[Senate Hearing 117-718]
[From the U.S. Government Publishing Office]
S. Hrg. 117-718
PROTECTING CONSUMER PRIVACY
=======================================================================
HEARING
before the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
SEPTEMBER 29, 2021
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online: http://www.govinfo.gov
______
U.S. GOVERNMENT PUBLISHING OFFICE
53-124 PDF WASHINGTON : 2023
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
MARIA CANTWELL, Washington, Chair
AMY KLOBUCHAR, Minnesota ROGER WICKER, Mississippi, Ranking
RICHARD BLUMENTHAL, Connecticut JOHN THUNE, South Dakota
BRIAN SCHATZ, Hawaii ROY BLUNT, Missouri
EDWARD MARKEY, Massachusetts TED CRUZ, Texas
GARY PETERS, Michigan DEB FISCHER, Nebraska
TAMMY BALDWIN, Wisconsin JERRY MORAN, Kansas
TAMMY DUCKWORTH, Illinois DAN SULLIVAN, Alaska
JON TESTER, Montana MARSHA BLACKBURN, Tennessee
KYRSTEN SINEMA, Arizona TODD YOUNG, Indiana
JACKY ROSEN, Nevada MIKE LEE, Utah
BEN RAY LUJAN, New Mexico RON JOHNSON, Wisconsin
JOHN HICKENLOOPER, Colorado SHELLEY MOORE CAPITO, West
RAPHAEL WARNOCK, Georgia Virginia
RICK SCOTT, Florida
CYNTHIA LUMMIS, Wyoming
David Strickland, Staff Director
Melissa Porter, Deputy Staff Director
George Greenwell, Policy Coordinator and Security Manager
John Keast, Republican Staff Director
Crystal Tully, Republican Deputy Staff Director
Steven Wall, General Counsel
C O N T E N T S
----------
Page
Hearing held on September 29, 2021............................... 1
Statement of Senator Cantwell.................................... 1
Statement of Senator Wicker...................................... 3
Letter dated September 27, 2021 from civil rights, civil
liberties, and consumer protection organizations to Hon.
Maria Cantwell and Hon. Roger Wicker....................... 6
Letter dated September 28, 2021 from Arthur Sidney, Vice
President of Public Policy, Computer & Communications
Industry Association to Hon. Maria Cantwell and Hon. Roger
Wicker..................................................... 11
Letter dated September 28, 2021 from the Main Street Privacy
Coalition to Hon. Maria Cantwell and Hon. Roger Wicker..... 15
Letter dated September 28, 2021 from David French, Senior
Vice President, Government Relations, National Retail
Federation to Hon. Maria Cantwell and Hon. Roger Wicker.... 19
Letter dated September 29, 2021 from Aaron Cooper, Vice
President, Global Policy, BSA | The Software Alliance to
Hon. Maria Cantwell and Hon. Roger Wicker.................. 20
Letter dated September 29, 2021 from Kirsten Gillibrand,
United States Senator from New York........................ 23
Article dated September 29, 2021 from The Wall Street Journal
entitled, ``FTC Weighs New Online Privacy Rules'' by John
McKinnon and Ryan Tracy.................................... 84
Statement of Senator Baldwin..................................... 89
Statement of Senator Tester...................................... 90
Statement of Senator Fischer..................................... 92
Statement of Senator Klobuchar................................... 94
Statement of Senator Scott....................................... 95
Statement of Senator Moran....................................... 97
Statement of Senator Markey...................................... 99
Statement of Senator Thune....................................... 100
Statement of Senator Hickenlooper................................ 102
Statement of Senator Lummis...................................... 104
Op-Ed dated September 27, 2021 entitled ``The bipartisan
reason Congress should regulate big tech'' by Senator
Cynthia Lummis............................................. 105
Statement of Senator Peters...................................... 108
Statement of Senator Lee......................................... 110
Statement of Senator Rosen....................................... 112
Statement of Senator Warnock..................................... 113
Statement of Senator Lujan....................................... 115
Statement of Senator Blumenthal.................................. 117
Witnesses
David C. Vladeck, Professor and Faculty Director, The Center on
Privacy and Technology, Georgetown Law; Former Director,
Federal Trade Commission, Bureau of Consumer Protection........ 26
Prepared statement........................................... 27
Maureen K. Ohlhausen, Partner and Section Chair of Antitrust and
Competition Law, Baker Botts; Former Acting Chairman, Federal
Trade Commission............................................... 33
Prepared statement........................................... 34
Ashkan Soltani, Independent Researcher and Technologist; Former
Chief Technologist, Federal Trade Commission................... 38
Prepared statement........................................... 40
Morgan Reed, President, ACT | The App Association................ 69
Prepared statement........................................... 70
Appendix
Color of Change, prepared statement.............................. 121
Electronic Transactions Association, prepared statement.......... 123
Privacy4Cars, prepared statement................................. 126
Response to written question submitted to David C. Vladeck by:
Hon. Ray Ben Lujan........................................... 130
Hon. Raphael Warnock......................................... 130
Hon. John Thune.............................................. 130
Hon. Marsha Blackburn........................................ 131
Response to written questions submitted to Maureen K. Ohlhausen
by:
Hon. Ben Ray Lujan........................................... 131
Hon. Raphael Warnock......................................... 131
Hon. John Thune.............................................. 132
Hon. Marsha Blackburn........................................ 132
Response to written questions submitted to Ashkan Soltani by:
Hon. Ben Ray Lujan........................................... 133
Hon. Raphael Warnock......................................... 133
Response to written questions submitted to Morgan Reed by:
Hon. Raphael Warnock......................................... 135
Hon. John Thune.............................................. 136
Hon. Marsha Blackburn........................................ 137
PROTECTING CONSUMER PRIVACY
----------
WEDNESDAY, SEPTEMBER 29, 2021
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 10 a.m., in room
SR-253, Hart Senate Office Building, Hon. Maria Cantwell,
Chairwoman of the Committee, presiding.
Present: Senators Cantwell [presiding], Klobuchar,
Blumenthal, Markey, Peters, Baldwin, Tester, Rosen, Lujan,
Hickenlooper, Warnock, Wicker, Fischer, Moran, Blackburn,
Young, Lee, Scott, and Lummis.
OPENING STATEMENT OF HON. MARIA CANTWELL,
U.S. SENATOR FROM WASHINGTON
The Chairwoman. The U.S. Committee on Commerce, Science,
and Transportation will come to order. Good morning, everyone.
Today, we are having a hearing on protecting consumer privacy.
And we will hear from a panel of experts, three of whom have
previously been on the front lines of fighting to protect
consumer privacy at the primary agency charged with protecting
consumers' privacy and data security, the Federal Trade
Commission.
We all know the challenges of the information age, and that
they have brought us new products and services. But it has also
exposed and threatened consumer privacy by unnecessarily
collecting, storing, selling, and exposing consumers' most
personal data to theft and harm. Every year for the past 5
years, more than 140 million people have been affected by data
breaches, exposing their personal data to thieves and
fraudsters. And from July 2019 through July 2020, more than
650,000 residents of my state, Washington, were victims of data
breaches, including the release of their healthcare
information, banking records, Social Security numbers, credit
card information.
Last week it was reported that Simon--last week it was
reported that last May, Simon Eye, a U.S. chain of optometry
clinics, had been data breached, exposing 144,000 individuals
to sensitive--their sensitive data. This past April, the
personal data of over 500 million Facebook users, including
phone numbers, full names, locations, e-mail addresses, were
posted in a hacking forum, 32 million records were from the
United States, providing key information with people who would
want to use those in various ways. And last June, Volkswagen
announced a data breach and exposed phone numbers and e-mail
addresses of 3.1 million Americans who had shopped for cars.
So it isn't a surprise that all this data being stolen,
exposed, that more people have become victims of identity
theft. Identity theft complaints have increased 375 percent
between 2017 and 2020. The harms are causing real damage to
consumers. According to a May 2021 report by the Identity Theft
Resource Center, victims of identity theft are turned down for
loans, unable to rent houses. They have their credit damaged.
They are billed for medical services they never received. Can't
find unemployment benefits because their name was basically
stolen.
Our precise locations, fitness regimens, computer strokes,
and even our friends and family networks have basically been
turned into commodities. We know that recently The Wall Street
Journal also found that even after you turn off some of your
app tracking on your iPhone, iPhone apps can continue to track
you using your device fingerprints. The fact is that companies
collecting this information are not doing enough to safeguard
and collect--the information that they collect or keep their
privacy promises. Unfortunately, the Federal Trade Commission,
which is tasked with preventing consumer data abuses, has not
been given the resources to keep pace with this tech based
economy.
Professor Vladeck, we will hear from you, but I think you--
have in your opening remarks that basically now the FTC's
docket is dominated by these technology issues. The truth is
that our economy has changed significantly, and the Federal
Trade Commission has neither the adequate resources nor the
technological expertise at the FTC to adequately protect
consumers from harm.
While the Commission is responsible for keeping up with the
latest technology companies in the world, according to today's
testimony, ``it has fewer than 10 employees on staff with the
right technology expertise.'' The FTC simply does not have the
tools to fend off privacy attacks, data breaches, Internet
scams, ransomware, digital abuses that threaten consumers and
our economy. It is not to say the FTC hasn't done some good
work. But when we look at the volume of what we are facing, it
is clear you are under--they are underresourced.
Even where the FTC has taken enforcement actions against
companies, the companies continue to violate those FTC orders,
which is beyond frustrating. Even though the FTC has been able
to use their current authority of unfair and deceptive
practices, companies like Facebook or others may gladly pay a
$5 billion fine when actually they can still make over $70
billion a year from some of these same practices. So,
compliance. We need compliance. Compliance with existing laws
or compliance with new rulemaking or compliance with a new
privacy law will be insufficient if the FTC is not well
resourced, technology sophisticated, and the policeman on the
beat of the information age.
The U.S. Department of Commerce estimated that the digital
economy accounted for 9.6 percent of GDP in 2019, and it grows
annually at a rate of 5.2 percent. This means we are just going
to continue to be ever dependent on this economy. I am not even
going to spend time talking about at length the great effect of
State actors attacking our systems. The fact that we are--
consumers are less vulnerable to these events. But the economy
of today is that--the digital economy generates $2 trillion
annually. So it will continue to be a target. As the economy
grows, the volume of data collected about Americans and the
amount of data that will be stored is staggering.
Last Congress, I introduced the Consumer Online Privacy Act
alongside my colleague Schatz, and Klobuchar, Markey, that
would have established a new privacy bureau at the FTC to serve
as a consumer privacy watchdog. And I am pleased that the
Budget Reconciliation Act that we are now considering in both
the House and the Senate has a call for action here by giving
$1 billion to the FTC to establish this bureau over 10 years,
to hire the technologists, the data scientists, needed to keep
pace with these digital threats. I know my Republican
colleagues in the SAFE DATA Act also called for a similar
amount of money to be spent by the FTC for privacy and data
security.
And as such, companies like Microsoft and others have
called for greater investments. Today's witnesses, I know, will
also underscore this need. Two of our witnesses, Professor
David Vladeck and Ms. Maureen Ohlhausen have served in senior
positions at the FTC and have been on the front lines of
enforcement actions against companies that misused or neglected
their security of personal data. We value their insights and
how harm at the FTC--how harm can be done, and that tools and
resources are needed at the FTC to hold companies accountable.
Mr. Vladeck, in your written testimony, you said the Bureau
of--New Privacy Investment Bureau could be a real game changer.
Mr. Soltani, who is going to be joining us virtually, was one
of the first technology experts hired by the FTC, and I know
he's been sounding the alarm for years about the need to get
the right resources, more technologists so the FTC can deliver
more, so I look forward to asking him questions about that.
And Mr. Reed, I was pleased to read your testimony, that
you have a strong statement in support of first time civil
penalty enforcements for the FTC in cases of privacy
violations. So thank you all for being here. Thank you for all
the work all of you have done on this important issue. And now
I will turn it over to my friend and colleague, Senator Wicker,
the Ranking Member, for his opening statement.
STATEMENT OF HON. ROGER WICKER,
U.S. SENATOR FROM MISSISSIPPI
Senator Wicker. Thank you, Senator Cantwell, for convening
this hearing. And we do have a distinguished panel and I look
forward to their testimonies. Last Congress, this committee
heard from multiple stakeholders representing diverse views on
how best to protect consumers' data privacy and security in the
United States.
We received testimony from current and former officials
from the FTC, representatives from the business community, and
academia, and privacy advocates who all testified about the
vast economic and social benefits of data. They also spoke
about the need for strong, clear, and consistent data
protection rules for the Nation's job creators and about
shortcomings in our existing data privacy and security laws.
Since the full committee last convened on this topic over a
year ago, the need for strong data privacy rules has become
more urgent.
In response to the COVID-19 pandemic, millions of Americans
have shifted their normal activities to online. This has
resulted in more consumer data and personal information flowing
throughout the economy than ever before. Without a national
data privacy law in place, Americans will continue to face a
growing risk of having their personal data exposed and
potentially exploited. We are already seeing this happen. As
the Chair has mentioned, earlier this year, the FTC reported
that identity theft increased by almost 3,000 percent in 2020.
Cyber-attacks and data breaches are also on the rise. Recent
news reports show an uptick in exploitive data practices by
social media targeting children and teens.
And there are near daily accounts of entities misusing
consumers' personal data or attempting to process their data in
discriminatory ways. These developments are deeply troubling
and further highlight the need for strong data protection
rules. Without these safeguards, we risk losing consumers'
trust in the Internet marketplace and undermining our national
security and technological leadership abroad.
Fortunately, Congress still has an opportunity to act to
develop bipartisan national privacy legislation. In doing so,
the United States would join more than 100 countries who
already have a baseline privacy law, including China. In July,
Senator Blackburn joined me in introducing a data privacy bill,
the SAFE DATA Act, as a starting point to resume negotiations.
And I am encouraged that this morning the Chair of this
committee spoke favorably about a provision in that Act. Once
again, I invite the Administration to work with Senator
Cantwell and me to make a comprehensive data privacy law a
reality.
I call on the President to appoint someone, a specific
person among his senior staff to be a liaison to Congress on
this issue and to prioritize the enactment of a data privacy
law this year. This is not only essential to a thriving digital
economy, but it would also demonstrate to our allies around the
world a serious and sincere commitment to the value of data
protection as we seek to replace the EU, U.S. Privacy Shield,
preserve transatlantic data flows, and enter into the new
bilateral partnership on trade and technology.
Today's hearing is an opportunity to discuss how to address
certain issues in privacy legislation such as data security and
enforcement. I hope our witnesses will speak to ways in which
Congress can materially improve data security without imposing
costly one size fits all mandates that would ignore an entity's
unique data collection practices. I also hope witnesses will
speak to what enforcement mechanisms offer the best way to
ensure that requirements in privacy law are met and data
protections are enforced. Last Congress, I proposed
incorporating a narrow private right of action into a
bipartisan privacy legislation, and I remain open to that idea.
I welcome feedback from witnesses on how a narrow private
right of action could be constructed without stifling
innovation and marketplace competition or leading to
unjustified financial windfalls for plaintiffs' attorneys.
Today's hearing is also an opportunity to discuss how to ensure
the FTC is properly resourced to enforce a data privacy law. I
am sure witnesses will want to discuss what additional funding
staff and technology expertise the Commission were required to
enforce the law effectively.
Finally, it is worth emphasizing that Congress, not the
FTC, is responsible for developing a comprehensive national
data privacy law. Only Congress can develop long-standing data
protections for consumers that meaningfully safeguard their
personal information. Anything short of Congressional action
would create significant regulatory uncertainty for businesses
and confuse consumers about the scope and durability of their
privacy rights. Americans deserve to have their data protected.
The time for Congress to act to pass Federal data privacy
legislation is now. And I am--I can say that the Chair and I
are united in that belief. I would like to take a moment to ask
unanimous consent.
I have here, Madam Chair, a letter signed by over 20
associations representing hundreds of companies and
organizations requesting that Congress pass a bipartisan
national privacy law. I ask unanimous consent that they be
entered into the record at this point.
The Chairwoman. Without objection.
[The information referred to follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Senator Wicker. Thank you, Madam Chair, and thank you to
these witnesses.
The Chairwoman. Thank you, Senator Wicker, and thank you
for that statement. I certainly want to agree with you. Happy
to work with a point person from the Administration on this
important policy. And I would be remiss if I didn't mention
your great work on the European, U.S. data shield discussions.
You have been a stalwart on this very important policy issue.
And I think that it shows not only do we have to get our
policies right, but that we are in a discussion with the world
community about this growing economy as well. So thank you for
that. And I very much appreciate your reminding me of your
willingness to have a larger discussion about the private right
of action. So, anyway, lots to--lots to do here. And so----
Senator Wicker. Thank you.
The Chairwoman.--I really appreciate those efforts. And so
we will now turn to our witnesses. Mr. David Vladeck, Professor
and Faculty Director of the Center on Privacy and Technology at
Georgetown Law and Former Director of the Federal Trade
Commission and Bureau of Consumer Protection. Welcome. Ms.
Maureen Ohlhausen--am I saying that right? OK, good.
Ohlhausen, Partner and Section Chair Baker Botts, Former
Acting Chairman of the Federal Trade Commission. Mr. Ashkan
Soltani, who is joining us remotely, an Independent Researcher
and Technologist, but former Chief Technologist for the Federal
Trade Commission. And Mr. Morgan Reed, President of The App
Association of Washington, D.C. So welcome to all of you. And
we will start with you, Professor Vladeck.
STATEMENT OF DAVID C. VLADECK, PROFESSOR
AND FACULTY DIRECTOR, THE CENTER ON PRIVACY
AND TECHNOLOGY, GEORGETOWN LAW; FORMER DIRECTOR,
FEDERAL TRADE COMMISSION,
BUREAU OF CONSUMER PROTECTION
Mr. Vladeck. Well, good morning, Chair Cantwell, and
Ranking Member Wicker--and I was to say other members of the
Committee. I am sure they will file in. I am David Vladeck. I
am a Law Professor at Georgetown Law School. And as the Chair
mentioned, I am the former Director of the Bureau of Consumer
Protection at the Federal Trade Commission. I strongly support
the legislation before Congress today. It would provide funding
to the FTC to create a new technology center bureau to
safeguard your constituents' privacy and data security.
This proposal builds on the Chair's 2019 privacy bill,
which also calls for a new technology bureau within the FTC. I
support the legislation because it will begin to rectify the
chronic underfunding and understaffing of the Federal Trade
Commission. It started in 1980s, when the FTC's budget and
staff allocations were literally cut in half. Since then, as
both--both of you have mentioned, the Nation's gross domestic
product has grown exponentially, and the FTC now enforces more
than 50 additional laws than it did back in 1980.
But today, the FTC is significantly smaller, both in terms
of staffing and funding, than it was in 1980. As best as I can
tell, that is not true for any other Federal agency. And
because Federal budgets are based on prior year appropriations,
the FTC is still lagging far behind its sister agencies,
including, among others, the SEC, the CFPB, and the FCC. But
unlike other agencies, the FTC pays for itself. The FTC almost
invariably, year after year, returns more money to the Federal
treasury than it gets. Why? Because FTC civil penalties,
including, for example, the $5 billion penalty the FTC imposed
on Facebook, goes straight to the Treasury.
$5 billion would pay for more than 15 years of the FTC's
budget. If the FTC were a company, we would all want to buy
stock in it because it always generates more income than it
spends. I urge you to pass this legislation to give the FTC the
tools that it needs--desperately needs to fend off and punish
privacy violations and other digital harms, from Internet scams
and data breaches, to dark pattern manipulation and ransomware
attacks. Without more resources, especially more technologists
and engineers, the FTC will simply not be able to stem the
growing tide of attacks on privacy and other digital harms.
As a result, the cost to the United States will continue to
vastly exceed the sums proposed in this legislation. Not
enacting this bill would be penny wise and pound foolish. I
know that some in this committee think funding and the creation
of a new bureau should await Federal privacy legislation. I
respectfully disagree. Your constituents are at risk today and
that risk grows as privacy averse business models grow. Just
read The Washington Post today about all of the Internet
enabled tools in one's household that are all collecting
enormous amounts of sensitive information over which your
constituents have little control.
Both of you talked about data breach. Well identity theft
is the essentially predictable debris of an Internet economy
that doesn't really care about data security. We still are
plagued with, you know, with data breaches. So the FTC is
really the only privacy cop on the beat. It is time that
Congress gave it the tools it really needs to be in this fight.
So thank you so much for inviting us here today. I am happy to
answer any questions.
[The prepared statement of Mr. Vladeck follows:]
Prepared Statement of David C. Vladeck, A.B. Chettle, Jr. Professor of
Law, Georgetown University Law Center
Chair Cantwell, Ranking Member Wicker, and members of the
Committee, I am David C. Vladeck, a professor at Georgetown University
Law Center, former Director of the Federal Trade Commission's Bureau of
Consumer Protection, and co-founder and faculty director of Georgetown
Law's Center on Privacy & Technology.
I am here to explain why I strongly support the proposed
legislation before the Committee today, which will provide funding for
the Federal Trade Commission (``FTC'') to create a new technology-
centered Bureau that will focus on safeguarding your constituents'
privacy and data security, and combatting other digital harms. This
proposal builds on the Chair's 2019 privacy bill, which called for a
new privacy, data security and technology bureau within the FTC.\1\
---------------------------------------------------------------------------
\1\ See Senate Bill No. 2968, 116th Congress, 1st Sess. Sec. 301
(2019).
---------------------------------------------------------------------------
*First, the proposed legislation will ameliorate, but not resolve,
the chronic under-funding and under-staffing of the FTC. Even though
the United States' gross domestic product (``GDP'') has grown at least
four-fold since 1980,\2\ and even though the FTC now enforces eighty
statutes in addition to the FTC Act, the FTC is significantly smaller
today--in both funding and staffing--than it was in 1980. Passage of
this legislation will be an urgently needed boost to the FTC's ability
to fend off and punish privacy violations and other digital harms--from
Internet scams and data breaches to dark pattern manipulation and
ransom-ware attacks--that threaten businesses, government entities, and
your constituents.\3\
---------------------------------------------------------------------------
\2\ See, e.g., https://www.statista.com/statistics/263601/gross-
domestic-product-gdp-per-capita-in-the-united-states/.
\3\ See Federal Trade Commission, FTC Appropriation and Full-Time
Equivalent (FTE) History (last visited Sept. 24, 2021), https://
www.ftc.gov/about-ftc/bureaus-offices/office-executive-director/
financial-management-office/ftc-appropriation.
---------------------------------------------------------------------------
*Second, the reality is that the FTC does not have adequate
resources to safeguard online privacy and fight digital threats,
notwithstanding the fact that the FTC remains the most effective
enforcement agency in the world. The proposed legislation will help
close the resource gap between the FTC and its sister law enforcement
agencies. One measure of the resource gap is to compare the FTC's
resources to those of its domestic and international counterparts. In
every head-to-head comparison, whether it is with domestic agencies
like the Securities and Exchange Commission and the Consumer Financial
Protection Bureau, or foreign counterparts like the Irish, British, or
French Data Protection authorities, the FTC loses, generally by a wide
margin. Without more resources, the FTC will not be able to stem the
growing tide of attacks on privacy and other digital harms, and the
cost to the United States will continue to vastly exceed the sums
proposed in this legislation.
*Third, the FTC can create a new Bureau to focus on privacy and
other digital threats without undermining the Bureau of Consumer
Protection's ability to do its job of protecting consumers in the
marketplace. My view (and I emphasize that I am not speaking for the
FTC) is that the FTC would benefit from the creation of a new Bureau
that would focus on safeguarding privacy and fighting digital harms.
The funding authorized in this legislation would allow the FTC to hire
and retain a critical mass of technologists, user experience designers,
engineers, and other technical staff. The FTC has never had a cohort of
technologists, a vacuum that has hindered the Commission's ability
effectively to regulate the major tech companies. To round out a new
Bureau, the FTC could transfer the Division of Privacy and Identity
Protection (DPIP), which at present has 61 full time employees, almost
all lawyers.\4\ The new Bureau would also need to bring in experts from
the Divisions of Marketing Practices, Financial Practices and
Enforcement, and work closely with other components of the Bureau of
Consumer Protection, including the Division of Litigation Technology
and Analysis.
---------------------------------------------------------------------------
\4\ FTC, Fiscal Year 2021 Congressional Budget Justification, at
121 (available at https://www.ftc.gov/system/files/documents/reports/
fy-2021-congressional-budget-justification/fy_2021
_cbj_final.pdf).
---------------------------------------------------------------------------
My point here is modest: There is plainly a path forward for the
FTC to create a new Bureau that focuses on protecting privacy and
combatting other digital harms, without undermining the Bureau of
Consumer Protection's ability to do its job. Many senior FTC staff have
advocated for the creation of a Bureau to focus on technology-related
threats for some time, but given resource constraints, the FTC has been
wary about doing so. The enactment of this legislation will give the
FTC the tools to reorganize and devote greater resources to fighting
digital harms.
I. The FTC Is Under-Funded and Under-Resourced
The FTC's ever-growing statutory responsibilities, along with the
growth of the economy, have long outstripped the Commission's ability
to fully tackle the many missions Congress has assigned to it. This
erosion started in the 1980s. Since then, the Commission's budget and
staffing allocations shrank by nearly half. At the same time, the
emergence of today's tech-driven economy has made the FTC's work far
more complex, and issues relating to technology now dominate the
Commission's docket.
Notwithstanding these challenges, the FTC's domestic and
international counterparts are better funded and staffed, especially
when measured by their mission and scope. The proposed legislation, if
enacted, will begin to address forty years of underfunding and
understaffing, and thus help empower the FTC better to protect
consumers in the digital age.
The hard fact is that the FTC has never recouped from severe budget
and staffing constrictions imposed throughout the 1980s. At its peak in
1980, the FTC had a staff of 1,719 full-time equivalent (``FTE'')
employees to enforce approximately thirty statutes.\5\ 1981 marked the
beginning of a steady decline in the Commission's resources. In a
seven-year span, the Commission's budget stalled out at $66 million,
with its staff whittled down by almost half to a mere 894 FTEs by
1989.\6\ Although there has been some growth in the last decade, the
FTC still operated with only a $331 million budget and only 1,128 FTEs
in Fiscal Year 2020 (``FY20'').\7\ This is less than two-thirds of the
manpower and only a thirty percent greater budget than the Commission
enjoyed forty years ago, yet today's FTC is charged with a much broader
and complex mission than its predecessors. Prior budget increases have
been modest, largely covering mandatory increases in staff compensation
and infrastructure costs, not desperately needed improvements like
hiring technologists and modernizing the Commission's technology.\8\
---------------------------------------------------------------------------
\5\ See Federal Trade Commission, FTC Appropriation and Full-Time
Equivalent (FTE) History (last visited Sept. 24, 2021), https://
www.ftc.gov/about-ftc/bureaus-offices/office-executive-director/
financial-management-office/ftc-appropriation.
\6\ See Federal Trade Commission, FTC Appropriation and Full-Time
Equivalent (FTE) History (last visited Sept. 24, 2021), https://
www.ftc.gov/about-ftc/bureaus-offices/office-executive-director/
financial-management-office/ftc-appropriation.
\7\ See id.
\8\ See Federal Trade Commission, Prepared Statement Before the
Committee on Appropriations, U.S. House of Representatives (Sept. 25,
2019), available at https://www.ftc.gov/system/files/documents/
public_statements/1545285/
appropriations_committee_testimony_092519.pdf; Federal Trade
Commission, Fiscal Year 2020 Congressional Budget Justification,
available at https://www.ftc.gov/system/files/documents/reports/fy-
2020-congressional-budget-justification/fy_2020_cbj.pdf (requesting
budget increase of $5.98 million, about 73 percent of which would go
toward infrastructure improvements and mandatory compensation
increases).
---------------------------------------------------------------------------
While resources have been constrained, the Commission's
responsibilities have expanded and continue to do so. Today's
Commission has the responsibility of enforcing significantly more
statutes than it did in 1980. In fact, since 1980, Congress has enacted
more than fifty statutes that require the FTC to take action.\9\ The
FTC currently enforces eighty-one antitrust and consumer protection
laws, as well as the Federal Trade Commission Act.\10\ At the end of
2020 alone, three new statutes were enacted tasking the Commission with
additional administrative and enforcement duties.\11\ Not surprisingly,
most of the responsibilities Congress has assigned to the Commission
relate to privacy and data protection. A number of the post-1980 FTC
statutes include important privacy laws such as the Children's Online
Privacy Protection Act (``COPPA''), the Gramm-Leach-Bliley Act, and the
Controlling the Assault of Non-Solicited Pornography and Marketing Act
of 2003 (``CAN-SPAM Act'').\12\ The FTC's privacy-related enforcement
matters have accounted for more than 130 spam and spyware cases, over
80 cases alleging privacy violations, more than 100 cases under the
Fair Credit Reporting Act, and dozens of cases under Gramm-Leach-
Bliley, the COPPA, and other related privacy-protective statutes.\13\
---------------------------------------------------------------------------
\9\ Federal Trade Commission, Statutes Enforced or Administered by
the Commission, available at https://www.ftc.gov/enforcement/statutes.
