by moderates Joe Manchin of West Virginia and Kyrsten Sinema of Arizona. Either one could torpedo the bill, even though Democrats could pass it without any Republican votes.

Although most bills in the Senate require 60 votes to pass — and the chamber is divided 50-50 — the measure will likely be considered under reconciliation rules. That means it can be passed if all 50 Democrats vote for it and Vice President Kamala Harris breaks the tie. It cannot be filibustered.

Senate Commerce Committee Chair Maria Cantwell supports the idea of a new bureau. At a Sept. 29 hearing on privacy legislation, the Washington State Democrat said the bureau would enable the FTC to improve its enforcement, but also pressed the agency to use other tools, such as rulemaking to provide more privacy protections.

Cantwell said the goal is to ensure the FTC “is equipped with the authorities and resources to fight digital harms and hold bad actors accountable for increasing privacy violations, data breaches, Internet scams, ransomware assaults and other harmful data abuses.”

Senator Roger Wicker, the top Republican on the panel, said he’s receptive to providing more money for the agency, though he didn’t specifically address the idea of adding a new bureau. Wicker spent most of his time discussing the need for comprehensive bipartisan privacy legislation and urged the Biden administration to appoint a point person to negotiate with Congress. He took issue with those who want the FTC to embark on privacy rulemaking.

“Anything short of congressional action would create significant regulatory uncertainty for businesses and confuse consumers about the scope and durability of their privacy rights,” the senior senator from Mississippi said.

Senator John Thune, a South Dakota Republican, expressed skepticism about the effectiveness of additional money for the FTC. “I do not believe we should relinquish our responsibility by simply increasing our federal bureaucracy.”

Former FTC Chief Technologist Ashkan Soltani told the panel the privacy bureau would help the agency because it’s understaffed compared to its foreign counterparts.

He said there are approximately 40 lawyers and a “handful” of technologists dealing with privacy at the FTC. By contrast, Germany’s data protection agency has 745 employees, including roughly 100 technical experts. France’s counterpart agency has a staff of almost 200 employees, including 30 technical experts.

Soltani, who served at the FTC during the Obama administration, said privacy legislation is needed to give the agency “a legal mandate to enforce privacy laws beyond those bad actions that are deceptive or unfair.”

Maureen Ohlhausen, a former acting FTC chair, recommended that the panel give the agency extra money and further guidance in the form of privacy legislation. Ohlhausen, a Republican who ran the agency during the first 15 months of the Trump administration, opposes having the FTC conduct additional privacy rulemaking because of its “checkered” history in this area.

David Vladeck, who ran the FTC’s consumer protection bureau during Obama’s first term, said “I don’t think an FTC rule is anyone’s first choice.”

But the agency is getting pressure from Congress.

Eight Democratic senators, led by Richard Blumenthal of Connecticut, asked FTC Chair Lina Khan to embark on aggressive privacy rulemaking.

The goal of these rules should be “protecting consumer data” and “the rulemaking should consider strong protections for the data of members of marginalized communities, prohibitions on certain practices (such as the exploitative targeting of children and teens), opt-in consent rules on use of personal data, and global opt-out standards.”

In past discussions on a comprehensive privacy bill, lawmakers couldn’t find consensus on whether there should be preemption of state laws, a priority of Republicans, and whether there should be a private right of action, which Democrats support.

There might be some meeting of the minds.

“I have some concerns about having something that has high punitive damages for an initial violation,” Ohlhausen said. “If you had something that was really focused on repeated or egregious violations that focused on making consumers whole and protecting consumers going down the road, I think that’s the appropriate focus for a privacy right of action.”

Vladeck said there was a way to find a compromise.

“There are ways for both providing a right of action, which would be essential to real enforcement, but minimize the kinds of concerns that you and my colleagues here today have raised,” he said.