\10\ Id.
\11\ Federal Trade Commission, Statutes Enforced or Administered by
the Commission, available at https://www.ftc.gov/enforcement/statutes
(The COVID-19 Consumer Protection Act, the Horseracing Integrity and
Safety Act, and the No Surprises Act).
\12\ New America, Revamped FTC or New Agency, available at https://
www.newamerica.org/oti/reports/does-data-privacy-need-its-own-agency/
revamped-ftc-or-new-agency/
\13\ Federal Trade Commission, 2020 Privacy and Data Security
Update, (May 24, 2021), https://www.ftc.gov/system/files/documents/
reports/federal-trade-commission-2020-privacy-data-security-update/
20210524_privacy_and_data_security_annual_update.pdf
---------------------------------------------------------------------------
Not only have the Commission's statutory responsibilities expanded,
but the U.S. economy has also grown exponentially. In 1980, the U.S.
GDP totaled just under $3 trillion in today's dollars.\14\ Today, it
totals about $21 trillion.\15\ And, with the exception of the recession
years of 2008 and 2009 and the pandemic year of 2020, the American
economy has reliably grown each year.\16\ Though we are still in the
throes of our battle against COVID-19, both the Federal Reserve and the
OECD project a 6 percent GDP growth rate for 2021, thanks in large part
to Congressional interventions like the American Rescue Plan.\17\
---------------------------------------------------------------------------
\14\ World Bank, GDP (current US$)--United States (last visited
Sept. 23, 2021), https://data.worldbank.org/indicator/
NY.GDP.MKTP.CD?end=2020&locations=US&start=1978&view
=chart.
\15\ See id.
\16\ World Bank, GDP Growth (annual percent)--United States (last
visited Sept. 23, 2021), https://data.worldbank.org/indicator/
NY.GDP.MKTP.KD.ZG?end=2020&locations=US&start=
1978&view=chart.
\17\ See Organization for Economic Co-Operation and Development,
Keeping the Recovery on Track, Interim Report (Sept. 2021), https://
doi.org/10.1787/490d4832-en; Tim Smart, Fed Holds Steady on Interest
Rates but Shaves 2021 Economic Forecast, U.S. News (Sept. 22, 2021),
https://www.usnews.com/news/economy/articles/2021-09-22/fed-holds-
steady-on-interest-rates-but-shaves-2021-economic-forecast.
---------------------------------------------------------------------------
The booming technology sector, where FTC expertise and regulatory
oversight are crucial, has contributed much to America's economic
growth since the 1980s. Employment in the technology sector increased
by 36 percent from 1990-2000, and by 20 percent from 2010-2015, nearly
double total private sector expansion in the same window of time.\18\
Today, high-tech industries account for about 10 percent of all U.S.
jobs and over 18 percent of U.S. output, with growth expected to
continue at a faster rate than the overall occupational average.\19\
---------------------------------------------------------------------------
\18\ Charles S. Gascon & Evan Karson, Growth in Tech Sector Returns
to Glory Days of the 1990s, St. Louis Federal Reserve (July 25, 2017),
https://www.stlouisfed.org/publications/regional-economist/second-
quarter-2017/growth-in-tech-sector-returns-to-glory-days-of-the-1990s.
\19\ See Brian Roberts & Michael Wolf, High-Tech Industries: An
Analysis of Employment, Wages, and Output, Bureau of Labor Statistics
(May 2018), https://www.bls.gov/opub/btn/volume-7/high-tech-industries-
an-analysis-of-employment-wages-and-output.htm?view_full; Bureau of
Labor Statistics, Occupational Outlook Handbook: Computer and
Information Technology Occupations, (last visited Sept. 23, 2021),
https://www.bls.gov/ooh/computer-and-information-technology/home.htm.
---------------------------------------------------------------------------
As the tech sector grows, so too does the velocity of the
integration of technology into our daily lives, underscoring the need
not only for a well-resourced FTC, but for an FTC with specific and
deep expertise in technology. The advance of laptops, tablets,
smartphones, and other internet-connected devices, along with the near
ubiquitous participation in social media, have resulted in the
generation of unprecedented amounts of sensitive personal data--
including geolocation data, information about political affiliations,
product preferences, and attitudes about virtually everything. Much of
this personal data is constantly harvested, packaged, and sold and
often resold. The commodification of sensitive personal data is a clear
threat to consumer privacy and threatens other digital harms.\20\
---------------------------------------------------------------------------
\20\ See Tuan C. Nguyen, The Brief History of Smartphones,
ThoughtCo (Jan. 30, 2021), https://www.thoughtco.com/history-of-
smartphones-4096585.
---------------------------------------------------------------------------
To be sure, technologies like videoconferencing have sustained our
personal, professional, and academic lives through the pandemic,
keeping us connected and ``keeping the white-collar economy alive.''
\21\ But the FTC's enforcement action against Zoom underscores that
threats to privacy and data security are ever-present, even with what
seem to be innocuous technologies.\22\ The FTC faces a crucial and
ever-increasing mission of keeping Americans safe from those who wish
to exploit technology for harm or fail to take essential measures to
safeguard data. The Committee's proposal would be a critical first step
to ensure the FTC possesses sufficient capabilities to protect
consumers as technologies continue to evolve.
---------------------------------------------------------------------------
\21\ See Matthew Yglesias, The Tech Sector is Finally Delivering On
Its Promise, Vox (Apr. 7, 2020), https://www.vox.com/2020/4/7/21209605/
solow-paradox-coronavirus-technology.
\22\ See FTC, In the Matter of Zoom Video Communications, Inc.,
https://www.ftc.gov/system/files/documents/cases/
1923167zoomcomplaint.pdf.
---------------------------------------------------------------------------
II. Comparing the FTC to its Counterpart Agencies Demonstrates the
Depth of the Resource Gap
It is hard to showcase the depth of the FTC's resource deficit in
isolation. To drive the point home, consider the asymmetry between the
FTC's mission and budget when compared to Federal agencies with
similar, and in some cases narrower, statutory authority. Consider the
Securities and Exchange Commission (``SEC''), for example, which
oversees securities trading on U.S. equity markets and enforces Federal
securities law. To be sure, the SEC has a vital mission to perform, and
I am not suggesting that its appropriation is too generous. But the
SEC's annual budget is almost $2 billion and it has a staff of
approximately 4,700 FTEs--that is, nearly six times the FTC's budget
and four times the FTC's allocation of FTEs.\23\ The SEC's enforcement
budget, standing alone, is nearly double that of the entire FTC.\24\
Even the Consumer Financial Protection Bureau (``CFPB''), which has
regulatory authority over certain consumer financial products and
services, had a FY21 budget that exceeded the FTC's budget by almost
$250 million and by nearly four hundred FTEs.\25\
---------------------------------------------------------------------------
\23\ See Securities and Exchange Commission, Fiscal Year 2022
Congressional Budget Justification and Annual Performance Plan and
Fiscal Year 2020 Annual Performance Report 2 (2021), available at
https://www.sec.gov/cj.
\24\ Id. at 23.
\25\ Bureau Of Consumer Financial Protection, Annual Performance
Plan and Report, and Budget Overview 10 (2021), available at https://
files.consumerfinance.gov/f/documents/cfpb
_performance-plan-and-report_fy21.pdf.
---------------------------------------------------------------------------
There is also a significant salary gap between the FTC and other
agencies that oversee financial regulation that jeopardizes the FTC's
ability to retain top talent. FTC employees do not qualify for enhanced
compensation under the Financial Institutions Reform, Recovery, and
Enforcement Act (``FIRREA''). As a result, their salaries are not on
par with similarly situated Federal employees working in financial
regulation even though the FTC also works on complex investigations of
and litigation against the world's largest corporations.\26\ And
salaries at these corporations and the law firms that represent them
dwarf those in government, which has helped tech giants, like Google,
Facebook, Amazon and others, poach FTC staffers at a remarkable
rate.\27\ Leveling FTC employees' salaries with their government
counterparts would restore parity within government and help the FTC
retain top talent, including technologists and engineers.
---------------------------------------------------------------------------
\26\ Paul H. Kupiec, The Money in Banking: Comparing Salaries of
Bank and Bank Regulatory Employees, American Enterprise Institute for
Public Policy Research 7-10 (April 2014).
\27\ See Alex Kantrowitz, ``It's Ridiculous.'' Underfunded FTC and
DOJ Can't Keep Fighting the Tech Giants Like This, Big Technology
Newsletter (Sep. 17, 2020), https://bigtechnology
.substack.com/p/its-ridiculous-underfunded-us-regulators.
---------------------------------------------------------------------------
The FTC's resources also pale in comparison to its international
counterparts. Many of our European allies have created agencies to
enforce privacy and data security protections--just a part of what the
FTC does.\28\ For example, Ireland's Data Protection Commission
(``DPC'') has 145 staff members, for a nation with a population around
5 million.\29\ DPC Commissioner Helen Dixon said these resources are
``vital for the DPC to continue to build its capacity as an
internationally respected and effective supervisory authority.'' \30\
If the FTC had comparable staff proportional to the U.S. population of
over 333 million, it would have over 9,600 staff dedicated just to
privacy. The British Information Commissioner's Office (``OIC'') has
more than 500 staff members.\31\ France's data protection authority
(``CNIL'') has 255 staff members to protect a population of about 65
million, and it is backed up by its sister agency, Inria (the French
National Institute for Research in Digital Science and Technology),
which has nearly 4,000 engineers on staff.\32\ That's a drastic
difference given only 61 FTC staffers are dedicated to protecting the
privacy of more than 333 million Americans. The resources of our
foreign counterparts continue to grow in proportion to the need for
privacy regulations while the FTC's resources remain static.
---------------------------------------------------------------------------
\28\ The GDPR explicitly requires that the member states' Data
Protection Supervisory Authorities are provided with the financial and
human resources, premises, and infrastructure necessary for the
effective performance of their tasks. Commission Regulation 2016/679,
General Data Protection Regulation, art. 1, 2016 O.J. (L 119) 1, 22.
\29\ https://www.dataprotection.ie/en/news-media/press-releases/
data-protection-commission-publishes-2020-annual-report; https://
www.dataprotection.ie/sites/default/files/uploads/2021-05/
DPC%202020%20Annual%20Report%20%28English%29.pdf
\30\ https://www.dataprotection.ie/en/news-media/press-releases/
data-protection-commission-statement-funding-2021-budget.
\31\ https://ico.org.uk/about-the-ico/our-information/history-of-
the-ico/.
\32\ https://www.cnil.fr/sites/default/files/atoms/files/
the_cnil_in_a_nutshell_2021.pdf. See also https://www.inria.fr/en/
inria-ecosystem.
---------------------------------------------------------------------------
Increasing the FTC's budget is absolutely necessary. Even with its
limited funding and staffing, the FTC continues to operate at a high
level, as demonstrated by its recent order enforcement case against
Facebook, which resulted in the strictest consent decree ever entered
anywhere, as well as a record-breaking $5 billion penalty, and a steady
stream of enforcement cases. But meeting the challenges of protecting
consumers from privacy violations, data breaches, identity theft, and
other digital harms requires an infusion of funding and staff. The FY22
President's budget proposal is insufficient; its increase to $389
million and 1,250 FTEs is a start, but still wholly inadequate. On the
other hand, the proposed infusion of $1 billion for a new Bureau that
focuses on digital privacy and cybersecurity can be a game-changer. I
support this proposal because it will align the FTC's budget with the
realities of today's tech-based economy, help restore the FTC to parity
with its domestic and international counterparts, and better enable the
FTC to perform its important mission of protecting consumers.
III. Funding Will Enable the FTC to Create a Bureau Focusing on
Fighting Digital Harms
There is no question that if Congress enacts the pending
legislative proposal the FTC will be able to create a new Bureau
devoted to fighting against digital harms without hollowing out the
Bureau of Consumer Protection (``BCP''). After all, there is plenty of
work for a new Bureau to focus on technology and digital harms and BCP
will still have an avalanche of consumer protection work to keep it
fully engaged. I recognize that for government veterans, the word
``reorganization'' is justifiably greeted with skepticism, alarm, or
worse. But there is a difference where, as would be the case here,
reorganization takes the form of adding substantial resources rather
than simply re-allocating existing resources.
In my view, the first and most important measure the FTC should
take in standing up a new Bureau is to recruit and hire a critical mass
of top-notch technologists. As far as I know, the FTC has never been
able to have more than ten technologists on staff at any given time
(and probably far fewer), and the small cohort has made it difficult
for the FTC to retain technologists. The FTC likely needs several
multiples of ten to ensure that the FTC has the expertise to regulate
the major tech companies. And a critical mass of technologists is
essential for several reasons, including instilling camaraderie and
information sharing, enabling the Bureau to engage in multiple
investigations simultaneously, helping staff with Section 6(b)\33\
investigations, and giving the technologists time to keep up with
emerging technologies and to conduct and publish research.\34\
---------------------------------------------------------------------------
\33\ 15 U.S.C. 46(b).
\34\ Having in-house experts would substantially bolster the
effectiveness of the FTC's enforcement cases, regardless of whether the
cases are brought before the Administrative Law Judge or a Federal
court. For instance, in FTC v. Commerce Planet, a case that spanned 18
trial days, the FTC retained an expert on human computer interaction
(in other words, user experience) to testify that the company's
disclosures were designed to be obscured and were misleading. In ruling
for the FTC, the District Court Judge said that ``the Court finds the
expert testimony of Jennifer King to be on-point and persuasive,''
sealing the FTC's win. FTC v. Commerce Planet, 878 F. Supp. 2d 1048,
1068 (C.D. Cal. 2012), aff'd, 815 F.3d 593 (9th Cir. 2016). Because of
the expense of hiring outside experts, the FTC rarely does so in
consumer protection cases.
---------------------------------------------------------------------------
To fully staff the new Bureau, the 61 staff currently assigned to
BCP's Division of Privacy and Identity Protection would be transferred
to the new Bureau. The new Bureau would also need to recruit a few
experienced lawyers from several BCP Divisions, including Marketing
Practices, Financial Practices, Enforcement, and Litigation Technology
and Analysis. I assume that those Division would be able to replace
lost staff.
A fully staffed new Bureau could also make critical changes to the
way the FTC enforces the law. For one thing, the new Bureau could
engage in real-time oversight of the tech companies to understand what
they are actually doing in the marketplace, enabling the new Bureau of
be pro-active in ways the FTC cannot undertake today. For another,
having an in-house complement of technologists would enable the FTC to
undertake simultaneously multiple investigations that require technical
assistance, especially in investigations into data breaches, spyware,
the Internet of Things, and the misuse of personal information. For yet
another, the new Bureau could take over the responsibility of
monitoring existing consent decrees involving tech companies, to ensure
that the companies adhere to the requirements of the decrees, and if
there are defaults, to help decide whether the FTC should launch an
investigation or pursue an enforcement action.
And last, but hardly least, the new Bureau will have the authority,
subject to Commission approval, to significantly modify the FTC's
orders against tech companies. Due to resource constraints, FTC privacy
orders require the company to hire a third-party assessor to conduct
periodic audits. Section VIII of the FTC's 2019 Order Modifying Prior
Decision and Order for Facebook lays out what is now the standard
practice of requiring the company to hire an assessor, subject to the
FTC's approval, to submit an initial assessment within six months, and
thereafter submit biennial assessments.\35\ But the FTC adopted the
practice of using outside assessors in privacy cases mainly because of
the resource constraints I have catalogued above. The new Bureau may
choose to play a far more active, direct role in overseeing tech
companies subject to FTC orders, and may, for example, require more
frequent and robust exchanges between the FTC and the company so the
FTC, in real-time, can assess whether the company is in fact in
compliance with the FTC's order.\36\
---------------------------------------------------------------------------
\35\ https://www.ftc.gov/system/files/documents/cases/
c4365facebookmodifyingorder.pdf.
\36\ I should acknowledge that I was the Director of the FTC's
Bureau of Consumer Protection when the Commission was crafting the
initial orders in the Facebook and Google cases. Because of resource
constraints, there was no discussion that the FTC should take on the
front-line role of assessing the companies' ongoing compliance with the
orders. For that reason, the FTC relied on third-party independent
assessments; the utility of those assessments is subject to debate.
There is no question that the assessments have worked reasonably well
in the seventy or so data breach cases the FTC has brought.
---------------------------------------------------------------------------
* * *
Let me end by making a few additional points that are not part of
the pending legislation but are issues Congress must tackle if the FTC
is going to fulfill its mission of safeguarding consumer privacy.
First, the FTC needs ordinary notice and comment rulemaking
authority under Section 553 of the Administrative Procedure Act;
without it, the FTC has no choice but to make policy through
enforcement cases, a process that is slow, resource-intensive, and does
not necessarily yield clear-cut standards.\37\
---------------------------------------------------------------------------
\37\ I recently testified in favor of House Bill 4447 before the
House Committee on Energy and Commerce, Subcommittee on Consumer
Protection and Commerce, which would restore to the FTC notice and
comment rulemaking authority. See https://energycommerce.house.gov/
sites/democrats.energycommerce.house.gov/files/documents/
WitnessTestimony_Vladeck_CPC_2021.07.28.pdf.
---------------------------------------------------------------------------
Second, the FTC needs initial fining authority, especially in cases
involving digital harms. Companies should not get a free pass on
privacy violations. Under existing law, however, the only remedy for a
first violation is a consent order, not a fine, and not redress, not
just because of the Supreme Court's ruling in AMG v. FTC, but because
the currency in privacy violations is the misuse of sensitive personal
data, which, unlike money, cannot be refunded or restored.
Third, the statutory tools the FTC has available are not sufficient
to provide robust protection for consumers against digital harms,
including privacy harms. The commands of Section 5 the FTC Act--that
the FTC ``prevent'' ``unfair and deceptive practices'' in the
marketplace--are not, in themselves, sufficient to create a meaningful
legal regime that safeguards consumers. To be sure, the Act provides
substantial ammunition for the Commission to bring enforcement cases
for many kinds of egregious privacy harms; ammunition that the
Commission has used against most of the major technology companies. But
Section 5 cannot restrain more insidious practices that go beyond
unfairness and deception, and Congress needs to enact a comprehensive
privacy law or delegate greater power to the FTC to combat digital
harms.\38\
---------------------------------------------------------------------------
\38\ I would like to acknowledge the exceptional assistance in
preparing this testimony provided by Georgetown Law Center's
Communications and Technology Law clinic, including the clinic's
director, Professor Laura Moy, staff attorneys Victoria Tang and Daniel
Jellins, and students Liliana Fiorenti, Anna Butel, Pariss Briggs and
Philip Robins.
The Chairwoman. Thank you, Professor Vladeck. Ms.
Ohlhausen, thank you for being here.
STATEMENT OF MAUREEN K. OHLHAUSEN, PARTNER AND SECTION CHAIR OF
ANTITRUST AND COMPETITION LAW, BAKER BOTTS; FORMER ACTING
CHAIRMAN, FEDERAL TRADE COMMISSION
Ms. Ohlhausen. Thank you. Thank you, Chairman Cantwell, and
Ranking Member Wicker, and the other distinguished members of
this Committee for the opportunity to testify at this important
hearing examining how to protect consumer privacy. As you have
already noted, I am Maureen Ohlhausen. I am a Partner at the
law firm of Baker Botts, and I also had the pleasure of serving
as an Acting Chairman and Commissioner at the Federal Trade
Commission, our Nation's leading consumer protection agency.
As the collection, use, and sharing of personal data has
continued to grow, the FTC is reaching the limits of its
current tools, and consumers and businesses are increasingly
required to navigate a tangle of confusing and often
inconsistent privacy requirements from various levels of
Government. And to safeguard consumer privacy in today's
environment, Congress needs to enact a comprehensive national
privacy law. And that is why it is paramount that members of
this committee return to the bipartisan negotiations conducted
in the previous Congress. A new law should have several
components.
First, legislation should provide consumers clarity and
visibility into companies' data collection use and sharing
practices, as well as choices regarding these practices
calibrated to the sensitivity of that data. Second, legislation
should provide a national and uniform set of protections and
consumer rights throughout our digital economy. Third, it
should ensure strong enforcement that protects consumers from
harmful data practices while allowing companies to provide
innovative products and services that consumers want. And while
though some have raised the possibility of the FTC undertaking
a privacy rulemaking under its current general unfair and
deceptive authority, I am concerned that a potential FTC
privacy rulemaking may actually distract from focusing on
achieving these key objectives through legislation.
And there are several potential problems with an FTC
rulemaking. First, the scope of an FTC rulemaking under the
agency's current UDAP authority is much more limited than what
Congress can achieve statutorily. For example, the requirement
of access and correction rights for consumers, which we have
seen in a number of proposed bills, is likely not supportable
under the FTC's current general authority. And some of my
fellow panelists have acknowledged the limitations of the FTC's
current authority in their testimony.
Second, an FTC rulemaking may not preempt State laws and
regulations, even conflicting State requirements. Thus, an FTC
rulemaking could simply produce a 50 first set of privacy
requirements rather than a single national framework that
applies no matter where consumers live, work, shop, or visit.
And this would lead to even more consumer and business
confusion and a fragmenting of consumer rights. And it would
also be particularly burdensome on smaller firms that lack the
resources to deal with such regulatory complexity.
Third, Congress put significant limitations in place for
FTC UDAP rulemaking absent specific guidance to the contrary.
And where Congress has enacted specific privacy laws such as in
the areas of children's privacy and credit reporting, it has
given the FTC notice and comment APA rulemaking authority to
implement clear statutory direction. Absent such clear
statutory guidance and streamlined rulemaking authority, the
FTC must proceed under the more deliberate Magnuson Moss
process, which will slow the implementation of consumer
protections that are widely supported by Congress.
Now, there is no question that a strong privacy law needs
to include strong FTC authority to protect consumers' rights. A
single Federal privacy law that gives the FTC more enforcement
authority will dramatically strengthen consumer protections.
And it should authorize the FTC to fine companies for certain
first time violations, and in certain cases to issue rules to
keep up with developments in technology. It should also give
the FTC more resources. State AGs should be given the power to
enforce any new Federal law. And a consumer privacy law,
though, should not include private rights of action with
punitive or statutory damages that would primarily benefit
lawyers and result in class actions that provide little, if
any, relief to actual victims.
Giving the FTC specific authority to provide consumer
redress would be an effective way to enable consumers to be
compensated directly and promptly when companies engage in
harmful data practices. So thank you again for the opportunity
to testify today, and I look forward to working with the
Committee and all stakeholders to craft strong national privacy
legislation.
[The prepared statement of Ms. Ohlhausen follows:]
Prepared Statement of Maureen K. Ohlhausen, Former Acting Chair,
Federal Trade Commission
Chair Cantwell, Ranking Member Wicker, and other distinguished
Members of this Committee, thank you for the opportunity to testify at
this important hearing examining how to better protect consumer
privacy. My name is Maureen Ohlhausen, and I am a partner at the law
firm Baker Botts L.L.P. I had the pleasure of serving as an FTC
Commissioner (2012-2018) and Acting Chairman (2017-2018).
The FTC is our Nation's leading consumer privacy protection agency.
It has brought hundreds of privacy-and data security-related
enforcement actions, covering both on-and offline practices and fast-
evolving technologies.\1\ The FTC has creatively used every
enforcement, policy, and educational tool at its disposal in its
privacy and data security work to protect consumers' personal
information, while still allowing consumers to enjoy the benefits of
the many innovative products offered in today's dynamic marketplace.
However, as the collection, use, and sharing of personal data have
continued to grow in amount and complexity, consumers and businesses
are now required to navigate a tangled web of confusing, and often
inconsistent, data privacy requirements from various levels of
government, and from various nations and regions throughout the world.
---------------------------------------------------------------------------
\1\ See, e.g., Fed. Trade Comm'n, FTC's Use of Its Authorities to
Protect Consumer Privacy and Security (2020), https://www.ftc.gov/
system/files/documents/reports/reports-response-senate-appropriations-
committee-report-116-111-ftcs-use-its-authorities-resources/
p065404reportprivacydatasecurity.pdf; Oversight of the Federal Trade
Commission: Strengthening Protections for American's Privacy and Data
Security: Hearing Before the S. Comm. on Commerce, Science, and
Transportation, 116th Congress (2019-2020) (statement of the FTC),
https://www.ftc.gov/system/files/documents/public_statements/1578963/
p180101testimonyftcoversight20200805.pdf.
---------------------------------------------------------------------------
While I am proud of the FTC's privacy and data security enforcement
efforts, the agency currently operates under several material
constraints that limit the FTC's effectiveness absent further action by
Congress. You and your colleagues can remove these constraints by
enacting comprehensive, technology neutral, national privacy
legislation that provides clear protections for consumers, articulates
specific limits on companies' ability to collect, use, and share
sensitive personal information, and grants the FTC the resources and
explicit authority necessary to enforce a new law.
I would like to address what I view as reasons why reliance on the
FTC's current authority cannot provide the same benefits as a Federal
privacy law. First, with the exception of discrete areas such as
children's privacy and fair credit reporting, the FTC lacks explicit
authority to enforce statutory privacy requirements or promulgate
privacy regulations. Section 5 of the FTC Act gives the agency the
authority to prevent certain entities from ``using . . . unfair or
deceptive acts or practices in or affecting commerce'' (``UDAP''). This
language has rightly been interpreted to permit the FTC to police
unfair or deceptive privacy and data security practices, but it does
not provide the clear statutory guidance found in other laws. For
example, under the Fair Credit Reporting Act, the FTC can impose
affirmative obligations on entities to provide rights of access to and
correction of data. These rights would also be available under Federal
privacy legislation introduced by Members of this Committee. But the
FTC likely could not impose such obligations based on its UDAP
authority alone.
Second, the FTC's ability to promulgate rules under its broad UDAP
authority is governed by a special process in the Magnuson-Moss
Warranty-Federal Trade Commission Improvement Act. Congress set up this
process specifically to cabin the agency's broad UDAP authority by
imposing additional procedural requirements and other protections.\2\
By contrast, where Congress has provided the agency with detailed
statutory guidance on subject matter and goals, it has expressly
permitted the FTC to use Administrative Procedure Act notice-and-
comment rulemaking, and specifically exempted the agency from the
additional procedures of Magnuson-Moss rulemaking.
---------------------------------------------------------------------------
\2\ Magnuson-Moss Warranty--Federal Trade Commission Improvement
Act, Pub. L. No. 93-637, Sec. 202, 88 Stat. 2183, 2193 (1975) (codified
as amended at 15 U.S.C. Sec. Sec. 45-46, 49-52, 56-57c, 2301-2312
(2012)); 15 U.S.C. Sec. 57a(a)(1)(B).
---------------------------------------------------------------------------
Third, an FTC rulemaking under existing authority may not
necessarily preempt state laws. If the FTC does not preempt state laws,
this would permit the continued proliferation of disparate state
requirements, and would make a coherent, consistent national framework
nearly impossible. In addition, there will inevitably be a conflict
between an FTC rulemaking and the increasing number of state laws and
rulemakings, which will create confusion with respect to what
requirements apply, and will further fragment U.S. privacy protections.
Simply put, the FTC's existing framework is not conducive to
adopting comprehensive, national consumer privacy and data security
requirements in a manner that can provide the clarity and certainty
consumers and businesses seek. That is why I respectfully request that
Congress turn its focus back to enacting privacy legislation.
Last year, I testified before this committee in support of
Congressional efforts to enact comprehensive Federal privacy
legislation. The events of the past year make the need for such
legislation even more apparent. Due to the COVID-19 pandemic, we have
seen a rapid shift to online work and learning, as well as the
deployment of technological efforts to track the path of the virus. The
California Consumer Privacy Act (``CCPA'') went into effect in 2020,
but the landscape continues to shift, as California's ballot initiative
(the California Privacy Rights Act) amended the CCPA, and Virginia and
Colorado enacted their own consumer privacy laws.
These developments reinforce the need for Federal action. Congress
needs to act quickly, and I urge the Leadership and Members of this
Committee to continue to take important steps in that direction.
I realize that there are still points of contention with respect to
privacy legislation. However, what we all have in common is a desire
for clear consumer privacy protections that apply throughout the Nation
based on the sensitivity of the data, and which allow consumers to
continue to benefit from innovative technologies, such as those we have
come to rely on even more heavily during this pandemic. We want
consumers to enjoy confidence that their personal information is not
subject to varying protections within a state or from state to state,
regardless of the entity that collects such information, based on the
sensitivity of the data and how it is used.\3\
---------------------------------------------------------------------------
\3\ See Memorandum from Public Opinion Strategies and Peter D. Hart
to the Progressive Policy Institute, Key Findings from Recent National
Survey of Internet Users (May 26, 2016), https://
www.progressivepolicy.org/wp-content/uploads/2016/05/Internet-User-
National-Survey-May-23-25-Key-Findings-Memo.pdf (finding that 94
percent of consumers favor such a consistent and technology-neutral
privacy regime, and that 83 percent of consumers say their online
privacy should be protected based on the sensitivity of their online
data, rather than by the type of Internet company that uses their
data). See also https://www.progressivepolicy.org/press/press-releases/
press-release-consumers-want-one-set-rulesprotecting-information/
(``Ultimately, consumers want to know there is one set of rules that
equally applies to every company that is able to obtain and share their
data, whether it be search engines, social networks, or ISPs, and they
want that data protected based on the sensitivity of what is being
collected' said Peter Hart.'').
---------------------------------------------------------------------------
I support strong consumer privacy rights and believe firmly in
providing transparency and control to consumers, robust security, and
strong accountability as outlined in the FTC's bipartisan 2012 landmark
Privacy Report.\4\ Further, as someone who has also focused on the
intersection of antitrust and privacy law, and the impact of regulation
of market competition, I urge that a federal approach be technology-
neutral and avoid unduly burdening smaller entities, innovative
services, or certain entities in the Internet ecosystem.
---------------------------------------------------------------------------
\4\ See Fed. Trade Comm'n, Protecting Consumer Privacy in an Era of
Rapid Change: Recommendations for Businesses and Policymakers (2012),
https://www.ftc.gov/sites/default/files/documents/reports/federal-
trade-commission-report-protecting-consumer-privacy-era-rapid-change-
recommendations/120326privacyreport.pdf.
---------------------------------------------------------------------------
Key Elements of an Effective Federal Framework
I strongly believe that Congress needs to enact Federal privacy
legislation that includes several key attributes. First, legislation
should provide a national and uniform set of protections and consumer
rights throughout our digital economy. Second, it should ensure strong
enforcement that protects consumer information that could result in
harm if disclosed or misused, while also allowing companies to provide
and develop innovative products and services that consumers want.
Third, it should provide consumers clarity and visibility into
companies' data collection, use, and sharing practices, as well as
easily understandable choices regarding these practices, calibrated to
the sensitivity of that data. Fourth, legislation should be more
comprehensive than current state laws, such as the CCPA, addressing
more elements of the data cycle. Fifth, Federal privacy legislation
should be enforced by the FTC, which has the experience and skill to
meaningfully enforce a new law's protections, supplemented by state
attorneys general (``AGs'').
1. Provide a national and uniform set of protections and consumer
rights
Federal legislation should be technology-neutral and apply to all
entities across the Internet ecosystem that collect, share, or make use
of consumer data, whether they are technology companies, broadband
providers, or retailers. What matters is not who collects the data, but
what data is collected, how sensitive it is, and how it is protected
and used.
Strong privacy protections need to apply to consumers regardless of
where in the United States they live, work, or happen to be accessing
information. By its very nature, the Internet connects individuals
across state lines. Data (and, increasingly, commerce) knows no state
boundaries. For this reason, a proliferation of different state privacy
requirements creates inconsistent and confusing privacy protections for
consumers, as well as significant compliance and operational challenges
for businesses of all sizes. Although privacy regulation is often
justified by concerns about big online players having large amounts of
consumer information, regulatory complexity actually works to favor
large, established companies.\5\ It also erects barriers to the kind of
innovation and investment that is a lifeblood of our Nation's economy
and to many beneficial and consumer-friendly uses of information.
---------------------------------------------------------------------------
\5\ See, e.g., Jian Jia, Ginger Zhe Jin, Liad Wagman, ``The Short-
Run Effects of GDPR on Technology Venture Investment'' (working paper,
National Bureau of Economic Research, November 2018), https://
www.nber.org/papers/w25248).
---------------------------------------------------------------------------
2. Protect consumer information that could result in harm if disclosed
or misused
A Federal privacy law should protect individuals' information, the
use or disclosure of which could result in harm. Accordingly, such
legislation should cover data that identifies an individual, whereas
data that does not identify an individual poses a minimal risk of harm
and need not be subject to the same requirements.
Sensitive personal information, such as health and financial
information, real-time precise geo-location information, social
security numbers, and children's information, poses the highest risk of
consumer harm and should be subject to the highest protections.\6\ In
turn, to mirror consumer expectations and preferences, there should be
less-stringent requirements on non-sensitive personally identifiable
information, reflecting the lower risk of consumer harm. Information
that is reasonably de-identified, aggregated, or publicly available
does not raise the same specter of harm and falls outside the scope of
necessary consumer protections.
---------------------------------------------------------------------------
\6\ These types of information reflect a general consensus, as
recognized in the FTC's 2012 report, supra note 4 at 58-59. Other types
of information may be sensitive, as reflected in consumer expectations.
---------------------------------------------------------------------------
3. Reflect consumer preferences through simple choices based on data
sensitivity
I believe that an optimal approach would balance ease of use and
transparency by giving consumers clear and simple privacy choices based
on the nature of the relevant information itself--its sensitivity and
the correlated risk of consumer harm if such information is the subject
of an unauthorized disclosure. A Federal privacy law should promote
consumer control and choice by imposing requirements for obtaining
meaningful consent based on the risks associated with different kinds
and uses of consumer data.
As I discussed earlier, sensitive data should be afforded stronger
protections under a Federal privacy law than non-sensitive personally
identifiable data and non-identifiable information. In line with this
concept, the most sensitive data should be subject to an opt-in consent
requirement, while other personally identifiable covered data would be
suitably protected by opt-out consent. Further, for certain types of
routine operational uses, such as order fulfillment, fraud prevention,
network management, and some forms of first-party marketing, consent
should be inferred, consistent with consumer expectations.
4. Legislation should be more comprehensive than current state laws
Federal privacy legislation should address gaps and shortcomings of
current privacy laws. A strong Federal privacy law should build on
elements of current efforts in California, Virginia, and Colorado, and
include safeguards protecting uses of consumer data throughout the
United States.
5. Ensure strong accountability and enforcement that best protects
consumer interests
The Members of this Committee recognize that Congress must develop
a law that guarantees strong privacy rights to consumers and adopts
best practices from state laws, while creating uniformity across the
Nation. But preempting state laws should not mean weakening protections
for consumers. A Federal privacy law needs to be a strong one. I
believe that states, as well as the FTC, have a critical role to play
in protecting and enforcing those rights.
The FTC should have the primary authority to enforce a national
privacy law. The FTC is already protecting consumer privacy, making it
experienced and knowledgeable in the field. Moreover, it is well-
equipped to assess the interaction between competition and privacy law
in the United States. Congress should make use of these existing
strengths, rather than start from scratch with a newly-formed, and
inexperienced, agency.
Federal privacy legislation should support strong enforcement by
the FTC, allowing the agency to obtain meaningful results. Rather than
being limited to violations of previous orders, the FTC needs to be
able to fine companies for first-time violations of a new,
comprehensive privacy law to provide sufficient incentives for
companies to take the necessary steps to ensure responsible use and
protection of consumer data.
However, as I discussed earlier, as privacy concerns become
weightier and more complex, the FTC is reaching the limits of its
current tools--which it has made clear in its statements, including
those made before the Committee.\7\ Congress must provide the FTC with
greater statutory clarity coupled with more resources to protect
consumer privacy in America.
---------------------------------------------------------------------------
\7\ See, e.g., Fed. Trade Comm'n, FTC Report on Resources Used and
Needed for Protecting Consumer Privacy and Security (2020), https://
www.ftc.gov/system/files/documents/reports/reports-response-senate-
appropriations-committee-report-116-111-ftcs-use-its-authorities-
resources/p065404reportresourcesprivacydatasecurity.pdf; Oversight of
the Federal Trade Commission, supra note 1 at (``Section 5, which we
use to bring our general privacy and data security cases, is not
without its limitations.'').
---------------------------------------------------------------------------
Despite the ever-growing need for privacy enforcement, the FTC's
budget has been flat since 2013. The number of full-time employees lags
behind where it was in the early 1980s and comparable bodies tasked
with data protection.\8\ Meanwhile, the Internet and the collection,
use, and sharing of consumer data have grown enormously. I urge
Congress to address that widening gap to meaningfully support an issue
as important and complicated as consumer privacy.
---------------------------------------------------------------------------
\8\ Id. at 2-3.
---------------------------------------------------------------------------
I recognize that state AGs are critical allies in the realm of
consumer protection. They should be given the power to enforce any new
Federal law, taking on violations that the FTC is yet to investigate or
that have a particular impact in their respective state. By working in
unison, the FTC and state AGs can create an efficient process that
reduces duplicative matters and supports consistency for all consumers.
A Federal privacy law, though, should not include private rights of
action with statutory or punitive damages. These approaches often
result in class actions that primarily benefit attorneys, while
providing little, if any, relief to those who are harmed. Private
rights of action may also lead to abuses, such as frivolous assertions
and attempts to seek ``nuisance fee'' settlements. This results in the
diversion of company resources from compliance to litigation, which
ultimately does not help consumers who, at the end of the day, simply
want companies to follow the law. Like state law preemption, trusting
enforcement to the FTC and state AGs fosters consistency, and is
ultimately more beneficial to consumers.
Providing the FTC and state AGs with clear privacy protections,
backed up with strong enforcement authority and expanded resources,
represents a highly beneficial approach for consumers, as evidenced by
the successful and bipartisan work in policing violations of children's
privacy through the Children's Online Privacy Protection Act. Providing
the FTC with enhanced authority to facilitate consumer redress for
privacy violations would also ensure that consumers can be compensated
directly and promptly when companies engage in harmful data practices.
Conclusion
Thank you again for the opportunity to testify today. I look
forward to working with all Members of the Committee and all
stakeholders in crafting strong national privacy legislation.
The Chairwoman. Thank you very much, Ms. Ohlhausen. Now we
are going to hear remotely from Mr. Ashkan Soltani, Independent
Researcher and Technologist, former Chief of the Federal Trade
Commission.
STATEMENT OF ASHKAN SOLTANI, INDEPENDENT
RESEARCHER AND TECHNOLOGIST; FORMER
CHIEF TECHNOLOGIST, FEDERAL TRADE COMMISSION
Mr. Soltani. Hello there. Can you hear me alright?
The Chairwoman. Yes.
Mr. Soltani. Perfect. Chair Cantwell, Ranking Member
Wicker, and members of this committee, thank you for inviting
me to appear today. My name is Ashkan Soltani. I am a
researcher and technologist, formerly Chief Technologist at the
FTC. Since departing FTC, I have helped support State level
privacy and tech enforcement, both as an expert and through my
involvement through Georgetown law, where I am a distinguished
fellow at the Institute of Law and Policy and the Center of
Privacy and Technology.
I also helped author California's landmark privacy laws,
the CCPA and the CPRA, Prop 24 which California voters
enthusiastically passed last year. I have seen firsthand the
challenges of crafting and enforcing laws that constrain bad
behavior in the current digital ecosystem. I am pleased to be
invited as Congress and this committee are considering
significant changes to the structure and funding of the FTC.
The proposal to create and fund a new bureau at the FTC is a
strong step forward and providing the Commission with the
resources it needs desperately to effectively protect consumers
in the digital economy.
A new bureau focused on technology and data protection
would help the FTC support its mission of policing unfair and
deceptive trade practices related to privacy, data security,
identity theft, and data abuses. I have submitted my written
testimony for the record, but I would like to highlight three
key points which I hope will inform the discussion today. One
is that the FTC is critically under-resourced to oversee the
Nation's myriad of privacy and cybersecurity issues. With a
bare bones staff of about 40 attorneys and a handful of
technologists, their researchers pale in contrast to their
counterparts in other countries.
The German DPA, for example, has 745 staff and nearly 100
tech experts enforcing their laws for a country one-quarter of
the population in the US. Similarly, France, which has one-
fifth of our population employs nearly 200 staff, including 30
tech experts. The research problem is exasperated when
businesses choose to litigate a case rather than accept a
settlement. By some accounts, litigation can occupy one-third
to one-half of the Commission's entire privacy division on a
single matter. That is the entire Federal--that is half of the
entire Federal privacy staff working on one case for years at
the exclusion of other critical work.
Similarly, the FTC Bureau of Enforcement is tasked with
overseeing compliance with all of the hundreds of FTC consent
decrees, in addition to a myriad of obscure laws relating to,
for example, Made in the USA and textile labeling. The same
lawyers who ensure that social media companies have robust
privacy and data security programs are also making sure the
labels on bed linens are correct. In fact, many of the big tech
companies which this Congress is presently concerned with, such
as Facebook, Apple, Google and others, are already under a
consent decree with the Commission.
But the FTC has limited resources to adequately monitor
that these firms are complying with the terms of their order.
One former FTC enforcement staff has publicly stated the FTC
rarely even reads the third party assessments provided to it.
Additionally, the FTC doesn't need just more resources. It
needs the right resources. Technology and data provides--
pervades nearly every aspect of today's online marketplace.
Data security, data abuse, identity theft all have one thing in
common, technology and the underlying data they rely on.
Narrowly constraining the new bureau to solve only one of
those problems, privacy, would fall short of the consumer
protection goals laid out by FTC and this Congress. I suggest
instead Congress support the creation of the Bureau of
Technology and Data Protection. This may seem like a small
point, but names do matter. As I said before, most harms don't
concern just privacy but data, data abuse. I have long
advocated for the creation of a new Bureau of Technology with
the mission and expertise to investigate harmful practices
across the technology ecosystem.
This new bureau would provide a hub of resources that would
serve across the agency's many consumer protection missions,
incentivize collaborations, and encourage efficiency, similar
to how BE functions across division. Alongside the funding,
Congress should take steps to ensure that the Commission hires
a wide range of staff to this bureau outside of just
traditional lawyers, economists, and even technologists like
myself. Importantly, the agency should hire statisticians, UX
designers, social scientists, and behavioral researchers such
as experts in child development who can guide the complex cases
that come before them across a myriad of technology issues,
such as dark patterns, and manipulative design, and algorithmic
discrimination.
Finally, in addition to more resources, I support my
panelist's call that the FTC needs additional legal authority
to meet the challenges of the digital economy. By expanding the
Commission's budget is a great first step, this Congress should
complement that funding with additional privacy authority so
that the agency can fulfill its mission. This is why it is
critical that this Congress pass Federal privacy legislation
that builds upon but does not preempt privacy legislation
adopted in states like California and Colorado.
I am happy to go into what attributes of such legislation
should look like, but based on my experience in California, the
most critical is the ability to allow experimentation in the
states as we seek to find the appropriate approach to the
complexities of the digital ecosystem. Thank you for the
opportunity to testify today. I am excited to work with you all
on helping to solve these challenges.
[The prepared statement of Mr. Soltani follows:]
Prepared Statement of Ashkan Soltani, Independent Researcher and
Technologist; Former Chief Technologist, Federal Trade Commission
Dear Chair Cantwell, Ranking Member Wicker, and Members of the
Committee:
Thank you for inviting me here today to testify before you. My name
is Ashkan Soltani. I am a researcher and technologist, and formerly
served as the Chief Technologist at the Federal Trade Commission (FTC
or Commission).
Since departing the FTC, I've helped support state-level privacy
and tech enforcement, both directly as an expert, and through my
involvement with Georgetown Law, where I am a Distinguished Fellow at
both the Institute for Technology Law & Policy and the Center on
Privacy and Technology. I also helped author California's landmark
privacy laws, the California Consumer Privacy Act (CCPA) and the
California Privacy Rights Act (CPRA). I have seen firsthand the
challenges in bringing cases against technology companies and making
new laws to constrain bad behavior.
Today, I'd like to discuss why the FTC needs expanded authority to
handle data and technology matters, how to appropriately expand the
Commission's staff and talent pool, and why it is important that any
new bureau have a specific mandate to investigate new technologies and
harmful data practices that pervade the modern digital ecosystem.
Expanding FTC Authority
I'm pleased to be invited as Congress and this Committee are
considering significant changes to the structure and funding of the
Federal Trade Commission. The proposal to create and fund a new bureau
at the FTC--which Chair Cantwell also called for in S. 2968, the
Consumer Privacy Rights Act--is a strong step forward towards providing
the Commission with the resources it needs to effectively protect
consumers in the digital economy. A new bureau focused on technology
and data protection would help the FTC support its mission of policing
unfair and deceptive practices related to privacy, data security,
identity theft, and data abuses. I strongly support it.
First and foremost, in addition to more resources, the agency
desperately needs additional legal authority to meet the new challenges
of the digital economy. With the exception of a few sectoral laws, such
as the Children's Online Privacy Protection Act (COPPA) or the Fair
Credit Reporting Act (FCRA) there is no comprehensive Federal privacy
regime in the United States. We're long overdue for a change.
Many of the digital harms from the surveillance economy are
monitored through the FTC's enforcement of deceptive practices under
Section 5 of the FTC Act. But this framework does not effectively
protect consumers. For example, consumers often don't directly interact
with the hundreds of data brokers that surreptitiously collect their
data as they move about their digital lives. This ecosystem makes the
required ``notice'' component of a deception case difficult to prove.
Unfairness authority is hard to use to enforce privacy harms, since the
courts have not typically recognized privacy harms as cognizable
injuries under FTC unfairness standards. Moreover, the FTC lacks the
authority to issue civil penalties for first-time violations.
While expanding the Commission's budget is a great step, Congress
should complement that funding with additional privacy authority so the
agency can properly fulfill its mission. That's why it is critical that
Congress passes Federal privacy legislation that builds upon, but does
not preempt, privacy legislation adopted in states like California and
Colorado. Already, there has been a concerted effort in Congress and in
statehouses across the Nation to muddy the conversation and introduce
privacy bills that appear strong, but merely entrench the status quo of
privacy violations. Specifically, bills like the one adopted in
Virginia appear robust, but allow exploitative business practices to
continue unabated.
This legislation, drafted by industry and passed with little
debate, seeks to confuse the conversation and provide cover for deep-
pocketed groups to change the conversation from one about strong
protections for consumers to one about ``harmonizing'' protections. But
these bills represent a race to the bottom, and are often deeply
flawed. For instance, the Virginia bill includes problematic technical
definitions of personal information, which exclude nearly all of the ad
tech industry from its scope of opt-out. Under this law, it is not
clear that the state will allow consumers to opt out of cross-
contextual targeted advertising, the tracking of individuals across
unaffiliated websites and services. Any law passed by Congress should
build upon the work done by states that does protect their consumers,
and not preempt state laws that seek to provide additional protections
to those enacted by Congress.
Congress should give the Federal Trade Commission a legal mandate
to enforce privacy laws beyond those bad actions that are deceptive or
unfair. This is doubly true since--for certain historical reasons--the
Commission rarely initiates privacy cases under its unfairness
authority. The agency's existing authority to regulate privacy, in
practice, limits it to taking action only after a company has made an
explicit promise to consumers and then broken that promise. This is
well short of the robust protections necessary to ensure the privacy
and security of consumers' data.
Strong FTC enforcement authority, such as measures proposed by many
members of this Committee, is essential, as are the provisions granting
the state attorneys general and private consumers the authority to
bring suit. Together, they would enable the Commission to undertake a
robust enforcement regime, and empower consumers and state law
enforcement to step in when the Commission cannot or will not do so.
Expanding FTC Capacity
The Agency Currently Has Few Privacy Staffers
Expanding the agency's capacity to enforce the law is also
critical. Laws alone without enforcement don't protect the public.
Presently, the Commission's Division of Privacy and Identity Protection
(DPIP) is tasked with solving the Nation's myriad privacy and
cybersecurity issues with a bare-bones staff of about 40 attorneys and
a handful of technologists. In comparison, European countries have
robust laws, such as the General Data Protection Regulation (GDPR).
Each country typically has a Data Protection Agency (DPA) with hundreds
of staff and dozens, if not hundreds of technologists. For example, the
German DPA has 745 staff and nearly 100 tech experts enforcing their
law for a country with one quarter the population of the United
States.\1\ Similarly, France, which has one-fifth our population,
employs nearly 200 staff, including 30 tech experts. The nations that
employ the most technologists have had the most success in bringing
corrective actions against big technology companies.\2\
---------------------------------------------------------------------------
\1\ Irish Council for Civil Liberties, Europe's Enforcement
Paralysis 10 (2021), https://www.iccl.ie/wp-content/uploads/2021/09/
Europes-enforcement-paralysis-2021-ICCL-report-on-GDPR-enforcement.pdf.
\2\ Id. at 7 (noting that Germany has taken 16 and France 19
corrective actions versus two or three actions taken on average by
every other member state).
---------------------------------------------------------------------------
The FTC, with its 40 staff and fewer than 10 technologists, simply
does not have enough resources to police an industry that touches
nearly every aspect of the American economy. This leads the agency to
prioritize certain cases, and ignore privacy violations if they aren't
deemed sufficiently harmful or easy to prosecute, or if the staff hours
aren't available. If staff are already engaged in one privacy or
security matter, they may simply ignore harmful acts that arise while
they are occupied.
The problem is exacerbated when businesses choose to litigate a
case rather than accept a settlement. By some accounts, these cases can
occupy one-third to half of the Commission's entire privacy division on
a single matter. Again, that's half of the entire Federal privacy staff
working on one case for years, at the exclusion of other critical work.
Businesses and their lawyers know and exploit this: in my experience,
when outside counsel knows that the Commission has its hands full with
litigation, they recommend that their clients take aggressive stances
in response to FTC action, knowing that the FTC is unlikely to have the
resources to adequately challenge them. Companies seek this expert
knowledge, and hire former FTC officials to advise them on how to best
avoid regulatory and enforcement scrutiny. Overworked commission staff
have a hard time making up for this level of deliberate gamesmanship,
and businesses' strategies to avoid FTC enforcement are quite
successful.
The FTC Has Limited Enforcement Staff to Monitor Compliance
The FTC also does not have enough enforcement staff to monitor
compliance with their orders. The Division of Enforcement--which is
separate from DPIP, which investigates privacy violations--is tasked
with overseeing compliance with all of the Commission's consent
decrees, in addition to the myriad of laws relating to Made In USA and
textile labeling, for example.\3\ The same lawyers who ensure that
social media companies have robust privacy and data security programs
are making sure labels on bed linens are correct. Technology
enforcement requires its own nuanced set of skills, and the FTC needs
both numbers and staff with special knowledge. Current enforcement
staff have varying skill sets, and while they may be generalists, they
may well not understand algorithms, APIs, or data encryption.
---------------------------------------------------------------------------
\3\ Federal Trade Commission, What We Do, https://www.ftc.gov/
about-ftc/what-we-do/enforcement-authority.
---------------------------------------------------------------------------
The Commission needs not only enough staff to monitor compliance
with their orders, it needs that staff to have the expertise to
understand the complex technological principles the initial violation
was based on. Presently, the staff who investigate and bring a matter
are not the ones who handle enforcement of consent decrees for those
matters. The staff disconnect often results in a huge gap in expertise
and understanding regarding what underlying privacy violations
occurred. Ideally, the Commission should have enough staff to leverage
the expertise of the initial investigators as part of the enforcement
oversight process.
In fact, many of the ``Big Tech'' companies with which Congress is
presently concerned--such as Facebook, Apple, Google, and others--are
already under consent decree with the Commission. The companies have
already taken some action that has landed them--essentially--under
probation with the Commission, and have agreed to a set of negotiated
terms with the agency. While this appears reasonable on paper, these
orders don't do much to curb problematic practices: staff limitations
at the agency mean that enforcement is lax or non-existent. For
instance, one common enforcement tool is to require companies to submit
regular third-party assessments of their data practices. These third-
party assessments can provide the Commission insight into ongoing
compliance by the company. But these assessments are only made
available to the FTC upon request, and the Commission staff rarely has
time to request them. In fact, one former FTC enforcement staff has
publicly stated that the FTC rarely even reads these assessments.\4\
---------------------------------------------------------------------------
\4\ Megan Gray, Understanding and Improving Privacy `Audits' Under
FTC Orders (2018), https://papers.ssrn.com/sol3/
papers.cfm?abstract_id=3165143.
---------------------------------------------------------------------------
Under the current arrangements at the FTC, it is quite possible--
even likely--that at least some of the companies under order are
violating the terms of their agreement but that the Commission doesn't
have the adequate resources to properly investigate.
The FTC Has Limited Technologists on Staff
In 2010, I was one of the first two technologists ever hired by the
Federal Trade Commission to work on privacy matters in DPIP. My
workload quickly went from handling small portions of matters to being
deeply involved in nearly every case brought by the Commission. I
personally helped to bring the Commission's first major successful
cases against Twitter, Google, and Facebook. I have firsthand
experience with how important technologists are to the effective
oversight of big technology companies.\5\
---------------------------------------------------------------------------
\5\ See also, Matt Burgess, How France Tamed Google, Wired (Aug. 2,
2021), https://www.wired.co.uk/article/google-france-fines (explaining
that the success of the major French antitrust case against Google was
due to the agency relying on technologists, rather than lawyers, to
build the case).
---------------------------------------------------------------------------
Despite this, the Commission only has a limited number of
technology experts on staff. When I re-joined the agency in 2014, as
Chief Technology Officer, there was only one other technologist on
staff. With the support of the then-Chair Ramirez, I helped to create
the Office of Technology Research and Investigation (OTech) and grew
that number of technologists to approximately ten by the end of my term
in 2016. But due to political pressures, these technologists were
housed not as a separate division that could serve the entire agency,
but instead in an obscure business unit within the IT staff of the
Bureau of Consumer Protection (BCP): the same group that maintains
eDiscovery computers and other litigation support resources for the
Commission. This awkward structure, which is in place to this day,
effectively restricts the team by limiting their ability to report to
key decision makers, and restricts them to functioning alongside the
same group that provides IT support to investigators, dramatically
reducing technologists influence across key investigations and
policymaking.
Additionally, staff technologists frequently recuse themselves from
active matters at the Commission due to the FTC's overly broad
interpretation of rules prohibiting technologists from ever working on
matters in which they participated during their employment at the
Commission. Because of the unique nature of technologists' work, this
same restriction does not apply to the attorneys or economists at the
Commission, effectively penalizing technologists who work for the FTC.
This overly broad provision intended to bar technologists from seeking
post-FTC employment at many private companies on the same matters also
prohibits them from working alongside the FTC in civil enforcement at
state agencies, including, as was my experience, for the offices of
state attorneys general.\6\
---------------------------------------------------------------------------
\6\ Lindsey Barrett, Laura Moy, Paul Ohm & Ashkan Soltani, Illusory
Conflicts: Post-Employment Clearance Procedures and the FTC's
Technological Expertise, 35 Berkeley Tech. L. J. 793 (2020), https://
papers.ssrn.com/sol3/papers.cfm?abstract_id=3895823.
---------------------------------------------------------------------------
Even in its hobbled structure, OTech was able to help support the
Commission's staff by providing trainings on emerging technology
issues, giving briefings on topics as varied as ``advertising industry
market dynamics, online manipulation, creepware apps, misuse of payment
data from web skimming, methods of detecting deepfakes and
authenticating original media, and using mobile phone data to inform
COVID-19 public health response,'' according to their budget
justification for 2022.\7\ Expanding the role and influence of this
group will greatly aid consumer protection efforts by the Commission on
key topics of interest to Congress
---------------------------------------------------------------------------
\7\ Federal Trade Commission, Congressional Budget Justification
Fiscal Year 2022 at 63. https://www.ftc.gov/system/files/documents/
reports/fy-2022-congressional-budget-justification/fy22cbj.pdf.
---------------------------------------------------------------------------
Creating a New FTC Bureau
Incentivizing Collaboration and Efficiency at the FTC
Providing additional resources to the FTC is an essential first
step to empowering the Commission to pursue strong technology
enforcement. A new bureau, funded fully, will ensure that the
Commission can fulfill its mission, and I support the measure. However,
it is essential that the creation of a new bureau enables the
Commission to collaborate and leverage its resources to investigate
fully the wide range of harms caused by new technology and data
practices.
To ensure that funding and additional resources are most effective,
Congress should make clear that collaboration between all of the
bureaus is an important goal of its funding. Too often, the bureaus at
the FTC work in isolation, creating silos that fail to maximize the
expertise throughout the Commission. For example, BCP houses the
Division of Marketing Practices (which investigates fraud), the
Division of Advertising Practices (investigating influencers and major
advertising practices), and the Division of Privacy and Identity
Protection (investigating privacy and identity theft). These three
divisions often look into the same entities for related matters, but do
not often collaborate across the divisions.
Under this structure, cases that deal with financial practices
issues in one division could miss the digital harms that pervade the
business practices at issue. Fortunately, there appears to have been
cross-division collaboration in a recent Financial Practices case:
Venmo--likely due to technology staff who are better able to move
between these boundaries. But in my experience, cross-division
collaboration is unfortunately not the norm which creates
inefficiencies and challenges when investigating fast-moving and well
resourced industry players.
Technology and Data Protection: A New Bureau By Any Other Name
One way to incentivize collaboration and forward-looking
enforcement is to appropriately scope any new bureau to reflect the
underlying needs of the current digital ecosystem. Data security, data
abuse, and identity theft all have one thing in common: technology and
the underlying data they rely on. Narrowly constraining a new bureau on
solely one of those practices, privacy, and giving it a name that
reflects that narrow focus, would fall short of the consumer protection
goals laid out for the FTC and by Congress. Instead, the bureau's
mission and name should reflect the realities of current challenges:
The Bureau of Technology and Data Protection.
This may seem like a small point, but names do matter. Many of the
harms that concern this Committee and are investigated by the
Commission do not fall neatly into the category of ``privacy'' harms.
Instead, many are abuses of personal data, harms to civil rights or
liberties, abuses of kids' data that fall outside of COPPA, and the
intentional design and release of harmful products.\8\ Data firms often
innovate new ways to track or identify users without consent, and
cannot easily be cabined by a singular focus on ``privacy.'' \9\ Other
harms, such as algorithmic bias or hyper-targeted news feeds and
recommendation algorithms, also do not fit neatly into ``privacy'' as a
category. A new bureau should be empowered to investigate these data
practices: their disproportionate effects on minorities and other
vulnerable populations, are often what harm consumers the most, and
often do not fall squarely into ``privacy.''
---------------------------------------------------------------------------
\8\ K.G. Orphanides, Children's YouTube Is Still Churning Out
Blood, Suicide and Cannibalism, Wired (Mar. 23, 2018), https://
www.wired.co.uk/article/youtube-for-kids-videos-problems-algorithm-
recommend.
\9\ See, e.g., Geoffrey A. Hunter & Tatum Fowler, When You `Ask App
Not to Track,' Some iPhone Apps Keep Snooping Anyway, Wash. Post (Sept.
23, 2021), https://www.washington
post.com/technology/2021/09/23/iphone-tracking/.
---------------------------------------------------------------------------
I have long advocated for the creation of a new Bureau of
Technology and Data Protection, because technology and data pervades
nearly every case that comes before the Commission. Congress should
create a bureau with the mission and expertise to investigate harmful
practices across the technology ecosystem and support the existing
divisions--like the Division of Privacy and Identity Protection, Ad
Practices, and Marketing Practices--in order to better protect
vulnerable populations. This Bureau of Technology and Data Protection
could issue guidance to staff about how to approach technology in
matters and could support investigations across the entire range of
digital harms the commission addresses.
A Bureau of Technology and Data Protection would provide a ``hub''
of resources for the Commission that would serve across the agency's
many consumer protection missions, incentivize collaboration across
agency divisions, and encourage efficiency. The Commission could look
to the Bureau of Economics (BE) as a model. Similarly to BE, the new
bureau should perform research and investigations to help support the
Commission's mission. The new bureau can also function as a community
of practice and expertise within the Commission that informs other
divisions and the FTC as a whole. When necessary, employees of the new
bureau, including technologists and other experts, could be detailed to
other bureaus or groups to support ongoing matters that may benefit
from their expertise. These meaningful opportunities for collaboration
and education will create a more robust culture within the FTC, and
help draw talent.
The FTC needs more resources, but it also needs the right
resources. Narrowly focusing the bureau's expertise on ``privacy,''
rather than a broader mission of data practices generally, would create
structural limitations that will live on in the Commission for years to
come.
Recommendations
I'd like to briefly lay out a few concrete recommendations for this
Committee to consider as it moves forward on privacy legislation,
either in this current legislation or later.
First, this Committee should focus on the outcomes it seeks to
enable, rather than becoming entangled in the details of agency
organization. While additional resources and bureaus are important, it
is important to implement change in ways that avoid bureaucratic
siloing or creating divisions between staff at the agency that may well
be counterproductive to ensuring a strong privacy enforcement regime.
Instead, the Committee should focus on creating incentives and
resources for the agency to hire experts and seek collaborative
solutions to continuing market problems.
For instance, many of the most pressing harms this Committee is
concerned with, such as the psychological harms caused to teens by
social media,\10\ do not fit cleanly into existing privacy enforcement
tools. The Committee should seek to enable the Commission to seek
remedies for digital conduct that causes harm, even when the practice
doesn't fall neatly under deceptive or unfair practices. Additional
enforcement authorities, such as enabling the Commission to protect
against negligent design or abusive business practices, would go a long
way to protecting consumers in the digital age.
---------------------------------------------------------------------------
\10\ Georgia Wells, Jeff Horowitz & Deepa Seetharaman, Facebook
Knows Instagram Is Toxic for Teen Girls, Company Documents Show, Wall
St. J. (Sept. 14, 2021), https://www.wsj.com/articles/facebook-knows-
instagram-is-toxic-for-teen-girls-company-documents-show-11631620739.
---------------------------------------------------------------------------
This Committee could address these harms by providing guidance to
the Commission with the funding of this Bureau. For instance, by
directing the Commission to conduct a rulemaking to reduce the
instances of identity theft or ransomware attacks online, to increase
safeguards around extractive data practices (such as microtargeting),
or to protect populations that are particularly vulnerable online, such
as communities of color, the LGBTQ+ community, women, and children.
Similarly, the Committee could greatly reduce the burden on
consumers by directing the FTC, as Senator Blumenthal already has,\11\
to adopt a Global Privacy Control (GPC) as a legally adequate opt-out
mechanism.
---------------------------------------------------------------------------
\11\ Letter from Senator Blumenthal, Senator, to FTC Chair Lina
Khan (Sept. 20, 2021), https://www.blumenthal.senate.gov/imo/media/doc/
2021.09.20%20-%20FTC%20-%20Privacy%
20Rulemaking.pdf.
---------------------------------------------------------------------------
Alongside additional funding and Congressional direction, the
Committee should take steps to ensure that the Commission hires a wide
range of staff outside its traditional lawyers, economists, and
technologists. In addition to those professionals, the agency should
hire statisticians, designers, social scientists and behavioral
researchers, such as experts on child development, who can guide
complex cases that come before them. These experts would allow the FTC
to review product documents at their earliest stages, understand
complex project calculations, and identify manipulative designs.
Additional expertise will also help the agency identify the current
business practices and apps might contravene existing Section 5
authority and empower the agency to more fully use its existing
enforcement tools.
Further, the Commission should devote more energy to developing and
retaining its talent outside the traditional Washington, DC pool. It
should take steps to hire talented individuals from across the country,
not just Washington. The pandemic showed that remote work is possible,
and in many circumstances desirable; hiring nationwide, to remote
positions, and in the regional offices, would better enable the
Commission to compete for talent with the firms it oversees.
Once the Commission has talent in the door, it needs to do a better
job of retaining it. Technologists' pay should be raised to be more
competitive with technology salaries, which are often many times higher
than what the Commission offers. Technologists also need to be able to
complete meaningful and engaging work at the Commission without worry
that the FTC's obtuse conflicts rules will prevent them from seeking
future employment later in their careers. Congress should seek answers
from the FTC about how the Commission will clarify and update its
conflict rules in order to better attract technologist talent.\12\
---------------------------------------------------------------------------
\12\ Lindsey Barrett, Laura Moy, Paul Ohm & Ashkan Soltani,
Illusory Conflicts: Post-Employment Clearance Procedures and the FTC's
Technological Expertise, 35 Berkeley Tech. L. J. 793, 826 (2020),
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3895823.
---------------------------------------------------------------------------
Conclusion
The creation of a new bureau at the Commission would be an
important step forward, but it is not the only important change that is
needed, and the work can't stop there. With a new bureau, the United
States will gain a stronger Federal Data Protection enforcer, which
will help allay concerns from Europe, and keep us competitive on a
global scale.
The new bureau needs not just money, however, but additional
substantive authority to investigate and curtail harmful data practices
and to rely on Commission resources. These necessary tools include
straightforward legislative fixes, such as providing the Commission
with first-time civil penalty authority. As the Committee continues to
pursue this matter, it should strongly prioritize drafting and passing
a comprehensive data privacy law that empowers Federal regulators,
including the FTC.
Congress should consider meaningful protections for consumers,
including strengthening the Commission, ensuring the attraction and
retention of talented Federal staff, and ensuring that there are robust
laws on the books to protect American consumers.
______
Illusory Conflicts: Post-Employment Clearance Procedures and the FTC's
Technological Expertise
---------------------------------------------------------------------------
DOI: https://doi.org/10.15779/Z38901ZG6Z
\\ 2020 Lindsey Barrett, Laura Moy, Paul Ohm & Ashkan
Soltani.
---------------------------------------------------------------------------
Lindsey Barrett, Laura
Moy, Paul
Ohm & Ashkan Soltani=
---------------------------------------------------------------------------
\\ Adjunct Professor of Law and Fritz Family Fellow,
Georgetown University Law Center.
\\ Associate Professor of Law and Director of the
Communications & Technology Law Clinic, Georgetown University Law
Center.
\\ Professor of Law and Associate Dean,
Georgetown University Law Center. From 2012-13, Professor Ohm served as
a Senior Policy Advisor for Privacy in the FTC's Office of Policy
Planning.
\=\ Distinguished Fellow, Institute for Technology Law & Policy and
Center on Privacy & Technology at Georgetown University Law Center.
From 2010-11, Mr. Soltani served as a staff technologist for the
Division of Privacy and Identity Protection at the FTC. And from 2014-
16, Mr. Soltani was appointed as the Chief Technologist of the FTC,
wherein he helped in creating the Office of Technology Research and
Investigation in order to expand the FTC's roster of technologists. The
authors are grateful to Harsimar Dhanoa and Jeffrey Brown for excellent
research assistance. They are also grateful to Chris Hoofnagle, Jessica
Rich, and David Vladeck for helpful comments.
---------------------------------------------------------------------------
Abstract
The Federal government restricts what former employees can work on
after they leave the government, and for good reason. These post-
employment conflict restrictions attempt to address the ``revolving
door'' problem, where employees take information learned from their
position in government to unfairly advantage industry. But an
unintended consequence of overbroad conflict rules is that they impede
well-meaning, former Federal employees from providing their knowledge
and general expertise to other enforcement agencies with similar
missions, such as those at the state level. This is playing out right
now with FTC technologists, at a time when the agency--and, indeed,
consumer protection agencies more broadly--desperately needs greater
technical expertise. Three problems result: (1) former FTC
technologists find themselves unable to contribute to the enforcement
efforts of other agencies and plaintiffs' attorneys aligned with the
mission of the FTC, (2) some current FTC technologists are unwilling to
work on important issues before the agency out of fear that doing so
will limit their ability to work on related matters in the future, and
(3) would-be technologists may be unwilling to take a position at the
agency due to these concerns.
We explore the impact of Federal conflict rules on technologists
working with the FTC, consider how this impact has changed alongside
changing circumstances and enforcement practices, and discuss policy
implications. We conclude that unless the FTC reforms the way it
administers its conflict rules, it risks losing the assistance of
technological expertise--expertise of which it badly needs more, rather
than less.
Table of Contents
I. INTRODUCTION
II. FEDERAL POST-EMPLOYMENT RESTRICTIONS
A. History and Goals of Federal Post-Employment Restrictions
B. Post-Employment Conflict of Interest Restrictions Under 18
U.S.C. Sec. 207
C. Post-Employment Conflict of Interest Restrictions Under FTC
Rules
III. POST-EMPLOYMENT RESTRICTIONS IN FTC PRACTICE TODAY
A. Impact of Post-Employment Restrictions on Technologists
B. Increased Market Consolidation
C. Technologists Act as Utility Players
D. Lengthy and Broad Consent Decrees
E. Risk-Averse Agency Culture
F. Possible Political Conflict Between FTC and State Attorneys
General
IV. IMPLICATIONS FOR AGENCY EFFICACY
V. POLICY RECOMMENDATIONS
VI. CONCLUSION
I. INTRODUCTION
The Federal Trade Commission's (FTC) laudable decade-long
experiment to hire in-house technologists may be in jeopardy from an
unexpectedly bureaucratic source: Federal conflict of interest law.
Post-employment restrictions for Federal employees are designed to
ensure that government officials avoid corruption and to slow the
revolving door into industry. In their current application to former
technologists, however, they have the counterproductive effect of
preventing people with technical expertise from engaging in work that
creates no meaningful conflicts.
Preventing technologists from accepting unproblematic post-
government work through the conflicts clearance process harms the
consumer protection and pro-competition missions of the agency.
Overbroad conflicts clearance policies harm the direct mission of the
agency by limiting the ability of experts to aid fellow enforcers such
as state attorneys general, who should be seen as force multipliers or
fellow travelers in policing technology companies. These policies also
make it more difficult for the FTC to hire and retain technological
experts, which hampers the agency's ability to adequately fulfill its
competition and consumer protection missions. Prospective technologists
think twice about working for the agency when they hear about the way
the clearance process has limited the activity of others. FTC employees
also limit the cases they can work on in order to avoid potential post-
employment conflicts.
This paper builds on the direct experience of two of the authors,
one a former Chief Technologist and the other a former Senior Policy
Advisor for privacy at the FTC. Since leaving the agency, we have
encountered numerous obstacles in our experience with the FTC's
clearance process, which we find to be unnecessarily broad in design
and perhaps also in execution. We have bolstered this firsthand
experience through interviews with numerous former FTC officials who
confirm and expand upon our observations.
We begin with an outline of our methodology. We interviewed eight
former FTC consumer protection attorneys and technologists and two
attorneys in the offices of state attorneys general in order to assess
the extent of the problem. The goal of the interviews was to determine
whether the experience of two of us being denied the ability to work on
certain matters post-FTC employment was representative, whether
technologists and other specialists were treated differently for the
purpose of conflicts, and whether there was any consensus as to why the
FTC was applying the conflicts rules the way it was and still is.
Preserving anonymity to allow our interviewees to discuss sensitive
topics was and is a key concern, given how few former technologists
there are and how easily certain details would reveal the identity of
the interviewees. For the reader's edification, we have tried to
provide as much context as possible without compromising the anonymity
of the interviewees, such as by highlighting when statements were
contradicted by other interviewees, not contradicted by any
interviewees, supported by interviewees, supported by only some
interviewees, or when they were supported indirectly. Indeed, the
difficulty of preserving the anonymity of our interviewees underscores
the very problem enumerated in this essay--there are simply too few FTC
technologists for the answers we describe here to allow each subject to
get lost in a crowd.
We focus on the FTC because that is the agency with which we have
direct experience, but the lessons of our analysis may also apply to
other government agencies seeking to hire and retain technological
experts, which ought to describe nearly every agency in this
technological age. The way an agency interprets the conflict of
interest laws and the way it administers its clearance procedures can
have an important, underappreciated impact on the way it fulfills its
mission--and the ability of other enforcers to fulfill theirs.
Part II of this Article explains why the Federal conflict rules
were created and how they affected current and former agency employees
at that time. Part III discusses how changes in technology, economy,
market, and agency practices have altered the impact of these conflict
rules on technologists working with the FTC. Part IV explores the
implications of this changing impact on agency efficacy and on the
FTC's ability to handle technical and other specialized subject
matters. Part V offers policy recommendations to address this problem
to help pave the way for the FTC and other Federal agencies to increase
their technical capacity, in part by hiring technical specialists.
II. FEDERAL POST-EMPLOYMENT RESTRICTIONS
Federal law restricts post-government employment opportunities for
all Federal government employees. The primary source of these
restrictions across the Federal government comes from one Federal
ethics statute, 18 U.S.C. Sec. 207. In addition to Sec. 207, former FTC
employees must comply with post-employment restrictions set forth in
the FTC Rules of Practice (i.e., 16 C.F.R. Sec. 4.1(b)). As a starting
point, it is helpful to understand more about the history, origin, and
intent of these restrictions, as well as what they do and who
interprets and enforces them.
A. History and Goals of Federal Post-Employment Restrictions
Both the Federal conflict statute and the FTC's conflict rules were
established in the 1960s.\1\ Legislative and administrative history
show that restrictions on where a former Federal employee may work and
what matters they may work on are intended to combat the ``revolving
door'' problem and to prevent both actual government corruption and the
appearance thereof.\2\ The rules are nevertheless intended to be
somewhat restrained, balancing the need to combat these problems with
the need to preserve the government's ability to attract and retain
top-notch expertise.\3\ Striking the right balance between these
competing objectives--preventing corruption and facilitating
expertise--is key to optimizing government function.
---------------------------------------------------------------------------
\1\ 18 U.S.C. Sec. 207 was established in 1962 alongside several
other Federal anti-corruption provisions. Act to Strengthen the
Criminal Laws Relating to Bribery, Graft, and Conflicts of Interest,
and for Other Purposes, ch. 11, Sec. Sec. 201-09, 218, 76 Stat. 1119-25
(1962). 116 C.F.R. Sec. 4.1(b) was established in 1967. Commercial
Practices, 32 Fed. Reg. 8444, 8456-59 (June 13, 1967).
\2\ See S. REP. NO. 95-170, at 32 (1977) (``18 USC 207, like other
conflict of interest statutes, seeks to avoid even the appearance of
public office being used for personal or private gain. In striving for
public confidence in the integrity of government, it is imperative to
remember that what appears to be true is often as important as what is
true. Thus government in its dealings must make every reasonable effort
to avoid even the appearance of conflict of interest and favoritism.''
(emphasis in original)).
\3\ See id. (``But, as with other desirable policies, it can be
pressed too far. Conflict of interest standards must be balanced with
the government's objective in attracting experienced and qualified
persons to public service. Both are important, and a conflicts policy
cannot focus on one to the detriment of the other. There can be no
doubt that overly stringent restrictions have a decidedly adverse
impact on the government's ability to attract and retain able and
experienced persons in Federal office.'').
---------------------------------------------------------------------------
The Federal statute designed to prevent actual and perceived
conflict by former Federal employees, Sec. 207, was developed on the
belief ``that a public servant owes undivided loyalty to the
Government.'' \4\ The statute addresses two primary ways in which
potential conflicts might occur. First, former Federal employees could
``switch sides'' upon leaving the government, going on to provide other
parties with an agency's proprietary information in an adversarial
proceeding, which would limit the agency's ability to protect the
public interest.\5\ Second, if Federal employees anticipate using their
Federal experience to help secure lucrative post-agency employment at a
regulated entity, they might temper their behavior while employed by
the agency.\6\ Lax rules for post-agency employment conflicts would
invite Federal employees to mold their conduct at the agency to make
themselves more appealing candidates for employment at a regulated
entity after leaving the agency. The legislative history and subsequent
cases interpreting the statute and rules also reflect a concern about
the appearance of conflict, in addition to actual conflicts, because
even the perception of corruption can erode public faith in the rule of
law.\7\
---------------------------------------------------------------------------
\4\ H.R. REP. NO. 87-145, at 3 (1961).
\5\ Id. at 4 (``[A]n official should be prohibited from resigning
his position and `switching sides' in a matter which was before him in
his official capacity.''); see also United States v. Nasser, 476 F.2d
1111, 1116 (7th Cir. 1973) (describing Sec. 207 restrictions as serving
to protect the government from use of agency information against the
government); Jack Maskell, Cong. Research Serv., Post-Employment,
``Revolving Door,'' Laws For Federal Personnel 1-2 (2014), https://
fas.org/sgp/crs/misc/R42728.pdf (``One of the initial and earliest
purposes of enacting the `revolving door' laws was to protect the
government against the use of proprietary information by former
employees who might use that information on behalf of a private party
in an adversarial type of proceeding or matter against the government,
to the potential detriment of the public interest.'').
\6\ Maskell, supra note 5, at 2 (``Another interest of the
government in revolving door restrictions was to limit the potential
influence and allure that a lucrative private arrangement, or the
prospect of such an arrangement, may have on a current Federal official
when dealing with prospective private clients or future employers while
still with the government, that is, `that the government employee not
be influenced in the performance of public duties by the thought of
later reaping a benefit from a private individual.' '') (quoting Brown
v. D.C. Bd. of Zoning Adjustment, 413 A.2d 1276, 1282 (D.C. App.
1980)).
\7\ Id.; see also Adam Samaha, Regulation for the Sake of
Appearance, 125 Harv. L. Rev. 1563, 1599 (2011) (discussing ethics
rules designed to facilitate public trust by diminishing the possible
appearance of corruption).
---------------------------------------------------------------------------
Federal post-employment restrictions also aim to avoid being overly
rigid. Overly rigid conflict rules might make it impossible to draw top
talent to agencies where employees with needed expertise could easily
find employment with other agencies or the private sector.\8\ Indeed,
in enacting and revisingSec. 207, Congress was acutely aware that
restrictive rules could hamstring the government's ability to attract
and retain technical experts. For example, in a 1960 House hearing on
Federal conflict of interest legislation, a representative of the
Department of Defense expressed concern that the proposed Sec. 207
``would greatly narrow the opportunity for [people who came to
government from private industry] to seek employment outside the
Government if they were precluded thereafter from rendering any
assistance to anyone in connection with any subject matter concerning
which they had any responsibility.'' \9\ The Defense Department
representative also pointed out that ``[w]e have had considerable
difficulty in recruiting engineers and scientists.'' \10\
---------------------------------------------------------------------------
\8\ MaskelL, supra note 5, at 2 (``These purposes in adopting
limitations on former employees' private employment opportunities must,
however, also be balanced against the deterrent effect that overly
restrictive provisions on career movement and advancement will have
upon recruiting qualified and competent persons to government
service.''); S. Rep. No. 95-170, at 32 (1977).
\9\ Federal Conflict of Interest Legislation: Hearing on H.R.
1900, H.R. 2156, H.R. 2157, H.R. 6556, and H.R. 10575 Before the H.R.
Antitrust Subcomm. of the Comm. on the Judiciary, 86th Cong. 144 (1960)
(statement of Stephen S. Jackson, Deputy Assistant Secretary of Defense
for Manpower, Personnel, and Reserve).
\10\ Id.
---------------------------------------------------------------------------
As Congress deliberated over the structure and wording of conflicts
restrictions in the year before passage of the bill that established
Sec. 207, President Kennedy sent a letter to Congress urging
accommodations for temporary, part-time, and technical experts:
The fundamental defect of [conflict] statutes as presently
written is that: On the one hand, they permit an astonishing
range of private interests and activities by public officials
which are wholly incompatible with the duties of public office;
on the other hand, they create wholly unnecessary obstacles to
recruiting qualified people for government service. This latter
deficiency is particularly serious in the case of consultants
and other temporary employees, and has been repeatedly
recognized by Congress in its enactment of special exemption
statutes. . .
But if the statutes often leave important areas unregulated,
they also often serve as a bar to securing important personal
services for the government through excessive regulation when
no ethical problem really exists. Fundamentally, this is
because the statutes fail to take into account the role in our
government of the part-time or intermittent adviser whose
counsel has become essential but who cannot afford to be
deprived of private benefits, or reasonably requested to
deprive themselves, in the way now required by these laws.
Wherever the government seeks the assistance of a highly
skilled technician, be he scientist, accountant, lawyer, or
economist, such problems are encountered.\11\
---------------------------------------------------------------------------
\11\ President's Special Message to the Congress on Conflict-of-
Interest Legislation and on Problems of Ethics in Government, 1961 Pub.
Papers 327-329 (Apr. 27, 1961).
The following decade, after the Watergate scandal, Congress passed
the Ethics in Government Act, which revised and crafted new post-
employment restrictions as part of a wave of reforms.\12\ Before the
new restrictions went into effect, however, a number of parties raised
concerns that the restrictions might interfere with the hiring of high-
caliber employees.\13\ In a report on the legislation, the Subcommittee
on Oversight and Investigations of the House Committee on Interstate
and Foreign Commerce explained that ethics restrictions should
``accommodate the need to attract and retain a qualified and
experienced work force.'' \14\ The report also stated that ``hearings
reflected the grave concern of agency heads'' that the ``balance
between maintaining integrity and ensuring an able workforce has not
been properly struck.'' \15\ For example, the Secretary of Health,
Education, and Welfare characterized the revisions as likely to cause
``the greatest brain drain of talent in the history of Federal
service.'' \16\ Recognizing the need to strike a balance between
preventing conflicts and attracting top talent, Congress ultimately
softened the new limitations before they went into effect.\17\
---------------------------------------------------------------------------
\12\ Sam Berger & Alex Tausanovitch, Ctr. for Am. Progress, Lessons
from Watergate: Preparing For Post-Trump Reforms 3-6 (2018), https://
cdn.americanprogress.org/ content/uploads/2018/07/27101947/
WatergateReformsReport-3.pdf (discussing the Ethics in Government Act
and other ``extensive'' post-Watergate government reforms). Among other
things, the 1978 Ethics in Government Act established ``a mechanism for
the appointment of an independent special prosecutor''; created the
Office of Government Ethics; and ``imposed the first mandatory
financial disclosures for members of Congress, candidates, and some
high-level Executive Branch officials.'' Id.
\13\ Staff of the Subcomm. on Oversight & Investigations of the H.
Comm. on Interstate & Foreign Commerce, 96th Cong., Cong. Rep. on
Impact of theEthics In Gov't Act 5 (Comm. Print 1979).
\14\ Id.
\15\ Id.
\16\ Id.
\17\ Office of Gov't Ethics, Report to the President and to
Congressional Committees on the Conflict of Interest Laws Relating to
Executive Branch Employment 14 (2006) (``Before these new restrictions
even became effective, Congress amended section 207 to lighten the new
restrictions, in response to expressions of concern about the expected
impact on recruitment and retention.'').
---------------------------------------------------------------------------
B. Post-Employment Conflict of Interest Restrictions Under 18 U.S.C.
Sec. 207
The Federal statute defining post-employment conflicts, Sec. 207,
is both a criminal and a civil statute; those who violate it could end
up in prison or be subject to a hefty civil penalty.\18\ The statute is
enforced by the Department of Justice (DOJ),\19\ but the Office of
Government Ethics (OGE) has regulatory authority to promulgate rules,
providing further details on the application of Sec. 207 beyond what is
provided in the statute.\20\ In addition, the FTC provides direct
guidance to former employees regarding Sec. 207.\21\ Under Sec. 207,
former Federal employees are not prohibited from taking a job with any
other potential employer but are prohibited from engaging in certain
activities.\22\ For former FTC employees, there are two types of
conduct prohibited under the Federal statute of which they should be
aware.
---------------------------------------------------------------------------
\18\ An offense can result in up to a year in prison, and a willful
offense can result in up to five years. 18 U.S.C. Sec. 216(a) (2018).
In addition, a person who violates Sec. 207 can be subject to a civil
penalty up to fifty-thousand dollars for each violation or the amount
of compensation which they received for the prohibited conduct,
whichever amount is greater. 18 U.S.C. Sec. 216(b).
\19\ Post-Employment Conflict of Interest Restrictions, 5 C.F.R.
Sec. 2641.103(a) (2020).
\20\ 5 C.F.R. Sec. 2638.108(a)(1).
\21\ See 5 C.F.R. Sec. 2641.105(a) (stating that ``[t]he agency in
which an individual formerly served has the primary responsibility to
provide oral or written advice concerning a former employee's post-
employment activities,'' including regarding Sec. 207). This is
consistent with our experience. Staff of the FTC's Office of General
Counsel have provided us with guidance and advice regarding the
application of Sec. 207 to post-employment activities that we have
inquired about.
\22\ 18 U.S.C. Sec. 207; see Office of Gov't Ethics, supra note 17,
at 11 (``None of its provisions bars any individual, regardless of rank
or position, from accepting employment with any private or public
employer after Government service. Section 207 only prohibits former
employees from engaging in certain activities on behalf of persons or
entities other than the United States, whether or not done for
compensation.'').
---------------------------------------------------------------------------
First, the Federal statute essentially prohibits a former Federal
employee from switching sides on a matter on which they previously
represented the Federal government.\23\ If a former FTC employee
communicates to, or appears before, the Federal government as a part of
their new job with the intent to influence ``in connection with a
particular matter. . .in which the person participated personally and
substantially'' as a Federal employee, that behavior constitutes a
violation.\24\ This prohibition lasts forever.
---------------------------------------------------------------------------
\23\ 18 U.S.C. Sec. 207; see Maskell, supra note 5, at 2-3; United
States v. Nasser, 476 F.2d 1111, 1116 (7th Cir. 1973) (holding in favor
of constitutionality of prohibition language).
\24\ 18 U.S.C. Sec. 207(a)(1). This only applies when the matter
also is one ``in which the United States or the District of Columbia is
a party or has a direct and substantial interest,'' and ``which
involved a specific party or specific parties at the time'' the former
employee worked on it. Id. Former Federal employees also cannot engage
in this variety of prohibited communications and/or appearances before
the District of Columbia. Id.
---------------------------------------------------------------------------
Second, even for a matter in which the former Federal employee did
not ``participate[] personally and substantially,'' Sec. 207 still
prohibits the person from working on it if the person ``knows or
reasonably should know [the matter] was actually pending under his or
her official responsibility . . . within a period of 1 year before the
termination'' of their employment.\25\ This restriction expires after
two years.\26\
---------------------------------------------------------------------------
\25\ 18 U.S.C. Sec. 207(a)(1)-(2).
\26\ Id. For a more fulsome explanation of the provisions of
Sec. 207, including restrictions not discussed here, see Maskell, supra
note 5, at 3-6.
---------------------------------------------------------------------------
In determining whether a former matter and a post-employment matter
are the same, OGE rules state that ``all relevant factors should be
considered, including the extent to which the matters involve the same
basic facts, the same or related parties, related issues, the same
confidential information, and the amount of time elapsed.'' \27\
---------------------------------------------------------------------------
\27\ 5 C.F.R. Sec. 2641.201(h)(5)(i).
---------------------------------------------------------------------------
Sec. 207(j) lays out a number of exceptions to these general
restrictions. For example, under this subsection, former employees are
exempted from certain post-employment restrictions to carry out
official duties as a Federal employee, state or local government
official, or representative of a higher education institution. One
exception that is particularly relevant to agency technologists is an
exception under several provisions of Sec. 207 for ``communications
[made] solely for the purpose of furnishing scientific or technological
information, if such communications are made under procedures
acceptable to the department or agency concerned.'' \28\
---------------------------------------------------------------------------
\28\ 18 U.S.C. Sec. 207(j)(5).
---------------------------------------------------------------------------
As noted above, Sec. 207 is enforced by the DOJ.\29\ Accordingly,
an agency where a former Federal employee served--such as the FTC--does
not have the authority to determine definitively how Sec. 207 applies
to a former employee, but the agency is responsible for providing
former employees with advice regarding the application of Sec. 207 to
post-employment activities.\30\ In determining whether and how to
pursue prosecution under Sec. 207, however, the DOJ may take into
account a former Federal employee's reliance on advice received from
the agency where they formerly served.\31\
---------------------------------------------------------------------------
\29\ 5 C.F.R. Sec. 2641.103(a).
\30\ 5 C.F.R. Sec. 2641.105(a).
\31\ 5 C.F.R. Sec. 2641.105(c).
---------------------------------------------------------------------------
C. Post-Employment Conflict of Interest Restrictions Under FTC Rules
The FTC's rules also restrict what matters a former employee can
work on after their employment with the FTC ends.\32\ Generally
speaking, the FTC's post-employment conflict rules prohibit former
employees from communicating to or appearing before the FTC and from
assisting or advising behind-the-scenes regarding certain
``proceeding[s] or investigation[s].'' \33\
---------------------------------------------------------------------------
\32\ 16 C.F.R. Sec. 4.1(b)(1) (2020).
\33\ Id.; see Post-Employment Restrictions, Fed. Trade Comm'n,
https://www.ftc.gov/about-ftc/bureaus-offices/office-general-counsel/
post-employment-restrictions (last visited Aug. 22, 2020).
---------------------------------------------------------------------------
Most relevant to former technologists is Sec. 4.1(b) of the FTC's
rules.\34\ After leaving the agency, a former employee generally cannot
work on a proceeding or investigation that is the same as one in which
they ``participated'' on behalf of the agency.\35\ A former employee
also cannot later work on a proceeding or investigation if they
received or saw ``nonpublic documents or information'' pertaining to it
while working for the agency.\36\ These restrictions are permanent, but
the FTC's rules also establish certain time-limited restrictions for
former employees.\37\
---------------------------------------------------------------------------
\34\ 16 C.F.R. Sec. 4.1(b).
\35\ Id.
\36\ Id.
\37\ Id. A former employee cannot work on a proceeding or
investigation that was pending under their official responsibility
within a year of when they left the agency. Id. This restriction lasts
for two years after an employee leaves the agency. Id. In addition, for
one year after leaving the agency, Commissioners and ``senior
employees'' cannot work on any proceeding or investigation before the
FTC. Id.
---------------------------------------------------------------------------
There is no bright-line rule that enables a former employee to
conclude with certainty that an activity in which they would like to
engage constitutes the same ``proceeding or investigation'' as one in
which they participated while employed by the FTC. According to a note
in the FTC's rules, ``a new `proceeding or investigation' may be
considered the same matter as a seemingly separate `proceeding or
investigation' that was pending during the former employee's tenure.''
\38\ In assessing this differentiation, ``the Commission . . .
consider[s]: the extent to which the matters involve the same or
related facts, issues, confidential information and parties; the time
elapsed; and the continuing existence of an important Federal
interest.'' \39\ These criteria are nearly identical to the criteria
considered by the OGE in determining whether a former matter and post-
employment matter are the same under Sec. 207.\40\
---------------------------------------------------------------------------
\38\ 16 C.F.R. Sec. 4.1(b)(1) n.1.
\39\ Id.
\40\ See 5 C.F.R. Sec. 2641.201(h)(5)(i).
---------------------------------------------------------------------------
The FTC's rules also set forth a formal process to help former
employees determine whether or not they are indeed restricted from
working on a matter in their non-FTC employment capacity.\41\ In
certain circumstances, a former employee is required to file a
``request for clearance'' to participate in a matter that is or was
before the FTC.\42\ If the former employee left the agency within the
previous three years, these circumstances include when the proceeding
or investigation was pending before the FTC while the former employee
was there, when the matter is the direct result of another proceeding
or investigation that was pending before the FTC while the former
employee was there, or when ``nonpublic documents or information''
pertaining to the matter were seen (or likely would have been seen) by
the former employee as part of their work for the FTC.\43\
---------------------------------------------------------------------------
\41\ See 16 C.F.R. Sec. 4.1(b)(2).
\42\ Id.
\43\ Id.
---------------------------------------------------------------------------
After a former employee files a clearance request, the FTC's Office
of the General Counsel (OGC), or designee, has ten business days to
respond by (1) granting the request, (2) stating that it recommends the
FTC deny the request, or (3) extending its consideration of the request
by up to ten additional business days.\44\ If a former employee is not
sure whether or not they need to file a clearance request, they can ask
the General Counsel for advice.\45\ The General Counsel or their
designee will provide advice within three business days.\46\
---------------------------------------------------------------------------
\44\ 16 C.F.R. Sec. 4.1(b)(7).
\45\ 16 C.F.R. Sec. 4.1(b)(6).
\46\ Id.
---------------------------------------------------------------------------
Significantly, the FTC's rules grant the agency the discretion to
simply decline to apply the rules to any specific set of circumstances.
In addition, the rules do not apply to post-employment activities that
would be covered if ``otherwise specifically authorized by the
Commission.'' \47\
---------------------------------------------------------------------------
\47\ 16 C.F.R. Sec. 4.1(b)(1).
---------------------------------------------------------------------------
While Sec. 207 is enforced by the DOJ, the FTC's post-employment
conflict of interest restrictions are applied and enforced only by the
FTC itself. To help current and former employees better understand the
rules, the FTC provides guidance on its website.\48\ The agency also
gives new employees an ethics guide. The guide states: ``if an FTC
matter was open during your [(i.e., former employee's)] time here, you
likely need to receive clearance before you work on it for a new
employer. If you worked on the matter while at the FTC or had access to
significant non-public FTC information about the matter, you are
unlikely to get clearance.'' \49\
---------------------------------------------------------------------------
\48\ Post-Employment Restrictions, supra note 33.
\49\ Fed. Trade Comm'n, Let's Talk Ethics: Ethics Orientation for
New Employees 7 (2019), https://www.ftc.gov/system/files/attachments/
office-general-counsel/ieo_for_new_ftc_em
ployees.pdf.
---------------------------------------------------------------------------
III. POST-EMPLOYMENT RESTRICTIONS IN FTC PRACTICE TODAY
As discussed above, post-government employment restrictions seek to
balance the need to combat the revolving door and corruption with the
need to preserve the government's ability to attract and retain top-
notch expertise. In the modern era, however, there is a greater need
than ever in government--and perhaps especially in the FTC--for highly-
skilled, technical expertise.\50\ As a result, these restrictions
appear to be off-balance with the FTC interpreting and applying post-
government restrictions aggressively to combat the revolving door and
corruption at the cost of attracting and retaining technical expertise.
This is particularly true as applied to conduct that supports the FTC's
objectives and doesn't implicate the corruption concerns that Sec. 207
was designed to address. A former FTC technologist seeking to consult
on a state attorney general investigation regarding consumer protection
matters is better described as entering an adjoining wing than availing
herself of a revolving door. Section III.A begins by identifying how
post-employment restrictions arguably are failing to facilitate hiring
and retention of skilled experts, specifically technologists. Why would
the FTC administer conflict rules more broadly than necessary to
advance the policy goals of preventing corruption and slowing the
revolving door? Sections III.B-F identify several possible
explanations, including increased market consolidation, the growing
role of technologists as utility players, the length and breadth of
consent decrees, the agency's risk-averse culture, and possible
political conflicts between the FTC and other enforcement agencies.
---------------------------------------------------------------------------
\50\ For a discussion by the former FTC Commissioner on enforcement
and oversight challenges created by rapidly changing technology and the
possibility that the FTC is failing to keep up, see generally Terrell
McSweeny, Psychographics, Predictive Analytics, Artificial
Intelligence, & Bots: Is the FTC Keeping Pace?, 2 Geo. L. Tech. L. Rev.
514 (2018).
---------------------------------------------------------------------------
A. Impact of Post-Employment Restrictions on Technologists
The FTC's application of post-employment restrictions today goes
beyond the policy goal of limiting corruption and the appearance of
corruption.\51\ The FTC may also apply post-government employment
restrictions too broadly in cases involving former employees who want
to work for the companies the FTC investigates, but we focus here
primarily on circumstances for which there are clear public policy
reasons to support a more permissive interpretation of post-employment
restrictions: requests to work for state attorneys general seeking to
investigate violations of law. In these cases, prohibiting former
technologists from contributing does not serve the Federal conflicts
provisions' goal of preventing employees from leaving the government
and ``switching sides.'' On the contrary, these other entities are best
characterized as being on the same side as the FTC, and their law
enforcement work is consonant with the consumer protection and pro-
competition missions of the FTC.
---------------------------------------------------------------------------
\51\ See Maskell, supra note 5, at 2.
---------------------------------------------------------------------------
As technologists and former FTC officials, two of us have
encountered firsthand the FTC's broad interpretation of post-employment
restrictions precluding us from contributing to valuable enforcement
work by other agencies and plaintiffs. In addition, we conducted
informal interviews of several other former FTC employees and
technologists in order to ascertain additional information and context
about how post-employment restrictions affect technologists.\52\
---------------------------------------------------------------------------
\52\ For a discussion of methodology, see supra Part I.
---------------------------------------------------------------------------
From these interviews, we heard consistent variations on a theme:
there was general consensus that the rules were overly broad, their
application opaque, and their impact felt acutely and
disproportionately by former technologists. While not everyone we spoke
to had sought clearances themselves, many were aware of the process
from colleagues. Several, however, had firsthand experience contacting
the FTC to seek advice and, ultimately, clearance regarding matters
they would like to work on that could be construed as related to
matters they had worked on while employed by the FTC.
In particular, former technologists--ourselves included--have often
been denied clearance by the FTC, under its own rules, to help others
investigate entities subject to FTC enforcement even after a
substantial period of time has passed. The crux of the problem is that
the FTC often considers a state attorney general's current
investigation regarding a major company to be the same ``proceeding or
investigation'' as one conducted by the FTC of the same company for
related practices--even if the FTC's investigation culminated in a
complaint that has already been settled with the company in
question.\53\ The FTC further appears to consider technologists to have
``participated personally and substantially'' in its investigations of
technology companies.\54\
---------------------------------------------------------------------------
\53\ 16 C.F.R. Sec. 4.1(b)(1)(i) (restricting post-employment
activities if ``[t]he former employee participated personally and
substantially on behalf of the Commission in the same proceeding or
investigation in which the employee now intends to participate''). As
discussed below, this problem likely is compounded by the fact that FTC
consent decrees typically last for twenty years. Infra Section III.D.
\54\ 16 C.F.R. Sec. 4.1(b)(1)(i). As discussed below, this problem
likely is compounded by the fact that FTC technologists are relied upon
as utility players. Infra Section III.C.
---------------------------------------------------------------------------
In other words, the FTC interprets its conflict rules as
prohibiting us from working on the ``same side'' as the FTC in
investigations that run parallel to the agency's mission. On at least
three occasions, we have sought clearance to provide technical guidance
to state attorneys general investigating the practices of major
technology companies. Two of these requests for clearance were denied
and the third took weeks to process. In fact, on one occasion, FTC
staff told one of us directly that, even though providing assistance to
a state attorney general would be working on the ``same side'' as the
FTC, this was ``irrelevant to the analysis'' under FTC rules.\55\
---------------------------------------------------------------------------
\55\ E-mail from Alternate Designated Agency Ethics Official,
Office of the General Counsel, Federal Trade Commission, to one of the
authors (Mar. 01, 2019, 08:00 EST) (on file with authors).
---------------------------------------------------------------------------
The conflicts rules are intended to prevent the appearance or
actual existence of conflicts between current employees and companies
the FTC oversees, not other enforcement entities.\56\ By making it
unduly difficult for former technologists to receive clearances, the
agency makes it less attractive for technologists to work there and
discourages those who do from working on certain cases, thus limiting
the agency's own efficacy. This problem is intensifying as
technological advancements increase the FTC's need for technical
expertise.\57\ In turn, this problem also makes other avenues in the
U.S. enforcement ecosystem less effective because it limits the access
of state attorneys general to qualified technology experts.
---------------------------------------------------------------------------
\56\ See MaskelL, supra note 5, at 2 (identifying the animating
goals of ``revolving door'' laws as ``protect[ing] the government
against the use of proprietary information by former employees who
might use that information on behalf of a private party in an
adversarial type of proceeding or matter against the government, to the
potential detriment of the public interest,'' ``limit[ing] the
potential influence and allure that a lucrative private arrangement, or
the prospect of such an arrangement, may have on a current Federal
official when dealing with prospective private clients or future
employers while still with the government,'' and ``prevent[ing] the
corrupting influence on the governmental processes of both legislating
and administering the law that may occur, and the appearances of such
influences, when a Federal official leaves his government post to `cash
in' on his `inside' knowledge and personal influence with those persons
remaining in the government.'') (emphasis added).
\57\ See generally McSweeny, supra note 50.
---------------------------------------------------------------------------
In addition to interpreting its own rules in this manner, the FTC
also appears to interpret Sec. 207 quite broadly. FTC staff have
advised us that activities we sought to assist alongside state
attorneys general could implicate Sec. 207 as constituting the same
matter as one in which we had participated at the FTC.\58\
---------------------------------------------------------------------------
\58\ 18 U.S.C. Sec. 207(a)(1)(A) (restricting post-employment
activities related to a particular matter ``in which the United States
or the District of Columbia is a party or has a direct and substantial
interest'').
---------------------------------------------------------------------------
The FTC's procedural approach to former employees' conflict
clearance inquiries raises additional problems. Based on our experience
and that of the people we interviewed, it seems the FTC's OGC routinely
denies clearance requests through an informal process completed over e-
mail. The OGC sometimes advises former employees to submit a formal
clearance request using a form designed for that purpose, but often
does not. This approach limits the transparency of the decision,
avenues for appeal, and rigor of the analysis.
B. Increased Market Consolidation
Increased market concentration and horizontal expansion in the
technology sector also contribute to the agency's broad application of
conflicts rules to technologists. In a diversified market, it can be
easy to tell that a former FTC employee's work investigating Company A
is not the same ``matter'' as, or is an unrelated ``proceeding or
investigation'' to, work involving Company B. But when Company A is at
the heart of both the prior investigation and the prospective work--
perhaps because Company A acquired ``nascent or potential competitor''
Company B to eliminate a threat to Company A's market--the potential
for conflict of interest may be higher.\59\
---------------------------------------------------------------------------
\59\ Press Release, Fed. Trade Comm'n, FTC to Examine Past
Acquisitions by Large Technology Companies (Feb. 11, 2020), https://
www.ftc.gov/news-events/press-releases/2020/02/ftc-examine-past-
acquisitions-large-technology-companies (describing current FTC
investigation of anti-competitive acquisitions by technology
companies).
---------------------------------------------------------------------------
There is no question that recent years have seen massive corporate
consolidation, both vertical and horizontal.\60\ The technology sector,
in particular, exhibits a steady trend toward greater
consolidation.\61\ For example, according to a recent report from the
Open Markets Institute, the three largest social networking sites
controlled eighty-five percent of the market in 2018, up from seventy-
five percent in 2012; the two largest search engines controlled ninety-
seven percent of the market in 2017, up from eighty-two percent in
2011; and the two largest e-commerce firms controlled fifty-six percent
of the market in 2018, up from forty-six percent in 2016.\62\
---------------------------------------------------------------------------
\60\ America's Concentration Crisis: An Open Markets Institute
Report, Open Mkts. Inst., https://
concentrationcrisis.openmarketsinstitute.org/ (last visited Aug, 22,
2020) (illustrating the wave of consolidation across a wide range of
industries over the past fifty years); Lina M. Kahn, The Ideological
Roots of America's Market Power Problem, 127 Yale L.J.F. 960, 964
(2018), http://www.yalelawjournal.org/forum/the-ideological-roots-of-
americas-market-power-problem (tracing the rise of concentration and
the ``cripple[ing]'' of antitrust enforcement); David Leonhardt, The
Monopolization of America, N.Y. Times (Nov. 25, 2018), https://www.ny
times.com/2018/11/25/opinion/monopolies-in-the-us.html (describing and
opining on the Open Markets dataset).
\61\ Lina M. Khan, Amazon's Antitrust Paradox, 126 Yale L.J. 710,
710 (2017) (criticizing consumer welfare as ill-adapted to measure
anti-competitive harms in the twenty-first century economy,
particularly online platforms); Frank Pasquale, When Antitrust Becomes
Pro-Trust: The Digital Deformation of U.S. Competition Policy, 2017 CPI
Antitrust Chron., May 2017, at 1, https://papers.ssrn.com/sol3/
papers.cfm?abstract_id=3020163 (analyzing the consolidation of the
technology sector and describing the failures of antitrust doctrine,
and the interpretation and application thereof by U.S. regulators, to
new trends).
\62\ America's Concentration Crisis, supra note 60. Although the
specific search engines controlling the largest market share have
changed between 2011 and 2017, the increase in the market share owned
by the two largest companies at that time nevertheless reflects market
consolidation.
---------------------------------------------------------------------------
In addition to greater consolidation in the technology sector, the
resultant diminished number of targets for enforcers to go after
overall has provided all enforcement agencies--including the FTC--clear
reasons to investigate the largest companies for violations of trade
practice law. Precisely because of their outsized market shares, large
companies that violate the law have the potential to cause substantial
injury to large numbers of consumers.\63\ And an enforcement agency
with limited resources will get the greatest ``bang for its buck''
going after companies with large numbers of users, substantial economic
clout, and a high public profile, rather than going after smaller
companies. Thus when the FTC announced its record five-billion-dollar
settlement with Facebook in 2019, the size of the company was relevant:
as the agency stated in its press release, ``[m]ore than 185 million
people in the United States and Canada use Facebook on a daily basis.''
\64\
---------------------------------------------------------------------------
\63\ When it violates the law, a company that has a billion users
has the potential to do greater harm than a company that has only a few
thousand users.
\64\ Press Release, Fed. Trade Comm'n, FTC Imposes $5 Billion
Penalty and Sweeping New Privacy Restrictions on Facebook (July 24,
2019), https://www.ftc.gov/news-events/press-releases/2019/07/ftc-
imposes-5-billion-penalty-sweeping-new-privacy-restrictions.
---------------------------------------------------------------------------
A review of recent enforcement actions reveals that the enforcement
efforts of the FTC and state attorneys general are indeed converging on
a handful of companies. For example, in the last two years alone,
Facebook has been both a target of the FTC and the subject of public
investigations by attorneys general in California,\65\ the District of
Columbia,\66\ Massachusetts,\67\ New York,\68\ and Washington,\69\ as
well as by a group of at least forty-seven state attorneys general
investigating Facebook for potential antitrust violations.\70\
Similarly, Google settled a complaint with the FTC in August 2019 but
has been publicly investigated in the past two years by Arizona,\71\
Connecticut and New York (in tandem),\72\ and fifty attorneys general
probing the company's competition practices.\73\
---------------------------------------------------------------------------
\65\ Cecilia Kang & David McCabe, California Sues Facebook for
Documents in Privacy Investigation, N.Y. Times (Nov. 6, 2019), https://
www.nytimes.com/2019/11/06/technology/face
book-california-investigation.html.
\66\ Matthew P. Denn & Amanda Fitzsimmons, District of Columbia v.
Facebook: General Consumer Protection Statute Can Serve as Vehicle for
State Attorney General Seeking Redress for Data Privacy Violations, DLA
Piper (June 12, 2019), https://www.dlapiper.com/en/us/insights/
publications/2019/06/district-of-columbia-v-facebook/.
\67\ Associated Press, Facebook Must Provide Info Sought by
Massachusetts Attorney General, Boston.com (Jan. 19, 2020), https://
www.boston.com/news/local-news/2020/01/19/facebook-must-provide-info-
sought-by-massachusetts-attorney-general.
\68\ Makena Kelly, New York's Attorney General Is Investigating
Facebook After Contact-Scraping Scandal, The Verge (Apr. 25, 2019, 5:15
PM), https://www.theverge.com/2019/4/25/18516716/new-york-attorney-
general-facebook-contact-scraping-letitia-james.
\69\ Associated Press, Washington Attorney General Sues Facebook
over Campaign Ads, U.S. News & World Rep. (Apr. 14, 2020, 5:47 PM),
https://www.usnews.com/news/best-states/washington/articles/2020-04-14/
washington-attorney-general-sues-facebook-over-campaign-ads.
\70\ Tony Romm, Forty-Six Attorneys General Have Joined a New York-
Led Antitrust Investigation of Facebook, Wash. Post (Oct. 22, 2019,
1:32 PM), https://www.washingtonpost.com/technology/2019/10/22/forty-
six-attorneys-general-have-joined-new-york-led-antitrust-investigation-
into-facebook/.
\71\ Ali Breland, Arizona Investigating Google's Location Tracking:
Report, The Hill (Sept. 11, 2018, 3:33 PM), https://thehill.com/policy/
technology/406106-arizona-investigating-googles-location-tracking-
report.
\72\ Reuters, At Least Two U.S. Attorneys General Are Investigating
the Google+ Glitch that Exposed Hundreds of Thousands of Users'
Personal Data, Bus. Insider (Oct. 9, 2018, 4:37 PM), https://
www.businessinsider.com/some-us-attorneys-general-are-investigating-
google-data-breach
-2018-10.
\73\ Makena Kelly, Google Under Antitrust Investigation by 50
Attorneys General, The Verge (Sept. 9, 2019, 2:59 PM), https://
www.theverge.com/2019/9/9/20857440/google-antitrust-investigation-
attorneys-general-advertising-search.
---------------------------------------------------------------------------
Because of the increase in the number of investigations targeting
the same handful of companies, a former employee who wishes to assist
another enforcer with a new case is increasingly likely to find that
the new case concerns an old target.
C. Technologists Act as Utility Players
Unlike most other roles at the FTC, every FTC technologist is
forced to be a utility player. Although the FTC employs hundreds of
attorneys and dozens of economists,\74\ it employs fewer than ten
technologists.\75\ The number of technologists has ebbed and flowed and
has been as low as only one. Over the past couple decades, however, the
technical complexity of U.S. commerce has grown, thereby increasing
agency demand for technical expertise. This has an important impact on
conflicts. Attorneys and economists can specialize in narrow slices of
the agency's work and focus on a small docket of investigations, but
technologists tend to work on a broad set of matters. As a result, for
purposes of applying the FTC's post-employment restrictions,
technologists may be more likely than other FTC employees to be
considered to have ``participated personally and substantially'' in any
FTC investigation of a major company.\76\
---------------------------------------------------------------------------
\74\ See Bureau of Economics Biographies, Fed. Trade Comm'n,
https://www.ftc.gov/about-ftc/bureaus-offices/bureau-economics/
biographies (last visited May 19, 2021).
\75\ As of May 2019, there were only five technologists at the FTC.
See Memorandum from the Comm. on Energy & Commerce Staff to the
Subcomm. on Consumer Prot. & Commerce Members and Staff 4 (May 8,
2019), https://energycommerce.house.gov/sites/democrats.energy
commerce.house.gov/files/documents/FTC%20Oversight%20Memo%2-50319.pdf.
In May 2021, an FTC official confirmed that the number of technologists
on staff is fewer than ten. Notes of conversation on file with authors.
\76\ 16 C.F.R. Sec. 4.1(b)(1)(i).
---------------------------------------------------------------------------
Technology now pervades nearly every industry the FTC oversees,
leading some to refer to it as the ``Federal Technology Commission.''
\77\ The biggest driver of increasing technical complexity is, of
course, the growth of computers and the Internet to their modern-day
prevalence.\78\ Personal computers and the Internet are still
relatively recent phenomena. In the nineteen years from 1997 to 2016,
the percentage of U.S. households with desktop or laptop computers more
than doubled.\79\ From 2000 to 2019, the percentage of U.S. adults who
used the Internet went from fifty-two percent to ninety percent.\80\
The iPhone was not even introduced until 2007,\81\ with the App Store
following close behind it, and yet today there are almost two million
apps available for download.\82\ E-commerce has simultaneously
ballooned over the past two decades.\83\
---------------------------------------------------------------------------
\77\ Brian Fung, The FTC Was Built 100 Years Ago to Fight
Monopolists. Now, It's Washington's Most Powerful Technology Cop, Wash.
Post (Sept. 25, 2014, 11:30 AM), https://www
.washingtonpost.com/news/the-switch/wp/2014/09/25/the-ftc-was-built-
100-years-ago-to-fight-monopolists-now-its-washingtons-most-powerful-
technology-cop/ (quoting Geoffrey Manne, executive director of the
International Center for Law and Economics).
\78\ See generally McSweeny, supra note 50 (detailing FTC
enforcement actions in consumer protection against the backdrop of
increasing technological complexity).
\79\ Laptop and desktop computer ownership increased from 36.6
percent in 1997 to 77 percent in 2016. Eric C. Newburger, U.S. Census
Bureau, Computer Use in the United States: October 1997, at 1 (1999),
https://www.census.gov/content/dam/Census/library/publications/1999/
demo/p20-522.pdf; Camille Ryan, U.S. Census Bureau, Computer and
Internet Use in the United States: 2016, at 2 (2018), https://
www.census.gov/content/dam/Census/library/publications/2018/acs/ACS-
39.pdf. In 2016, eighty-nine percent of households had a smartphone or
computer. Ryan, supra note 79, at 1.
\80\ Internet/Broadband Fact Sheet, Pew Research Ctr. (June 12,
2019), https://www.pew
research.org/internet/fact-sheet/internet-broadband/.
\81\ Lisa Eadicicco, This Is Why the iPhone Upended the Tech
Industry, Time (June 29, 2017, 7:00 AM), https://time.com/4837176/
iphone-10th-anniversary/.
\82\ Sam Costello, How Many Apps Are in the App Store?, Lifewire,
https://www.lifewire.com/ how-many-apps-in-app-store-2000252 (last
updated Feb. 24, 2020).
\83\ U.S. retail e-commerce sales were estimated at $5.3 billion in
the fourth quarter of 1999, when the U.S. Census Bureau first began
reporting e-commerce statistics, representing 0.64 percent of total
retail sales. Press Release, U.S. Census Bureau, Retail E-Commerce
Sales for the Fourth Quarter 1999 Reach $5.3 Billion, Census Bureau
Reports (Mar. 2, 2000), https://www2.census.gov/retail/ releases/
historical/ecomm/99q4.pdf. By the first quarter of 2020, retail e-
commerce sales had ballooned to $160.3 billion, representing 11.8
percent of total retail sales. Press Release, U.S. Census Bureau,
Quarterly Retail E-Commerce Sales: 1st Quarter 2020 (May 19, 2020),
https://www2.census.gov/retail/ releases/historical/ecomm/20q1.pdf.
---------------------------------------------------------------------------
Today, technically complex subject matter is often at the center of
the agency's investigations and proceedings. For example, the 2019
Facebook complaint discussed Facebook's implementation of facial
recognition technology;\84\ the 2019 Google/YouTube complaint discussed
behavioral advertising;\85\ the 2019 Equifax complaint discussed
critical security vulnerabilities and reasonable patch management
policies and procedures;\86\ and the 2018 Uber complaint discussed the
company's use of real-time precise geolocation data.\87\
---------------------------------------------------------------------------
\84\ Complaint for Civil Penalties, Injunction, and Other Relief at
6, 39-42, United States v. Facebook, Inc., No. 19-cv-2184 (D.D.C. July
14, 2019), https://www.ftc.gov/system/files
/documents/cases/182_3109_facebook_complaint_filed_7-24-19.pdf.
\85\ Complaint for Permanent Injunction, Civil Penalties, and Other
Equitable Relief at 4, 7-9, Fed. Trade Comm'n v. Google LLC, No. 1:19-
cv-2642 (D.D.C. Sept. 6, 2019), https://www.ftc.gov/system/files/
documents/cases/172_3083_youtube_revised_complaint.pdf.
\86\ Complaint for Permanent Injunction and Other Relief at 6, 8-
14, Fed. Trade Comm'n v. Equifax Inc., No. 1:19-mi-99999-UNA (N.D. Ga.
July 22, 2019), https://www.ftc.gov/system/files/ documents/cases/
172_3203_equifax_complaint_7-22-19.pdf.
\87\ Complaint at 2, Uber Technologies, Inc., No. C-4662 (Fed.
Trade Comm'n Oct. 26, 2018), https://www.ftc.gov/system/files/
documents/cases/152_3054_c-4662_uber_technologies_revised
_complaint.pdf.
---------------------------------------------------------------------------
As the role of technology in FTC investigations and enforcement has
expanded, the agency has struggled to adjust accordingly, forcing the
few available technologists to consult on an outsized portion of agency
matters.\88\ Our personal experience bears this out. As technologists
for the FTC, we were asked to consult with attorneys working on
virtually every case that came before the Division of Privacy and
Identity Protection, as well as a number of cases originating in other
divisions. In interviews with other former FTC technologists, we heard
similar accounts. This means that our potential list of conflicts is
much longer than non-technologists who work for the FTC for the same
length of time. Nearly every matter involving technology during our
tenure crossed our desks, even if many of those interactions were
fleeting and insubstantial. Still, our list of potential conflicts
encompasses nearly everything involving complex information technology
during our employment.
---------------------------------------------------------------------------
\88\ This has been our experience, as well as the experience of
several people we interviewed. Contact authors for information on
interviews.
---------------------------------------------------------------------------
The general dearth of technical experts at the FTC reflects the
agency's dearth of staff more broadly. Much of the scrutiny the agency
exacts on technology companies is facilitated by staff working on
privacy and data security, of which the FTC has only about forty.\89\
In contrast, the United Kingdom has more than five hundred people
working in its Information Commissioner's office,\90\ and Ireland's
Data Protection Commissioner has over 130 employees.\91\ As far as
technologists are concerned, while the FTC has between five and nine
technologists,\92\ Germany--a country with one-fourth the population of
the United States--has 101 technology specialists working with its data
protection authorities.\93\ While such a high number is unusual, other
European countries nevertheless have drastically more technologists
than the United States; Spain has thirty-six, France has twenty-eight,
and the United Kingdom has twenty-two.\94\
---------------------------------------------------------------------------
\89\ Harper Neidig, FTC Says It Only Has 40 Employees Overseeing
Privacy and Data Security, The Hill (Apr. 3, 2019, 11:01 AM), https://
thehill.com/policy/technology/437133-ftc-says-it-only-has-40-employees-
overseeing-privacy-and-data-security.
\90\ History of the ICO, Info. Comm'r's Office, https://ico.org.uk/
about-the-ico/our-information/history-of-the-ico/ (last visited Aug.
23, 2020).
\91\ Peter Hamilton, Data Commissioner to Look for More Staff and
Funding, Irish Times (Mar. 7, 2019, 1:50 PM), https://
www.irishtimes.com/business/technology/data-commissioner-to-look-for-
more-staff-and-funding-1.3817791.
\92\ See Breland, supra note 71.
\93\ Johnny Ryan, Brave, Europe's Governments Are Failing the GDPR
4 (2020), https://brave.com/wp-content/uploads/2020/04/Brave-2020-DPA-
Report.pdf.
\94\ Id.
---------------------------------------------------------------------------
The dearth of FTC technologists is also evident in comparison to
the large population of economists employed by the FTC. The FTC's
website currently lists approximately 80 staff in the Bureau of
Economics.\95\ This list does not include economists who serve in other
roles, such as staff advisors for Commissioners.\96\ With dozens of
economists and supporting analysts on staff, it is neither necessary
nor feasible to ask any individual economist to take on such a broad
portfolio of matters that might serve as a future potential conflict of
interest.
---------------------------------------------------------------------------
\95\ See Bureau of Economics Biographies, supra note 74.
\96\ See Fed. Trade Comm'n, Federal Trade Commission Organization
Directory 2, https://www.ftc.gov/system/files/attachments/contact-
federal-trade-commission/ftc_org_directory_8-8-2019.pdf (last updated
Aug. 8, 2019) (listing an ``Economic Advisor'' for Chairman Joseph J.
Simons).
---------------------------------------------------------------------------
D. Lengthy and Broad Consent Decrees
Another possible contributor to the FTC's broad application of
conflicts rules for technologists is the agency's practice of
establishing broad, twenty-year settlements with parties presumed to be
in violation of Sec. 5 of the FTC Act.\97\ This would not necessarily
pose a problem if the FTC understood that the ``proceeding or
investigation'' in a conflict of interest analysis under Sec. 4.1(b) of
the agency's rules should be the specific facts that gave rise to the
twenty-year settlement. But if the rules are instead read broadly--too
broadly in our view--to encompass ``this company and privacy'' or
``this company and security,'' the twenty-year term serves as a two-
decades-long restraint on future work for former employees. In
combination with the fact that companies--especially technology
companies--are bigger and more horizontally diversified than they were
in the past,\98\ broad and lengthy consent decrees dramatically limit
the ability of former FTC staff to work on issues related to technology
companies for a period that may cover half a person's professional
career.
---------------------------------------------------------------------------
\97\ See Legislative Hearing on 17 FTC Bills: Hearing Before the
Subcomm. on Commerce, Mfg. & Trade of the H. Comm. on Energy &
Commerce, 114th Cong. 5 (2016) (statement of David C. Vladeck,
Professor, Georgetown University Law Center), https://
energycommerce.house.gov/sites/ democrats.energycommerce.house.gov/
files/05.24.16_Testimony_Vladeck-CMT-LegHrg-17-FTC-Bills-20160524.pdf
(``[T]he Commission has for decades generally insisted on twenty year
[sic] orders.''); id. at 6 (``[M]ost [data security cases] were
resolved with twenty-year consent decrees.''); Daniel J. Solove &
Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum.
L. Rev. 583, 613-14 (2014) (citing twenty years as a common duration
for FTC's privacy and security audits, while also noting variation
among the orders); Woodrow Hartzog & Daniel J. Solove, The Scope and
Potential of FTC Data Protection, 83 Geo. Wash. L. Rev. 2230, 2297
(2015) (``While the FTC does not enter into a twenty-year consent order
with every company it files a privacy-related complaint against, this
burdensome timescale is the most common duration for such
agreements.'').
\98\ See discussion in supra Section III.C.
---------------------------------------------------------------------------
The FTC has existing consent decrees that will endure many years
into the future with a large number of major companies. For example,
from past cases, the agency has settlement provisions that will persist
with Facebook until 2039,\99\ with Apple until 2034,\100\ with Google
until 2031,\101\ with Google/YouTube until 2029,\102\ with Twitter
until 2030,\103\ and with PayPal until 2038.\104\
---------------------------------------------------------------------------
\99\ Stipulated Order for Civil Penalty, Monetary Judgement, and
Injunctive Relief at Attachment A at 20, United States v. Facebook,
Inc., No. 19-cv-2184 (D.D.C. July 24, 2019), https://www.ftc.gov/
system/files/ documents/cases/182_3109_facebook_order_filed_7-24-19.pdf
[hereinafter ``FTC Facebook Order 2019''] (``This Order will terminate
20 years from the date of its issuance, or 20 years from the most
recent date that the United States of the Commission files a complaint
'').
\100\ Decision and Order at 6, Apple Inc., No. C-4444 (Fed. Trade
Comm'n Mar. 25, 2014), https://www.ftc.gov/system/files/documents/
cases/140327appledo.pdf [hereinafter ``FTC Apple Order 2014''] (``This
order will terminate on March 25, 2034, or twenty (20) years from the
most recent date that the United States or the Federal Trade Commission
files a complaint '').
\101\ Agreement Containing Consent Order at 7, Google Inc., No.
102316 (Fed. Trade Comm'n 2011), https://www.ftc.gov/sites/default/
files/documents/cases/2011/03/110330googlebuzz
agreeorder.pdf [hereinafter ``FTC Google Order 2011''] (``This order
will terminate twenty (20) years from the date of its issuance, or
twenty (20) years from the most recent date that the United States or
the Commission files a complaint '').
\102\ Stipulated Order for Permanent Injunction and Civil Penalty
Judgement at 16, Fed. Trade Comm'n v. Google LLC, No. 1:19-cv-02642
(D.D.C. Sept. 4, 2019), https://www.ftc.gov/system/files/documents/
cases/172_3083_youtube_coppa_consent_order.pdf [hereinafter ``FTC
Google/YouTube Order 2019''] (``For ten (10) years after entry of this
Order, each Defendant must submit a compliance notice, sworn under
penalty of perjury, within fourteen (14) days of any change in '').
\103\ Agreement Containing Consent Order at 6, Twitter, Inc., No.
0923093 (Fed. Trade Comm'n 2010), https://www.ftc.gov/sites/default/
files/documents/cases/2010/06/100624twitteragree
.pdf [hereinafter ``FTC Twitter Order 2010''] (``This order will
terminate twenty (20) years from the date of its issuance, or twenty
(20) years from the most recent date that the United States or the
Commission files a complaint '').
\104\ Decision and Order at 7, Paypal, Inc., No. C-4651 (Fed. Trade
Comm'n May 23, 2018), https://www.ftc.gov/system/files/documents/cases/
1623102-c4651_paypal_venmo_decision
_and_order_final_5-24-18.pdf [hereinafter ``FTC PayPal Order 2018'']
(``Respondent must create certain records for 20 years after the
issuance date of the Order.'').
---------------------------------------------------------------------------
The consent decrees often include provisions that require special
behavior, oversight, or reporting with respect to a broad range of
activities. For example, consent decrees negotiated as part of privacy
and data security cases commonly require parties to commit to not
misrepresent their privacy or security practices,\105\ obtain express
consent from consumers with respect to certain data practices,\106\
adopt privacy or security programs incorporating certain specific
practices,\107\ produce regular privacy or security reports that meet
outlined standards,\108\ and make certain documents available to the
FTC upon request.\109\
---------------------------------------------------------------------------
\105\ See, e.g., FTC Facebook Order 2019, supra note 99, at 5; FTC
PayPal Order 2018, supra note 104, at 3; FTC Google Order 2011, supra
note 101, at 3-4; FTC Twitter Order 2010, supra note 103, at 3.
\106\ See, e.g., FTC Facebook Order 2019, supra note 99, at 5-6;
FTC Google Order 2011, supra note 101, at 4.
\107\ See, e.g., FTC Facebook Order 2019, supra note 99, at 6-12;
FTC Google Order 2011, supra note 101, at 4-5; FTC Twitter Order 2010,
supra note 103, at 3-4.
\108\ See, e.g., FTC Facebook Order 2019, supra note 99, at 12-14;
FTC PayPal Order 2018, supra note 104, at 5-6; FTC Google Order 2011,
supra note 101, at 5-6; FTC Twitter Order 2010, supra note 103, at 4-5.
\109\ See, e.g., FTC Facebook Order 2019, supra note 99, at 20; FTC
PayPal Order 2018, supra note 104, at 8; FTC Google Order 2011, supra
note 101, at 6; FTC Twitter Order 2010, supra note 103, at 5-6.
---------------------------------------------------------------------------
Because the term of the agreements is long and the scope broad,
former employees may find that if they worked on or saw documents
related to an investigation of a company that later settled with the
FTC, future work relating generally to the data practices of that same
company is then essentially off-limits for the lengthy term of the
agreement. Even investigations into products or services that did not
yet exist at the time can then be construed as the ``same proceeding or
investigation'' under the agency's rules restricting post-employment
activities.\110\
---------------------------------------------------------------------------
\110\ 16 C.F.R. Sec. 4.1(b)(1)(i).
---------------------------------------------------------------------------
E. Risk-Averse Agency Culture
When we interviewed former FTC employees, they generally agreed
that another cause of the agency's broad application of post-employment
conflicts rules is a cultural inclination toward risk-aversion at the
agency.\111\ In particular, interviewees stated that there is a
widespread concern about heavy congressional criticism within the
agency.\112\ This is viewed as a motivating factor for a number of
agency considerations. Many interviewees stated a belief that the
agency's extreme caution harkens back to the 1970s when, in what is
known as ``KidVid,'' the agency attempted to ban television ads for
junk food directed at children--a move perceived by a congressional
majority as regulatory overreach.\113\ In response, Congress limited
the agency's authority and withdrew its funding.\114\ Many believe that
the agency continues to tread lightly today out of a lingering fear of
congressional backlash, an assessment echoed by our interviewees.
Applying this approach to conflicts questions, the agency may
reasonably calculate that there are few or no downsides to OGC
rejecting a former employee's clearance request.
---------------------------------------------------------------------------
\111\ Interviews, supra note 88; see also Nicholas Confessore &
Cecilia Kang, Facebook Data Scandals Stoke Criticism That a Privacy
Watchdog Too Rarely Bites, N.Y. Times (Dec. 30, 2018), https://
www.nytimes.com/2018/12/30/technology/facebook-data-privacy-ftc.html
(``In more than 40 interviews, former and current F.T.C. officials,
lawmakers, Capitol Hill staff members, and consumer advocates said that
as evidence of abuses has piled up against tech companies, the F.T.C.
has been too cautious.'').
\112\ Interviews, supra note 88.
\113\ See Chris Jay Hoofnagle, Federal Trade Commission Privacy Law
and Policy 60-66 (2016) (describing the KidVid controversy, the ensuing
fallout, and the impact on the FTC's enforcement approach); Confessore
& Kang, supra note 111 (``The F.T.C. is haunted, for example, by a
clash with Congress in the 1980s over an attempt by the agency to ban
television ads for junk food directed at children, known as `KidVid.' .
. . Fears that Congress could again cripple the F.T.C. have made some
career lawyers reluctant to take on politically sensitive cases,
according to current and former employees, speaking about their
experiences during the Trump and Obama administrations.''). In one
memorable example of a culture of severe sensitivity to congressional
censure at the agency, an interviewee described briefing their
superiors on research that websites were using JavaScript code that
could surreptitiously dig through a user's browser and access the sites
they had visited. (Please contact authors for information on
interviews.) The most heavily trafficked site that was engaging in that
practice belonged to a pornography website. Id. The interviewee was
informed that the agency would not investigate the pornography company
because the FTC did not want to run the risk of being perceived as
``protecting the privacy of people who watch pornography.'' Id. While
no other interviewees provided similarly colorful examples to
illustrate the point, this example is representative of the risk-
adverse culture described by the other former FTC employees.
\114\ Hoofnagle, supra note 113, at 65 (describing the FTC
Improvement Act of 1980, which passed in response to the KidVid
controversy, implemented a Congressional veto of Agency action, limited
the Agency's rule-making authority, and temporarily expunged funding).
---------------------------------------------------------------------------
In contrast, granting a former employee's clearance request--
especially when it concerns a major company or highly visible matter--
could provide fodder for a company under the scrutiny of the FTC to
attempt to drum up criticism of the agency. This is not an unfounded
concern; in response to unwanted FTC investigation, companies have
attempted all manner of interference strategies throughout the agency's
history. For example, in 1918 when the FTC issued a report documenting
the predatory and collusive practices of meatpackers and calling for
the nationalization of certain components of the industry, the agency
was roundly attacked.\115\ The U.S. Chamber of Commerce and the New
York Times Editorial Board called for the agency to be ``cured of its
present bolshevist and propagandist tendencies,'' \116\ and were echoed
by Senator James Watson when he specifically targeted the FTC's Chicago
field office as a ``spawning ground of sovietism.'' \117\ In response,
the agency investigated, cleared of wrongdoing, but ultimately still
fired eleven of the employees who worked on the report, and Congress
removed the agency's oversight of meatpackers, awarding this
jurisdiction instead to the more industry-friendly Department of
Agriculture.\118\ Sixty years later in KidVid, when the agency
considered children's advertising rules, advertisers devoted the
equivalent of one-fourth of the agency's budget at the time to lobbying
and public relations efforts against the rules, while advertising trade
associations petitioned the FTC to compel Chair Michael Perschuk to
recuse himself based on his prior statements about the regulation of
children's advertising.\119\ When Perschuk initially refused, the
advertisers sued, won, and lost on appeal; nevertheless, Perschuk
eventually recused himself voluntarily to shield the rulemaking from
further corruption accusations.\120\ These episodes provide support for
fears of corporate retaliation: when it comes to companies attempting
to avoid profit-narrowing regulation, some will not hesitate to work
the referees, and many of those will be rewarded with the calls they
sought.
---------------------------------------------------------------------------
\115\ Luke Herrine, The Folklore of Unfairness, 96 N.Y.U.L.
Rev.431, 467 (2021). The practices described in the report also
provided the basis for a subsequent criminal suit by the Attorney
General.
\116\ Editorial, The Trade Commission, N.Y. Times, Sept. 3, 1918,
at 10, available at https://timesmachine.nytimes.com/timesmachine/1918/
09/03/97024087.pdf?pdf_redirect=true&ip=0.
\117\ Paul A. Pautler, A Brief History of the FTC's Bureau of
Economics: Reports, Mergers, and Information Regulation, 46 Rev. Indus.
Org. 59, 64 n.13 (2015).
\118\ Id. (noting that the employees were ``cleared of wrongdoing''
and that their firing was ``presumably to placate Senator Watson'');
Hoofnagle, supra note 113, at 24-25 (recounting the episode and
characterizing the Department of Agriculture as ``friendlier'' to the
meatpackers than the FTC).
\119\ Herrine, supra note 115, at 503 (``With General Mills and
Bristol-Myers in the lead and ``Washington super-lobbyist Tommy Boggs''
coordinating (and rumors of the tobacco lobby contributing
substantially), a ``war chest'' of $30 million was raised to ``Stop the
FTC'' and KidVid in particular.''); id. at 506-07 (detailing The
Association of National Advertisers, Inc., the American Association of
Advertising Agencies, the American Advertising Federation, and the Toy
Manufacturers of America, Inc.'s demands that Perschuk recuse himself
for conflict of interest due to his ``public statements concerning
regulation of children's advertising that demonstrated prejudgment of
specific factual issues sufficient to preclude his ability to serve as
an impartial arbiter'') (citing Ass'n of Nat'l Advertisers, Inc. v.
FTC, 627 F.2d 1151, 1155 (D.C. Cir. 1979)).
\120\ Herrine, supra note 115, at 503.
---------------------------------------------------------------------------
Indeed, we know of at least two instances when the agency acted on
outside claims of conflict or bias that seemed exceptionally weak on
their face, and for which it is difficult to explain the agency's
responses as anything other than extreme risk aversion. One former
technologist we interviewed publicly criticized a large technology
company prior to his employment by the agency.\121\ When the company
filed a complaint with the FTC regarding the employee's participation
in investigations of the company, the FTC removed the employee from the
investigation and precluded him from working on any investigation of
that company for the rest of his employment at the FTC. In another
case, a large technology company complained to the FTC when a member of
an FTC technologist's Ph.D. dissertation committee filed a public
request for the agency to investigate that company. The request was
based entirely on publicly available information but, because the
company complained that the employee was somehow conflicted, the FTC
prohibited the employee from working on any investigations of that
company. As a result, an important investigation of the company was
conducted without the support of any FTC technologist for several
months.
---------------------------------------------------------------------------
\121\ Contact authors for more information.
---------------------------------------------------------------------------
The agency's attempts to inoculate itself from charges of bias by
industry are likely to fail because opportunistic companies raise such
charges even when there is no reasonable basis for them. Nevertheless,
a deep-seated agency culture of prudence--and a history of successful
corporate interference--leads the agency to reflexively shy away from
even the suggestion of possible conflict.
F. Possible Political Conflict Between FTC and State Attorneys General
It is also possible that perceived political conflict may
contribute to the overly broad application of post-employment conflict
restrictions to FTC technologists. To be clear, the FTC often works
closely with state attorneys general, including in investigations into
the practices of technology companies.\122\ For example, in 2012, the
FTC and dozens of state attorneys general coordinated on cases brought
against Google for its privacy policy practices.\123\ Even though the
state enforcers pressed arguably more aggressive theories than the FTC
pursued in its investigation, FTC Commissioner Julie Brill praised the
settlement extracted by the states.\124\
---------------------------------------------------------------------------
\122\ Paul M. Schwartz, The Value of Privacy Federalism, in Social
Dimensions Of Privacy: Interdisciplinary Perspectives 324 (Beate
Roessler & Dorota Mokrosinska eds., 2015) (``When Congress enacts
privacy law, it generally allows the states space for further
action.''); Danielle Keats Citron, The Privacy Policymaking of State
Attorneys General, 92 Notre Dame L. Rev. 747, 791-94 (2016)
(``Attorneys general have enjoyed a synergistic relationship with
Federal agencies working on privacy and data security issues.'');
Bilyana Petkova, The Safeguards of Privacy Federalism, 20 Lewis & Clark
L. Rev. 595, 621-22 (2016) (``[T]he state attoneys general have not
only coordinated their actions horizontally but have also joined
efforts with the FTC.'').
\123\ Citron, supra note 122, at 793.
\124\ Id.; Letter from Twenty-three Att'ys Gen. to Larry Page,
Chief Exec. Officer, Google, Inc. (Feb. 22, 2012), https://epic.org/
privacy/google/20120222-Google-Privacy-Policy-Final.pdf.
---------------------------------------------------------------------------
Our interviewees downplayed the possibility of rivalry between the
FTC and the states as playing a significant role in the FTC's
application of post-employment restrictions. Many of our respondents
thought it unlikely that perceived political conflict plays a
meaningful role driving the FTC's broad application of post-employment
conflict rules. Nevertheless, this is a possibility worth exploring.
Although the state attorneys general and the FTC frequently are
well aligned, their respective goals and approaches sometimes diverge.
A 2013 investigation of Google, regarding the company bypassing privacy
settings in the Safari browser, led the FTC to enter a settlement with
Google that required no limits on Google's future behavior.\125\ State
attorneys general declined the FTC's invitation to join the consent
decree and continued to press a parallel case that led, arguably, to
tougher restrictions on Google's conduct.\126\
---------------------------------------------------------------------------
\125\ Citron, supra note 122, at 770 (citing Press Release, Fed.
Trade Comm'n, Google Will Pay $22.5 Million to Settle FTC Charges It
Misrepresented Privacy Assurances to Users of Apple's Safari Internet
Browser (Aug. 9, 2012), https://www.ftc.gov/news-events/press-releases/
2012/08/google-will-pay-225-million-settle-ftc-charges-it-
misrepresented).
\126\ Id.
---------------------------------------------------------------------------
There are reasons to believe that some amount of competitiveness
exists between these entities. In many ways, the FTC has become the de
facto privacy and technology regulator in the United States, even
though, outside of sectoral laws like the Children's Online Privacy
Protection Act (COPPA) and the Fair Credit Reporting Act (FCRA), there
is currently no comprehensive Federal privacy law.\127\ The FTC
benefits from the appearance that it is the primary and most powerful
enforcer of fair trade practices in the United States because, when a
regulator has a reputation as being toothless, companies subject to
their jurisdiction have no incentive to comply with the relevant rules.
As a result, the FTC sometimes competes with state attorneys general
when enforcing high-profile cases. When state enforcement agencies
investigate and impose stronger perceived penalties on companies that
the FTC has already investigated, charged, and settled, this could
undermine the FTC's status as supreme enforcer.\128\
---------------------------------------------------------------------------
\127\ Solove & Hartzog, supra note 97, at 600-08.
\128\ See Justin Brookman, State Attorneys General: Evading Privacy
Settings Is Illegal, Ctr. for Democracy & Tech. (Nov. 20, 2013),
https://cdt.org/insights/ state-attorneys-general-evading-privacy-
settings-is-illegal/ (pointing out that the 2013 settlement by state
attorneys general with Google was ``considerably more expansive than
the FTC's,'' and arguing that ``it's heartening to see states
increasingly take action to protect consumer privacy''); Citron, supra
note 122, at 756 n.42 (``In important areas, [state attorneys general
(AG)] have set privacy policy in the absence of Federal norms; in
others, they have pressed the FTC to offer greater privacy protections
to consumers than those afforded by Federal agencies. In the near
future, there may be more aggressive state AG privacy and data security
enforcement than enforcement activity at the Federal level.'').
---------------------------------------------------------------------------
The experiences of one interviewee who worked on consumer
protection investigations with a state attorney general's office speak
to the occasional tensions between the FTC and state attorneys general.
The interviewee hypothesized that in certain, high-profile cases, the
FTC's willingness to allow the former employee to consult on the state
attorney general's case was hindered by the agency's interest in public
credit for tackling certain cases. The interviewee hypothesized that
the agency's desire for public credit was responsible for the friction
in that particular case because the interviewee had not encountered
similar problems when working with FTC officials on previous lower-
level cases. The interviewee explained that in response to a request
for clearance to work with state AGs on a high-profile matter, the FTC
denied clearance for the interviewee unless the interviewee was willing
to work as an unpaid FTC employee and allow the FTC to mediate their
recommendations to the state agencies.\129\ Indeed, there is good
reason for FTC staff to seek public credit for its enforcement efforts.
In recent years, the FTC has been lambasted by a range of critics for
its failure to take strong, decisive action to rein in unfair and
deceptive trade practices.\130\ Even the agency's record-breaking five-
billion-dollar settlement with Facebook drew widespread criticism that
it was simply not enough.\131\
---------------------------------------------------------------------------
\129\ E-mail from Alternate Designated Agency Ethics Official,
Office of the General Counsel, Federal Trade Commission, to one of the
authors (Mar. 07, 2019, 07:54 PST) (on file with authors).
\130\ See, e.g., Hearing on Oversight of the Federal Trade
Commission: Strengthening Protections for Americans' Privacy and Data
Security Before House of Representatives Subcommittee on Consumer
Protection and Commerce of the House Committee on Energy and Commerce,
116th Cong. 1 (May 8, 2019) (opening statement of Frank Pallone, Jr.,
Chairman, Comm. on Energy & Commerce), https://
energycommerce.house.gov/sites/democrats.energycommerce.house
.gov/files/documents/
0508%20FP%20FTC%20Oversight%20Hrg%20Opening%20Remarks.pdf (claiming
the FTC ``can dodo[es] little more than give a slap on the wrist to
companies the first time they violate the law''); Emily Birnbaum, GOP
Senator Scolds FTC for `Toothless' Response to Privacy Scandals, The
Hill (Mar. 11, 2019, 1:41 PM), https://thehill.com/policy/technology/
433514-gop-senator-ftc-response-to-privacy-scandals-has-been-toothless;
Peter Maass, Your FTC Privacy Watchdogs: Low-Tech, Defensive,
Toothless, Wired (June 28, 2012, 6:30 AM), https://www.wired.com/2012/
06/ftc-fail/ (calling the FTC ``low-tech, defensive, [and]
toothless'').
\131\ See, e.g., Devin Coldewey, 9 Reasons the Facebook FTC
Settlement Is a Joke, TechCrunch (July 24, 2019, 8:01 PM), https://
techcrunch.com/2019/07/24/9-reasons-the-facebook-ftc-settlement-is-a-
joke/; Editorial Board, Opinion, A $5 Billion Fine for Facebook Won't
Fix Privacy, N.Y. Times (July 25, 2019), https://www.nytimes.com/2019/
07/25/opinion/facebook-fine-5-billion.html; Nilay Patel, Facebook's $5
Billion FTC Fine Is an Embarrassing Joke, The Verge (July 12, 2019,
9:05 PM), https://www.theverge.com/ 2019/7/12/20692524/facebook-five-
billion-ftc-fine-embarrassing-joke; Adam Schwartz, The FTC-Facebook
Settlement Does Too Little to Protect Your Privacy, Elec. Frontier
Found. (July 24, 2019), https://www.eff.org/deeplinks/2019/07/ftc-
facebook-settlement-does-too-little-protect-your-privacy; Siva
Vaidhyanathan, Billion-Dollar Fines Can't Stop Google and Facebook.
That's Peanuts for Them, Guardian (July 26, 2019, 6:00 AM), https://
www.theguardian.com/commentisfree/2019/jul/26/google-facebook-
regulation-ftc-settlement; Press Release, H. Comm. on Energy &
Commerce, Pallone Statement on the FTC's Facebook Settlement (July 24,
2019), https://energycommerce.house.gov/newsroom/press-releases/
pallone-statement-on-the-ftc-s-facebook-settlement (``While $5 billion
is a record fine for the FTC, monetary damages are not enough.'').
---------------------------------------------------------------------------
Some critics have gone so far as to argue that what they consider
to be the agency's too-weak enforcement efforts provide support to
further constrain the agency's authority. Indeed, a number of privacy
advocates have called for Congress to create a new data protection
authority to counteract the FTC's failures and hold technology
companies accountable.\132\ Senator Gillibrand,\133\ Senator
Brown,\134\ and Representatives Lofgren and Eshoo \135\ heeded that
call by offering legislation that would establish a new data protection
agency in the United States.
---------------------------------------------------------------------------
\132\ See, e.g., Caitriona Fitzgerald & Mary Stone Ross, Now Is the
Time for a U.S. Data Protection Agency, The Hill (Feb. 21, 2020, 9:30
AM), https://thehill.com/blogs/congress-blog/politics/483997-now-is-
the-time-for-a-us-data-protection-agency (``Congress needs to create a
Data Protection Agency because the Federal Trade Commission is failing
to protect privacy.''); Privacy & Dig. Rights for All Coal., The Time
Is Now: A Framework for Comprehensive Privacy Protection and Digital
Rights in the United States, https://www.citizen.org/wp-content/
uploads/migration/privacy-and-digital-rights-for-all-framework.pdf; The
U.S Urgently Needs a Data Protection Agency, Elec. Privacy Info. Ctr.,
https://epic.org/dpa/; see also Natasha Singer, The Government Protects
Our Food and Cars. Why Not Our Data?, N.Y. Times (Nov. 2, 2019),
https://www.nytimes.com/2019/11/02/sunday-review/data-protection-
privacy
.html (describing critiques of the FTC and proposals for a new data
protection agency).
\133\ Press Release, Kirsten Gillibrand: U.S. Sen. for N.Y.,
Confronting a Data Privacy Crisis, Gillibrand Announces Landmark
Legislation to Create a Data Protection Agency (Feb. 13, 2020), https:/
/www.gillibrand.senate.gov/news/press/release/confronting-a-data-
privacy-crisis-gillibrand-announces-landmark-legislation-to-create-a-
data-protection-agency.
\134\ Press Release, Sherrod Brown: U.S. Sen. for Ohio, Brown
Releases New Proposal That Would Protect Consumers' Privacy from Bad
Actors (June 18, 2020), https://www.brown
.senate.gov/newsroom/press/release/brown-proposal-protect-consumers-
privacy.
\135\ Press Release, Congresswoman Anna G. Eshoo, Eshoo & Lofgren
Introduce the Online Privacy Act (Nov. 5, 2019), https://
eshoo.house.gov/media/press-releases/eshoo-lofgren-introduce-online-
privacy-act.
---------------------------------------------------------------------------
The FTC could be concerned that if state attorneys general were to
frequently pursue additional enforcement action against companies for
practices that have already been the subject of FTC settlements,
companies would have less of an incentive to agree to truly burdensome
conditions when they are brought to the settlement negotiation table
over alleged violations. It is not unusual for the FTC to release any
claims it may have against the subjects of its enforcement actions as
part of the negotiated settlement.\136\ If a company caught violating
the FTC Act believed it was likely to just be sued again for the same
behavior by another enforcer, then the FTC's avowal to release any
claims related to the violation would have little value.
---------------------------------------------------------------------------
\136\ See, e.g., FTC Facebook Order 2019, supra note 99; [Proposed]
Stipulated Revised Order for Permanent Injunction and Equitable
Monetary Relief at 17, Fed. Trade Comm'n v. Cephalon, Inc., No. 2:08-
cv-2141-MSG (E.D. Pa. Feb. 19, 2019), https://www.ftc.gov/system/files/
documents/cases/teva_proposed_stipulated_revised_order.pdf (``The
Commission and the Cephalon Parties stipulate that upon entry of the
Revised Order, the Commission and the Cephalon Parties each release the
other from any and all claims, causes of actions and demands '');
Stipulation at 2, United States v. Okumus, No. 1:17-cv-00104 (D.D.C.
Jan. 17, 2017), https://www.ftc.gov/system/files/documents/cases/
170117okumus_stipulation_filed.pdf (``The entry of the Final Judgment
in accordance with this Stipulation settles, discharges, and releases
any and all claims of Plaintiff for civil penalties and equitable
relief pursuant to Section 7A(g)(1) of the Clayton Act, 15 U.S.C.
Sec. 18a(g)(l) . . . in connection with Defendant's acquisitions of
voting securities of Web.com Group, Inc. from 2014 through 2016.'');
Stipulated Order for Permanent Injunction and Monetary Judgement at 7,
Fed. Trade Comm'n v. Hold Billing Services, Ltd., No. 5:98-cv-006292,
(W.D. Tex. May 4, 2016), https://www.ftc.gov/system/files/documents/
cases/160504holdbillingstip.pdf (``Upon entry of this Stipulated Order,
the FTC releases [Defendant] from any and all Claims that it may have
stemming from charges to consumers' landline telephone bills through or
on behalf of any third-party seller of Enhanced Services.'').
---------------------------------------------------------------------------
IV. IMPLICATIONS FOR AGENCY EFFICACY
As this Article has noted throughout, the broad application of the
conflict rules undermines their purpose and the FTC's ability to
fulfill its competition and consumer protection mission. The FTC is
making it less attractive for technologists to work at the agency by
disproportionately limiting the work they are able to do, including
when the matters former employees are being precluded from
participating in create neither an actual conflict nor the appearance
of it. Unwieldy and unpredictable post-employment constraints will make
it even less attractive, or frankly feasible, for technologists to work
for the FTC than it already is, raising exactly the concerns that
Congress has repeatedly noted when revising Sec. 207.\137\
---------------------------------------------------------------------------
\137\ Supra notes 13, 17.
---------------------------------------------------------------------------
This overbroad application of the FTC's rules also undermines the
agency's broader mission of consumer protection by inhibiting other
consumer protection actors, such as state attorneys general, from
gaining the expertise to adequately seek remedies in areas the FTC
itself was unable to obtain. For example, many organizations criticized
the five-billion-dollar settlement with Facebook because the settlement
includes very little in the way of injunctions to restrict the
company's future practices with regards to privacy harm of third-party
companies, like Cambridge Analytica.\138\ In fact, the final settlement
also precludes Facebook, its executives, and its board of directors
from being held responsible for ``any and all claims'' prior to the
settlement date.\139\ Two FTC Commissioners criticized this point, and
one implied the existence of other ongoing investigations into the
company that were released as a part of the settlement.\140\ In
addition, private plaintiffs already face steep hurdles to getting
their privacy violations redressed due to years of judicial hostility
toward privacy rights.\141\ Making it harder for private plaintiffs to
find and retain technology experts will make the already minimal
utility of courts to vindicate privacy rights less meaningful still.
---------------------------------------------------------------------------
\138\ See, e.g., supra note 131 and sources cited therein.
\139\ FTC Facebook Order 2019, supra note 99, at 1, United States
v. Facebook, Inc., No. 19-cv-2184 (D.D.C. July. 24, 2019), https://
www.ftc.gov/system/files/documents/cases/182_31
09_facebook_order_filed_7-24-19.pdf.
\140\ See Office of Comm'r Rohit Chopra, Fed. Trade Comm'n, Comm'n
File No. 1823109, Dissenting Statement Of Commissioner Rohit Chopra: in
re Facebook, Inc. 17-18, (2019), https://www.ftc.gov/system/files/
documents/public_statements/1536911/chopra_dissenting_
statement_on_facebook_7-24-19.pdf (``This means that the proposed
release not only shields Facebook from `known' (an undefined term)
Section 5 claims, but also `known' claims under COPPA and other
statutes. Given persistent questions about Facebook's compliance with
these statutes, the Commission should be transparent about which claims
are being released--even if they are being released because they are
seen as lacking viability.''); Office of Comm'r Rebecca Kelly
Slaughter, Fed. Trade Comm'n, Dissenting Statement of Commissioner
Rebecca Kelly Slaughter: In the Matter of FTC vs. Facebook 14 (2019),
https://www
.ftc.gov/system/files/documents/public_statements/1536918/
182_3109_slaughter_statement_on
_facebook_7-24-19.pdf (objecting ``strenuously'' to the settlement's
liability exculpation for Facebook's executives and calling the scope
of the liability release ``unjustified by our investigation and
unsupported by either precedent or sound public policy'').
\141\ Justin Brookman, Protecting Privacy in an Era of Weakening
Regulation, 9 Harv. L. & Pol'y Rev. 355, 356-65 (2015) (describing how
courts have made it more and more difficult for privacy plaintiffs to
receive redress through artificially narrow definitions of Article III
standing and injury, and an expansive approach to First Amendment
rights and the rights of corporations); Julie E. Cohen, Information
Privacy Litigation as Bellwether for Institutional Change, 66 DePaul L.
Rev. 535, 575-77 (2017) (describing courts' response to privacy
litigants as ``busily constructing classes of consumers who lack
remedies before the law'').
---------------------------------------------------------------------------
Overbroad application even limits the efficacy of the few
technologists the agency does employ. In the interviews we conducted,
we heard from former employees who had recused themselves from working
on certain cases for fear of being broadly precluded from ever working
on a related matter once they left the agency, one citing market
consolidation as the justification. As such, concerns of post-
employment conflict checks are likely chilling the freedom that current
FTC employees have to work on certain investigations while at the
agency. This corrodes the agency's effectiveness given how few
technologists it employs already. With the agency's current volume of
technologists, if even one technologist declines to work on cases
involving Facebook or Google, for example, the agency loses a
significant fraction of its available technological expertise--
expertise that it cannot afford to lose.
The FTC is taking the population of employees that it has the
hardest time recruiting and making it disproportionately even less
attractive for them to work there. Technologists are subject to
potential conflicts far more broadly than employees in other
disciplines, even though technologists are much harder for the agency
to locate and retain than attorneys and economists.\142\ An entry-level
engineer's compensation at Facebook with no post-collegiate work
experience can reach $166,000 and up to $189,000 at Google in 2019,
while senior staff roles at the FTC can only make up to around
$170,000.\143\ This difference in potential salary in conjunction with
the broad and opaque application of the conflict rules render it even
less appealing for technologists to work at the FTC. Not only are the
conflicts rules making it harder for the agency to recruit and retain
the population of employees it needs most,\144\ they seem fairly
ineffective at reducing the revolving door problems for non-
technologist employees and senior leadership.\145\
---------------------------------------------------------------------------
\142\ Different factors, such as advance planning and unchanging
subject matter, influence why non-technologists are easier for the
agency to find and retain. For example, the Bureau of Economics at the
FTC was proactive in its creation rather than reactive; that is, it was
created all at once with many staff with the objective of changing the
agency's focus, as opposed to bit by bit in reaction to subject matter
changing beyond the agency's control.
\143\ Adam Janofsky & Matt Drange, We Counted the FTC Employees who
Moved Over to Tech. Is Reform Needed?, Protocol (Mar. 9, 2020), https:/
/www.protocol.com/ftc-tech-hawley-revolving-door/; Kif Leswing, Here's
How Big Tech Companies Like Google and Facebook Set Salaries for
Software Engineers, CNBC (June 15, 2019, 9:30 AM), https://
www.cnbc.com/2019/06/14/how-much-google-facebook-other-tech-giants-pay-
software-engineers.html.
\144\ See generally McSweeny, supra note 50.
\145\ See generally id.; see also Rick Claypool, The FTC's Big Tech
Revolving Door Problem, Pub. Citizen (May 23, 2019), https://
www.citizen.org/article/ftc-big-tech-revolving-door-problem-report.
---------------------------------------------------------------------------
In almost cruel irony, the lack of competition among the technology
companies subject to the FTC's jurisdiction further hampers its ability
to enforce antitrust laws. The technology companies that the FTC
investigates, like Apple, Amazon, Facebook, and Google, are frequently
repeat players.\146\ The size of these companies and the range of
markets they have inserted themselves into makes overlap inevitable.
When the FTC prohibits an employee from working on matters related to
one technology company, that often means that the employee will be
forbidden from working on a whole host of investigations across a wide
gamut of sectors.\147\ The lack of competition in the technology sector
means that the agency's broad enforcement of the conflicts rules will
significantly undercut its efforts to fulfil its consumer protection
and competition missions.
---------------------------------------------------------------------------
\146\ See, e.g., Agreement Containing Consent Order, Facebook,
Inc., No. 0923184 (Fed. Trade Comm'n Nov. 29, 2011), https://
www.ftc.gov/sites/default/files/documents/cases/2011/11/
111129facebookagree.pdf (2011 Facebook consent order); Press Release,
Fed. Trade Comm'n, Apple Inc. Will Provide Full Consumer Refunds of At
Least $32.5 Million to Settle FTC Complaint It Charged for Kids' In-App
Purchases Without Parental Consent (Jan. 15, 2014), https://
www.ftc.gov/news-events/press-releases/2014/01/apple-inc-will-provide-
full-consumer-refunds-least-325-million (2014 Apple settlement); Press
Release, Fed. Trade Comm'n, Google Agrees to Change Its Business
Practices to Resolve FTC Competition Concerns in the Markets for
Devices Like Smart Phones, Games and Tablets, and in Online Search
(Jan. 3, 2013), https://www.ftc.gov/news-events/press-releases/2013/01/
google-agrees-change-its-business-practices-resolve-ftc (2013 Google-
specific antitrust settlement); Press Release, Fed. Trade Comm'n,
Google and YouTube Will Pay Record $170 Million for Alleged Violations
of Children's Privacy Law (Sept. 4, 2019), https://www.ftc.gov/news-
events/press-releases/2019/09/google-youtube-will-pay-record-170-
million-alleged-violations (2019 Google and YouTube settlement); Press
Release, Fed. Trade Comm'n, Google Will Pay $22.5 Million to Settle FTC
Charges It Misrepresented Privacy Assurances to Users of Apple's Safari
Internet Browser (Aug. 9, 2012), https://www.ftc.gov/news-events/press-
releases/2012/08/google-will-pay-225-million-settle-ftc-charges-it-
misrepresented (2012 Google settlement); Facebook, Inc., In the Matter
of, Fed. Trade Comm'n, https://www.ftc.gov/enforcement/cases-
proceedings/092-3184/facebook-inc (last updated Apr. 28, 2020) (2019
Facebook settlement); Lesley Fair, FTC Settlement with Amazon Yields
$70 Million for Consumers, Advice for Business, Fed. Trade Comm'n: Bus.
Blog (May 30, 2017, 12:07 PM), https://www.ftc.gov/news-events/blogs/
business-blog/2017/05/ftc-settlement-amazon-yields-70-million-
consumers-advice (2017Amazon settlement); Cecilia Kang & David McCabe,
F.T.C. Broadens Review of Tech Giants, Homing in on Their Deals, N.Y.
Times (Feb. 11, 2020), https://www.nytimes.com/2020/02/11/technology/
ftc-tech-giants-acquisitions
.html (2020 Amazon, Apple, Facebook, Alphabet, and Microsoft
investigation); Microsoft Corp., Fed. Trade Comm'n, https://
www.ftc.gov/enforcement/cases-proceedings/002-3331/microsoft-
corporation (last updated May 18, 2001) (2001 Microsoft settlement);
Spencer Soper & Ben Brody, Amazon Probed by U.S. Antitrust Officials
over Marketplace, Bloomberg (July 24, 2019, 5:00 AM), https://
www.bloomberg.com/news/articles/2019-09-11/amazon-antitrust-probe-ftc-
investigators-interview-merchants (2019 Amazon-specific antitrust
investigation); Nick Statt, Facebook Confirms New FTC Antitrust
Investigation After Posting Strong Earnings, The Verge (July 24, 2019,
4:27 PM), https://www.theverge.com/2019/7/24/20726371/facebook-ftc-
antitrust-earnings-q2-2019-privacy-regulation-mark-zuckerberg (2019
Facebook-specific antitrust investigation).
\147\ Between the enormous range of sectors Amazon is involved in
through its provision of cloud services and the range of sectors that
sell products through its site, and the fact that online advertising is
overwhelmingly dominated by Facebook and Google, all kinds of
competition and consumer protection investigations will necessarily
involve these companies. See, e.g., Khan, supra note 61, at 768-78
(describing how Amazon leverages its delivery infrastructure into
outpricing competitors in a range of industries, such as when it
eliminated its biggest competitor in diapers and other baby care goods
through a carefully orchestrated predatory pricing scheme and ultimate
acquisition). Amazon accounted for over a third of online retail sales
in the United States last year. Jessica Young, US Ecommerce Sales Grow
14.9 percent in 2019, Digital Com. 360 (Feb. 19, 2020), https://
www.digitalcommerce360.com/article/us-ecommerce-sales/. The FTC is also
currently undergoing a review of Amazon, Apple, Facebook, Alphabet, and
Microsoft's reliance on ``killer acquisitions''--i.e., the practice of
buying a nascent competitor to neutralize the threat posed by the
smaller company's product. Kang & McCabe, supra note 146.
---------------------------------------------------------------------------
Meanwhile, the collateral effects of the FTC's overreaction hamper
its ability to oversee those companies effectively. The agency simply
does not employ enough technologists to be able to sideline them every
time a subject or potential subject of investigation files a bad-faith
complaint. As of 2019, the FTC only employed five full-time
technologists in total, for an agency that oversees digital consumer
protection issues for a nation of 330 million people and handles a
range of other issues beyond privacy, security, and digital
competition.\148\ The FTC's lack of sufficient technologists on staff
has been a frequent point of criticism by advocates,\149\ former\150\
and current\151\ FTC officials, and Congress,\152\ and the agency has
acknowledged the deleterious effects of the lack of technologists on
its effectiveness.\153\ The overly broad application of the conflict
rules exacerbates this problem.
---------------------------------------------------------------------------
\148\ Memorandum from the Comm. on Energy & Commerce Staff, supra
note 75.
\149\ Becky Chao, Eric Null & Claire Park, Open Tech. Inst.,
Enforcing a New Privacy Law: Who Should Companies Hold Accountable?
(2019), https://www.newamerica.org/oti/ reports/enforcing-new-privacy-
law/ (noting the paucity of technologists at the agency and noting that
it is ``unclear whether the FTC has the technological expertise it
needs to enforce privacy laws'').
\150\ McSweeny, supra note 50, at 530 (recommending that the FTC
``scale[] up its in-house technology and research expertise''); Jessica
Rich, Give the FTC Some Teeth to Guard Our Privacy, N.Y. Times (Aug.
12, 2019), https://www.nytimes.com/2019/08/12/opinion/ftc-privacy-
congress.html (``To adequately police privacy in this country, the
F.T.C. needs more lawyers, more investigators, more technologists and
state-of-the-art tech tools. Otherwise, it will continue to operate on
a shoestring, foregoing certain investigations and understaffing
others.'').
\151\ See, e.g., Office of Comm'r Rohit Chopra, Fed. Trade Comm'n,
Comm'n File No. P065404, Statement of Commissioner Rohit Chopra:
Regarding the Report to Congress on the FTC's Use of Its Authorities to
Protect Consumer Privacy and Security 4-5 (2020), https://www.ftc.gov/
system/files/documents/public_statements/1577067/p065404dpip
choprastatement.pdf.
\152\ See, e.g., Memorandum from the Comm. on Energy & Commerce
Staff, supra note 75; Hearing on ``Oversight of the Federal Trade
Commission: Strengthening Protections for Americans' Privacy and Data
Security'' Before the Subcommittee on Consumer Protection and Commerce
of the House Committee on Energy and Commerce, 116th Cong. (2019)
(opening statement of Rep. Jan Schakowsky, Chair), https://
energycommerce.house.gov/sites/democrats.energycom
merce.house.gov/files/documents/
2019.5.8.SCHAKOWSKY.%20FTC%20Oversight%20Hearing
.CPC--0.pdf (noting a contributing factor to the agency's struggle to
conduct meaningful enforcement is the mere five technologists and lack
of a Chief Technologist).
\153\ The Technology 202: The Government's Top Silicon Valley
Watchdog Only Has Five Full-Time Technologists. Now It's Asking
Congress for More, Wash. Post (Apr. 4, 2019, 8:47 AM), https://
www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2019/
04/04/the
-technology-202-the-government-s-top-silicon-valley-watchdog-only-has-
five-full-time-technologists-now-it-s-asking-congress-for-more/
5ca512661b326b0f7f38f30d/ (discussing a letter from FTC Chairman Joseph
Simons to the House Committee on Energy and Commerce ``request[ing]
funding for 10 to 15 more technologists'').
---------------------------------------------------------------------------
V. POLICY RECOMMENDATIONS
We offer policy recommendations to address this problem and help
pave the way for the FTC and other Federal agencies to increase their
technical capacity. The FTC has joined Congress and civil society in
bemoaning its lack of technical experts, and it must mitigate the
obstacles that currently make correcting this problem so difficult. We
offer specific suggestions and broader objectives that will help
mitigate the current obstacles the agency faces in order to attract and
retain technology expertise.
To be clear, we do not mean to diminish the need for conflict of
interest laws, nor do we support watering down the efficacy of those
laws to prevent corruption or slow the revolving door. We see civil
service as an important, if not sacred, calling, and we endorse the
strong use of conflicts rules to discourage cynical or opportunistic
people from trading on government service for personal gain. In fact,
we think in some cases conflict of interest laws may need to be
strengthened as there are still a great deal of former employees that
``switch sides'' and join companies the agency is tasked to
oversee.\154\
---------------------------------------------------------------------------
\154\ Janofsky & Drange, supra note 143.
---------------------------------------------------------------------------
However, we believe that the FTC-administered rules go far beyond
these important goals, especially when applied to technologists.\155\
As discussed above, in many cases, former FTC technologists seek simply
to work on the same side as the agency in the furtherance of consumer
protection.\156\ In those situations, we think a reevaluation of
priorities is warranted.
---------------------------------------------------------------------------
\155\ See discussion in supra Section III.A.
\156\ Id.
---------------------------------------------------------------------------
First, the FTC should address the current vagueness in determining
when different projects comprise either the same ``proceeding or
investigation'' under 16 C.F.R. Sec. 4.1(b) or the same ``particular
matter'' under 18 U.S.C. Sec. 207(a). Under the current formulation of
the rule, in making this determination the FTC considers ``the extent
to which the matters involve the same or related facts, issues,
confidential information and parties; the time elapsed; and the
continuing existence of an important Federal interest.'' \157\ The FTC
could interpret this broad set of factors as permitting it the latitude
to determine that ``same side'' investigations that take place after an
FTC settlement complaint has already been brought constitute new and
separate ``proceeding[s] or investigation[s].'' At present, however,
the FTC interprets the vagueness of this multi-factor test to apply
post-employment restrictions extremely broadly, in a way that we
believe ultimately runs counter to the public interest.
---------------------------------------------------------------------------
\157\ 16 C.F.R. Sec. 4.1(b)(1) n.1. In setting forth these factors,
the FTC refers to an analogous section of the Office of Government
Ethic's regulations setting forth the factors considered to determine
whether two particular matters are the same under Sec. 207: ``the
extent to which the matters involve the same basic facts, related
issues, the same or related parties, time elapsed, the same
confidential information, and the continuing existence of an important
Federal interest.'' 5 C.F.R. Sec. 2641.201(h)(5)(i).
---------------------------------------------------------------------------
Second, the FTC should clarify that whether or not one particular
``proceeding or investigation'' is the same turns more narrowly on the
specific facts of the underlying investigation. The 2012 consent decree
with Facebook speaks to this.\158\ The consent decree stemmed from an
investigation into, among other things, changes to Facebook's privacy
policies that made more information about its users visible to the
public than before and misled consumers about the amount of information
third-party apps could obtain about users.\159\ The investigation led
to a settlement and twenty-year consent decree that obligated Facebook
to create a ``comprehensive privacy program'' and to report to the FTC
for twenty years.\160\
---------------------------------------------------------------------------
\158\ Decision and Order, 5-8, In the Matter of Facebook, Inc.,
Fed. Trade Comm'n (Aug. 10, 2012) (Docket No. C-4365), https://
www.ftc.gov/sites/default/files/documents/cases/2012/08/
120810facebookdo.pdf
\159\ Press Release, Fed. Trade Comm'n, Facebook Settles FTC
Charges that It Deceived Consumers by Failing to Keep Privacy Promises
(Nov. 29, 2011), https://www.ftc.gov/news-events/press-releases/2011/
11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep.
\160\ Decision and Order at 5-8, Facebook, Inc., No. C-4365 (Fed.
Trade Comm'n Aug. 10, 2012), https://www.ftc.gov/sites/default/files/
documents/cases/2012/08/120810facebookdo.pdf; Press Release, Fed. Trade
Comm'n, FTC Approves Final Settlement with Facebook (Aug. 10, 2012),
https://www.ftc.gov/news-events/press-releases/2012/08/ftc-approves-
final-settlement-facebook.
---------------------------------------------------------------------------
For former FTC officials who worked on the 2012 consent decree,
what is the underlying matter that might trigger conflicts review
today? We contend that the matter should be closely related to the
facts that existed in 2012, which was largely premised on changes to
privacy policies in 2009 and 2010 as well as aspects of Facebook's
architecture in 2011. In contrast, the FTC seems to take a much broader
interpretation, treating the underlying ``matter'' as ``Facebook and
privacy.'' For example, the FTC has prevented at least one of us from
working on cases related to Cambridge Analytica, the company that
notoriously mined Facebook user data in the 2016 election, by claiming
they were too closely related to the 2012 consent decree matter, even
though Cambridge Analytica did not even exist in 2011.\161\ The FTC
allowed another of us to participate in a matter related to Cambridge
Analytica but only after a two-week delay that prevented a more
meaningful role in the case. A definition of ``proceeding or
investigation'' as expansive as ``Facebook and privacy'' or ``Amazon
and predatory pricing'' will disqualify the FTC's technologists from
working on crucial investigations, even as these companies consistently
repeat the same kind of exploitative practices and necessary
technological expertise becomes harder and harder for enforcers to
find, attract, and retain.
---------------------------------------------------------------------------
\161\ Cambridge Analytica was founded in 2013. See David Ingram,
Factbox: Who Is Cambridge Analytica and What Did It Do?, Reuters (Mar.
19, 2018, 10:00 PM), https://www.reuters.com/article/us-facebook-
cambridge-analytica-factbox/factbox-who-is-cambridge-analytica-and-
what-did-it-do-idUSKBN1GW07F.
---------------------------------------------------------------------------
Third, to bring even more clarity to its conflicts analysis, the
FTC should consider announcing a bright-line rule in the form of a time
limit on conduct that will be considered the same ``matter'' or
``proceeding or investigation.'' For example, the FTC might decide
that, for investigations into the conduct of platforms, such as social
networking services or search engines, it is not the same ``matter'' if
it occurs more than two years after an earlier matter, nor is an
investigation the same ``proceeding or investigation'' if it arises
more than two years later. This approach finds support in the rhetoric
of the FTC itself, which regularly publishes paeans to the speed and
dynamism of innovation in the technology industry.\162\
---------------------------------------------------------------------------
\162\ See, e.g., Request for Public Comment on the Federal Trade
Commission's Implementation of the Children's Online Privacy Protection
Rule, 84 FED. REG. 35,842, 35,843 (July 25, 2019); Fed. Trade Comm'n,
Big Data: A Tool for Inclusion or Exclusion? i (2016) (``With a
smartphone now in nearly every pocket, a computer in nearly every
household, and an ever-increasing number of Internet-connected devices
in the marketplace, the amount of consumer data flowing throughout the
economy continues to increase rapidly.''); Staff of the Fed. Trade
Comm'n, Protecting Consumers in the Next Tech-ade 2 (2008)
(``Consumers' roles are changing in this new marketplace, as are the
products they buy, how those products are marketed and advertised, and
how they are paid for . . . [and] at a dizzying pace ''); Maureen K.
Ohlhausen, The Procrustean Problem with Prescriptive Regulation, 23
CommLaw Conspectus 1, 2 (2014) (``When the regulated industry is
rapidly evolving, yesterday's comfortable regulatory bed can quickly
become a torture rack for tomorrow's technologies.''); Maureen K.
Ohlhausen, Acting Chairman, Fed. Trade Comm'n, Antitrust Enforcement in
the Digital Age, Remarks Before the Global Antitrust Enforcement
Symposium 6, 11 (Sept. 12, 2017) (describing technology markets as
``fast-moving''); Neil Brady, `Velocity' of Technological Change
`Speeding Up' Says FTC Commissioner, Medium (July 11, 2017), https://
medium.com/@neil.brady/speed-of-technological-change-increasing-sense-
of-loss-of-control-says-ftc-commissioner-259265f4389f (accounting how
the former FTC Commissioner Terrell McSweeny noted that the ``velocity
of technological change is speeding up''); Lesley Fair, Future of the
COPPA Rule: What's on the Agenda, Fed. Trade Comm'n: Bus. Blog (Oct. 1,
2019, 11:46 AM), https://ftc.gov/news-events/blogs/business-blog/2019/
10/future-coppa-rule-whats-agenda (``Technology changes at the speed of
light, but the touchstone of the Children's Online Privacy Protection
Rule remains constant.''); Financial Technology: Protecting Consumers
on the Cutting Edge of Financial Transaction, Fed. Trade Comm'n,
https://www.ftc.gov/news-events/media-resources/consumer-finance/
financial-technology (last visited Aug. 23, 2020) (describing the
agency's approach to the ``fast-moving realm of financial
technology'').
---------------------------------------------------------------------------
To blunt the potential arbitrariness of a rigid two-year deadline,
this gloss on the FTC rules can be presented as a rebuttable
presumption: facts will be presumed not to involve the same matter
after two years, but the FTC can rebut the presumption by marshaling
specific facts demonstrating the same matter.
Fourth, the FTC should also revise its rules to make it easier for
former technologists to consult on ``same side'' investigations, such
as those conducted by state attorneys general. To do this, the FTC
should revise its definition of ``communicate to or appear before''--a
key definition that serves to specify which types of activities by
former employees are subject to restriction.\163\ Under the current
definition, the FTC's rules are triggered when a former employee
engages in ``any oral communication or written communication to, or any
formal or informal appearance before, the Commission or any of its
members or employees on behalf of any person (except the United States)
with the intent to influence.'' \164\ We recommend that the agency add
``or the Government of one of the States'' to the parenthetical
exception. The purpose of the rules is to enable more effective
enforcement of the law by preventing agency capture or the appearance
of corruption, and the exception acknowledges that other work on behalf
of the government does not present that concern. The exception easily
could--and should--be extended to work on behalf of state attorneys
general, which support the agency's consumer protection and competition
mission.
---------------------------------------------------------------------------
\163\ See 16 C.F.R. Sec. 4.1(b)(1) (restricting when a ``former
member or employee . . . of the Commission may communicate to or appear
before the Commission, as attorney or counsel, or otherwise assist or
advise behind-the-scenes, regarding a formal or informal proceeding or
investigation'').
\164\ 16 C.F.R. Sec. 4.1(b)(5)(ii).
---------------------------------------------------------------------------
The FTC's rules must be revised, but in the meantime, the OGC can
also simply exercise its discretion to grant more clearance requests
from former technologists seeking to work on investigations on behalf
of state attorneys general. In laying out prohibited conduct for former
employees, the text of the rules clarifies that post-employment conduct
may be ``otherwise specifically authorized by the Commission,'' though
the rules do not elaborate further about what those circumstances might
be.\165\ In addition, Sec. 207 includes a specific exception for former
employees that provide scientific or technological information. That
exception states in part that certain Sec. 207 restrictions do not
apply ``with respect to the making of communications solely for the
purpose of furnishing scientific or technological information, if such
communications are made under procedures acceptable to the department
or agency concerned.'' \166\ In many instances, state attorneys general
seek former technologists' advice on policy and strategy, not solely
for scientific or technological information. However, there are
circumstances in which the FTC could rely on this exception to quickly
bless requests from former technologists to provide scientific or
technological information to other parties, particularly those on the
``same side.'' Yet FTC staff never even mentioned the existence of this
exception to those of us who are former technologists when we sought
advice on possible conflicts.
---------------------------------------------------------------------------
\165\ 16 C.F.R. Sec. 4.1(b)(1).
\166\ 18 U.S.C. Sec. 207(j)(5).
---------------------------------------------------------------------------
In addition, the FTC should create greater transparency into its
substantive evaluation of clearance requests, as well as into the
procedures it applies in considering those requests. At present, it is
difficult for members of the public and, indeed, former technologists
themselves to gain insight into this process. Under the FTC's rules,
``[a]ny request for clearance filed by a former member or employee
pursuant to this section, as well as any written response, are part of
the public records of the Commission, except for information exempt
from disclosure under Sec. 4.10(a) of [the] chapter.'' \167\ However,
documents related to clearance requests are not available on the FTC's
website or in its ``FOIA Reading Room.'' We submitted a request to the
FTC under the Freedom of Information Act for ``[a]ll documents relating
to clearance requests filed by former FTC employees under 16 C.F.R.
Sec. 4.1(b)(2)'' from January 2017 to March 2020, but our request was
denied on the basis that ``the resources required to process your
request would cause an unreasonably burdensome review process for the
agency.'' \168\
---------------------------------------------------------------------------
\167\ 16 C.F.R. Sec. 4.1(c).
\168\ Freedom of Information Act (FOIA) request and response on
file with authors.
---------------------------------------------------------------------------
The agency's clearance process should also be clarified so that ex-
employees know what to expect. The FTC's rules set forth particular
procedures for FTC consideration of clearance requests filed by former
employees. But in our experience, the staff of OGC frequently dismiss
clearance requests informally over e-mail, without either directing
former employees to file formal requests pursuant to the FTC's rules or
referring the matter to the Commission for approval.\169\
---------------------------------------------------------------------------
\169\ See 16 C.F.R. Sec. Sec. 4.1(b)(6)-(7).
---------------------------------------------------------------------------
We also propose that OGE revise its regulations under Sec. 207. In
particular, OGE should vest Federal agencies, including the FTC, with
clearer authority to determine when a particular ``matter'' is the same
as another for purposes of applying Sec. 207. At least where
independent agencies are concerned, we propose that this interpretative
authority lie with the specific agency where a former Federal employee
previously served. This would constitute a modest shift from OGE's
current guidance that the agency where an employee previously served
may advise the employee as to the application of Sec. 207 but that any
advice it provides will not be binding on the DOJ.\170\ Granting
clearer deference to Federal agencies--including the FTC--on the
question of whether or not two particular matters are the same may
empower the FTC to make the determination based on whether or not it
believes there is a true conflict of interest, rather than based on the
agency's over-prudent estimation of the broadest way in which the DOJ
could possibly construe the question itself.
---------------------------------------------------------------------------
\170\ 5 C.F.R. Sec. Sec. 2641.105(a), (c). This would also be
consistent with at least one Federal appellate case that considered a
``same particular matter'' question in an instance where the agency in
question had advised the former employee that two matters were not the
same. CACI., Inc.-Federal v. United States, 719 F.2d 1567, 1576 (Fed.
Cir. 1983) (``This ruling is entitled to weight. It would be most
unusual to disqualify [former employee] Sterling from bidding on the
proposal because of Stevens' participation for Sterling after the
Assistant Attorney General in charge of the Antitrust Division had
advised Sterling that Stevens' handling of the proposal for Sterling
would not be improper.'').
---------------------------------------------------------------------------
Finally, parallel reforms would also help alleviate the problems we
have outlined, or at least they would help ensure that even if former
technologists continue to be broadly precluded from contributing to
similar work with other agencies, this disincentive does not completely
halt the influx of technologists interested in public service. For
example, a modest raise to the pay scale for government employees would
help attract technologists. It is a tall order to expect recently
graduated computer scientists to turn down six-figure salaries working
for technology companies in the background of financial burdens like
substantial student debt or supporting families.\171\ Students with
fewer resources are disproportionately deterred from government
service, which results in a Federal service that is disproportionately
wealthier than the rest of the population. Public service should not be
a vocation reserved for the independently wealthy. The practices of
technology companies implicate every part of society, and we need
enforcers with diverse backgrounds and prior experiences. Moreover,
paying public servants at rates more comparable with the private sector
would help to reduce the revolving door problem. Agency employees,
congressional aides, and public servants at all levels of government
would not need to leave the government out of financial necessity if
government service paid comparable rates to the private sector. Public
service may be a calling, but a calling cannot feed children or pay a
landlord.
---------------------------------------------------------------------------
\171\ See Adam Janofsky & Matt Drange, We Counted the FTC Employees
who Moved Over to Tech. Is Reform Needed?, Protocol (Mar. 9, 2020),
https://www.protocol.com/ ftc-tech-hawley-revolving-door/ (quoting one
former FTC employee who now works for Electronic Arts as saying that it
can be ``very difficult to live there on a government salary,
especially if you have student loan debt'').
---------------------------------------------------------------------------
VI. CONCLUSION
Few question the dire need for technological expertise at the U.S.
consumer protection and competition agency. Yet, the FTC is
exacerbating its existing difficulty in recruiting and retaining
technologists by unduly limiting the kind of work technologists can
undertake after leaving government service. The FTC's interpretation
and uneven application of well-intentioned conflict rules further
undermine not only its own efficacy, but also the efficacy of
complementary enforcement bodies that support the agency's mission. We
urge a series of modest reforms to prevent post-employment restrictions
from hamstringing the FTC's enforcement efforts as well as those of
other agencies. We hope these reforms will also help pave the way for
skilled technologists to seek and secure meaningful careers in public
service without unnecessarily hemming in their future career prospects.
The Chairwoman. Thank you. Thank you very much. We will now
hear from Mr. Morgan Reed from The App Association who is here
in person. Thank you.
STATEMENT OF MORGAN REED, PRESIDENT,
ACT | THE APP ASSOCIATION
Mr. Reed. Chairman Cantwell, Ranking Member Wicker, my name
is Morgan Reed and I am the President of ACT | The App
Association. We are a leading trade group representing small
software and device companies in the app economy, a $1.7
trillion global sector that supports roughly 5.9 million jobs
here in the U.S.
I am here to share the perspectives of App Association
members, many of which are in your states, on the need for
strong Federal privacy laws and enforcement. And when I say in
your state, I am not doing some kind of hand waving blanket
gesture, I am talking about real companies. Chair Cantwell, in
Spokane we have Mighty Call, which provides a cloud based
communications platform for small businesses to connect teams
remotely. In Starkville, we have got Buzzbassador. They provide
a management platform for brands to use Ambassadors promoting a
product across social media.
And in my written testimony, there are examples for every
single one of your states and in every single one of the
districts in this country. We changed the way we are doing
business today, whether it is farming, education,
communication, and sometimes just having fun. These companies
rely on consumer trust much more than large companies with
brand recognition and privacy is the leading factor.
According to Pew, 63 percent of consumers say they have
deleted an app due to privacy concerns, and 65 percent cite
trust in brand as their number one consideration when deciding
whether to allow access to their information. My member
companies are small and can't buy a Super Bowl ad to create
brand awareness. So when we try to reach customers through the
app stores, we rely heavily on the trustworthiness of the
ecosystem and the marketplaces within. The Federal Trade
Commission and this committee play an important role in
maintaining that trust by maximizing consumer protection while
fostering growth in the economy.
To better protect consumer privacy, we urge you to take
these four considerations into account. Number one, Congress
should set the scope and purposes of the FTC enforcement
authority and resources on privacy. The existing regulatory
framework for the FTC does not have the tools to deal with the
more complex data and privacy questions that arise. The rest of
the world has surged ahead of the U.S. on these questions. When
Europe instituted the GDPR, it was clear the U.S. would have to
act, if just to harmonize.
But now 16 other countries have national privacy laws
matching GDPR, and as Chair--as Ranking Member Wicker noted,
there are 100 more countries with some form of national privacy
law, and the U.S. still has nothing. The FTC needs better
privacy tools based on the risks data processing activities
posed to consumers and the expectations that people have about
its use. It is up to Congress to set forth the overarching
purposes and specify the limits on FTC rules.
Failure to act hurts American citizens and American
competitiveness globally. Number two, if Congress doesn't act,
we have seen what--how FTC is forced to stretch their
authority. The FTC's recent effort to use breach notification
to cover unauthorized sharing is an example how the FTC has to
cobble together a solution in the absence of Congressional
action. Just like Tom Hanks character in the movie Cast Away
using ice skates to open coconuts, the Commission is settling
for the tools it can find rather than the right tool when it
proposes to enforce a breach notification rule as a privacy
law. But we are not on a desert island.
Congress can and should make the right tools for the job.
Number three, Congress should produce more--should produce one
national privacy framework. The single most important policy
decision Congress can make to combat existing and future
privacy harms is to enact comprehensive privacy legislation
that grants strong consumer rights to the citizens of all 50
states simultaneously. A patchwork will make it hard for small
businesses like mine and comparatively easy for big companies
with hundred lawyer compliance departments. In short,
preemption is essential to the success for the little company.
And number four, Congress should avoid antitrust measures that
prohibit some of the most important platform level privacy
controls consumers and app makers rely on today. Big companies
doing business on the app stores, Epic games and Spotify and
others, have their own big brand, and some of them don't want
the app stores to manage the platform.
However, we urge you not to undermine trust in the app
economy with bills that would prevent key privacy protections
my members rely on to bring consumers to market. To be clear,
we are not opposed to and in fact support the FTC vigorously
enforcing the law on privacy and on unfair methods of
competition. For example, on the competition side, the
Commission has the opportunity to clarify the applicability of
its UMC authority to standards essential patents.
Anti-competitive self-abuse harms consumers and small
businesses and competition alike, and this is an example of
where the FTC guidance can help. But ultimately, the economic,
health, education and frankly, opportunities for growing new
businesses created for--in our country, depend on a robust and
appropriately funded FTC.
Congress needs to get this right and they need to do it
now. And without it, we are left with giving the FTC a pile of
money and they are going to end up spending it on additional
ice skates to open coconuts rather than the tools that they
need to solve the problems that we face today. Thank you.
[The prepared statement of Mr. Reed follows:]
Prepared Statement of Morgan Reed, President, ACT | The App Association
Executive Summary
ACT | The App Association (the App Association) is the leading
trade group representing small mobile software and connected device
companies in the app economy, a $1.7 trillion ecosystem employing
186,590 people in Washington and 14,190 in Mississippi.\1\ Our member
companies create the software that brings your smart devices to life.
They also make the connected devices that are revolutionizing
healthcare, education, public safety, and virtually all industry
verticals. They propel the data-driven evolution of these industries
and compete with each other and larger firms in a variety of ways,
including on privacy and security protections.
---------------------------------------------------------------------------
\1\ ACT | The App Association, State of the U.S. App Economy: 2020
(7th Ed.), available at https://actonline.org/wp-content/uploads/2020-
App-economy-Report.pdf.
---------------------------------------------------------------------------
One of the foundational imperatives for the success of small
business innovators in the app economy is consumer trust in the
marketplace. The vast majority of mobile device users cite trust as the
number one factor when deciding to grant an app access to their
personal data, and users already commonly restrict access and delete
apps they believe pose a privacy risk.\2\ Eighty-nine percent of users
have at some point denied features, such as microphone or location
access, to an app they did not trust, while 63 percent of users have
deleted an app outright due to privacy concerns.\3\ Because our member
companies are small and often young companies, they rely more heavily
on the privacy and security protections and controls that protect
consumers from bad actors than their larger, more established
counterparts--which depend more on brand name reputation and
recognition. Therefore, the Committee's and the Federal Trade
Commission's (FTC's) role in holding bad actors accountable is critical
to the success of App Association members. Specifically, we urge you to
take the following recommendations into account as you evaluate next
steps on consumer privacy:
---------------------------------------------------------------------------
\2\ 14. Deloitte, Trust: Is there an app for that? Deloitte
Australian Privacy Index 2019, (2019), available at https://
www2.deloitte.com/content/dam/Deloitte/au/Documents/risk/deloitte-au-
risk-privacy-index-150519.pdf.
\3\ Id. at 6
1. Congress Should Guide FTC Enforcement Authority and Resources.
Though the FTC is the main privacy enforcer at the Federal
level and has its hands full in recent years with the
proliferation of privacy, security, and other consumer
protection issues, it often lacks the statutory authority and/
or dedicated funding to carry out its mission to the fullest
potential.
2. Congress Should Avoid Forcing the FTC to Stretch its Own
Authority. The FTC's recent steps to bolster its leadership in
the privacy space, while certainly understandable, demonstrate
that the Commission is working with limited tools at its
disposal.
3. Congress Should Enact a Federal Privacy Framework. The single
most impactful policy decision Congress can make to combat
existing and future privacy harms is to enact comprehensive
privacy legislation that grants strong consumer rights to the
citizens of all 50 states simultaneously.
4. Congress Should Avoid Antitrust Measures that Presume the
Illegality of Platform-Level Privacy Protections. These
proposals could unintentionally render widely-adopted privacy
protections illegal, especially those that consumers use on
their smart devices, exposing consumer data to greater privacy
and security risks.
We deeply appreciate your leadership as the Senate Commerce
Committee continues to navigate the unprecedented COVID-19 pandemic and
works to get our economy back on track. As part of these efforts, we
ask that you continue the bipartisan work of crafting a single set of
rules governing the privacy practices of entities that generally fall
under the FTC's jurisdiction. Recent events and the forced shift of
daily and essential activities--including core healthcare and
communication services--to the digital space has underscored the need
for Congress to act decisively on this issue.
I. Congress Should Guide FTC Enforcement Authority and Resources
We support enhancing the enforcement capabilities and resources for
the FTC to stop and prevent consumer protection harms by bad actors.
The FTC needs more appropriate tools with Congress' direction to stop
consumer harms resulting from privacy and data security abuses in
particular, as those problems have proliferated and continue to
generate headlines and stoke constituent outrage.
Recent activity in the House Energy & Commerce Committee indicates
that lawmakers are seriously mulling increased funding for the FTC as
part of ongoing deliberations on the budget reconciliation package. In
particular, the House Energy & Commerce Committee voted to approve $1
billion in additional appropriations for the Commission to establish
new a privacy bureau to conduct work ``related to unfair or deceptive
acts or practices relating to privacy, data security, identity theft,
data abuses, and related matters.'' \4\ In general, App Association
members support vigorous management of the marketplace for bad actors,
especially those that circumvent rules in a way that reduces overall
trust in the app ecosystem or that threaten an even playing field in
the marketplace. However, in this case, we believe that Congress should
not act in half measures on privacy and that empowering the FTC with
augmented capabilities to address privacy harms should take the form of
a comprehensive Federal privacy regime. Simply establishing a new
bureau with additional resources does little to enhance enforcement
remedies, nor does it more clearly delineate the breadth and boundaries
of the FTC's authority on privacy practices.
---------------------------------------------------------------------------
\4\ See Committee Print by the Committee on Energy and Commerce,
Title III, Subtitle O, Sec. 31501, available at https://
privacyblogfullservice.huntonwilliamsblogs.com/wp-content/up
loads/sites/28/2021/09/BILLS-117pih-SubtitleO.pdf.
---------------------------------------------------------------------------
We also appreciate and understand the intent behind proposals
originating in the House Energy & Commerce Committee to bolster the
FTC's enforcement authority. At the same time, we continue to have
concerns with granting the Commission, or any new regulatory body,
general, undirected rulemaking authority to regulate privacy harms. The
same concerns extend to even more general rulemaking authority to
regulate all consumer protection harms under the FTC's purview. As
we've previously written, we recommend providing only narrow rulemaking
authority on the issue of privacy, as ``[t]he swath of the economy and
range of economic activities'' any privacy regulator would oversee is
``too broad for it to promulgate generally applicable rules that
successfully balance the finer conflicts of purpose in the many sectors
that would be subject to those requirements.'' \5\ A general grant of
rulemaking authority to define unfair or deceptive acts or practices in
or affecting commerce would completely delegate the exercise of
defining limits to the Commission's own powers to the agency itself--a
task better suited to Congress. A Democratic Congress imposed
additional procedural hurdles on the Commission's rulemaking authority
in 1980 \6\ for just this reason. The sheer breadth of its purview was
better adapted for an adjudicative approach and invited overreach with
rulemaking.
---------------------------------------------------------------------------
\5\ Letter from Graham Dufault and Madeline Zick to the Honorable
Anna Eshoo and the Honorable Zoe Lofgren, Members of Congress, re:
Draft Framework of Online Privacy Act of 2019 (Jul. 18, 2019).
\6\ See the Federal Trade Commission Improvements Act of 1980 (H.R.
2313, 96th Cong.).
---------------------------------------------------------------------------
Aside from potential overreach and its relative unsuitability in
regulating the dynamic markets the FTC oversees, general rulemaking
also creates substantial uncertainty and potential instability. For
example, an FTC controlled by one party might construct a carefully
segmented regulatory regime, categorizing consumer protection harms by
industry. The next Administration might have a completely different
regulatory philosophy and scrap the framework entirely. Without
guardrails in statute, challenges to such a complete deletion of
regulations might fail--according to jurisprudence evaluating Federal
agency decision-making, the courts grant ``Chevron deference'' to those
interpretations.\7\ The less there is for an agency to interpret, the
more leeway an agency has to define its own goals and decisions.\8\ The
result could be massive swings in consumer protection regulation from
one agency to the next (mainly unchecked by the courts), and in all
likelihood, a more purposeful focus on political aims and headlines
rather than targeting practices that are net harmful to consumers. Even
where Congress has explicitly outlined regulatory goals and purposes,
shifts in Administration have brought uncertainty, especially to more
dynamic markets. The effect could be much worse without clear statutory
guidance on the limits and purposes of FTC rules and enforcement.
---------------------------------------------------------------------------
\7\ See Chevron U.S.A., Inc. v. Natural Resources Defense Council,
Inc., 467 U.S. 837 (1984); Astrue v. Capato, 566 U.S. 541 (2012).
\8\ Id.
---------------------------------------------------------------------------
As Rob Coons, chief revenue officer of App Association member
Walker Tracker--a platform for people to compete with each other on
step challenges and similar wellness activities--points out, regulatory
uncertainty falls heavily on small companies like his. For example, as
states and governments overseas recently enacted new and differing
general consumer privacy laws, Walker Tracker went back to the drawing
board on its data processing agreements with employer clients. In turn,
Walker Tracker now turns down contracts under a certain dollar
threshold with smaller companies because the costs of uncertainty are
too high to justify working on smaller contracts. Further privacy
shifts at the state level coupled with regulatory pirouetting at the
Federal level would only worsen the situation for Walker Tracker and
other App Association members.
We have similar concerns with granting the Commission broad civil
penalty authority for any violation of the FTC Act, as legislation
pending in the House would do. Although we support granting the
Commission civil penalty authority for specific kinds of offenses,
including as part of a general privacy bill, civil penalties for cases
of first impression would chill innovation that has a net positive
effect on consumer welfare. For example, when the Commission first
encountered social media influencers, it quickly developed guidance
outlining proper disclosures for influencers who receive compensation
for endorsing products and services.\9\ A fast-developing business that
blurred the lines between personal networking and advertising,
``influencing'' cried out for FTC clarity on when it crosses the line
into deception. If the FTC had civil penalty authority--providing up to
$44,000 per violation--in cases where market participants have little
notice as to where the line is for social media influencing, the cost
of those potential penalties might have discouraged the practice
altogether. Although influencing may have gained an unserious
reputation,\10\ its emergence created legitimate livelihoods where none
previously existed. And while authorizing civil penalties for first
offenses--under the broad prohibitions in Section 5--would not
necessarily cause the FTC to shoot first and ask questions later, it
certainly could allow for such an enforcement approach.
---------------------------------------------------------------------------
\9\ Disclosures 101 for Social Media Influencers, Fed. Trade Comm'n
(Nov. 2019), available at https://www.ftc.gov/system/files/documents/
plain-language/1001a-influencer-guide-508_1.pdf.
\10\ Influencers in the Wild, @influencersinthewild, Instagram,
https://www.instagram.com/influencersinthewild/?hl=en (last visited
Jul. 25, 2021).
---------------------------------------------------------------------------
The risk of such a regime falls especially heavily on small
companies like App Association members. Marc Fischer, chief executive
officer of App Association member Dogtown Media, says the prospect of
civil penalties in undefined cases could cause longer timelines for
product and service development and higher insurance costs. Dogtown
Media is a mobile media development firm that has created more than 200
apps on behalf of clients in a wide variety of industries, and like
many of its peers, buys business risk insurance. As Marc points out,
those costs would likely increase with the prospect of monetary
penalties for first-time offenses, and the additional money he spends
on those premiums should instead go toward hiring and business
development.
The concerns are especially acute where companies, like Dogtown
Media, are forging cutting edge uses for advanced technologies like
artificial intelligence (AI). Publicly traded firms with high-powered
attorneys may be able to pay heavy fines and move on, but those
penalties could deal a devastating financial blow to small companies
like App Association members.
Other reform proposals on the House side that would enhance the
FTC's authority cause similar concerns for our member companies,
although we would support these limited expansions in some forms in the
context of a general privacy bill. For example, possible reforms could
expand the FTC's jurisdiction to cover non-profit entities or expand
FTC jurisdiction to cover common carriers under the Communications Act
(telecommunications and wireless carriers, for example). It may make
sense to enable the FTC to cover these kinds of entities in a more
limited context like a general privacy bill, but we would be concerned
about adding breadth to the FTC's purview generally. For Communications
Act common carriers and non-profit entities, we have seen provisions in
privacy bills that would place both categories into FTC jurisdiction--
while carving those common carriers out of Communications Act
jurisdiction--for the purposes of the privacy law and regulations
promulgated under it.\11\ The FTC is a more experienced privacy
enforcer than the Federal Communications Commission (FCC), so it makes
sense to task the FTC with monitoring privacy practices of wireless
carriers instead of the FCC. The targeted treatment of
telecommunications common carriers also avoids overlapping regulation
of certain entities by multiple Federal agencies. App Association
members demand high quality services at the lowest possible costs from
Internet service providers and understand that subjecting them to
duplicative regulatory compliance and penalties from multiple Federal
agencies could increase costs and diminish service quality.
---------------------------------------------------------------------------
\11\ See, e.g., SAFE DATA Act (S. 4626, 116th).
---------------------------------------------------------------------------
II. Congress Should Avoid Forcing the FTC to Stretch Its Own Authority
Absent action from Congress to grant additional rulemaking
authorities to the Commission, either through a comprehensive privacy
law or otherwise, the Commission is likely to take it upon itself to
reinterpret its existing authorities to better police the marketplace.
While certainly an understandable impulse in the face of a rapidly
evolving digital ecosystem and host of novel privacy harms, this
direction also predictably produces suboptimal outcomes for businesses
and consumers.
The recent policy statement issued by the FTC interpreting its
Health Breach Notification Rule is emblematic of the limitations and
issues that can arise when the Commission stretches its limited powers
beyond their intended purpose. During its most recent open meeting, FTC
Commissioners voted 3-2 to approve a policy statement affirming that
health apps and connected devices that collect or use consumers' health
information must comply with the Health Breach Notification Rule. The
FTC originally implemented its Health Breach Notification Rule in
September 2009, as required as part of the American Recovery and
Reinvestment Act of 2009, though it has yet to enforce the rule in its
more than 10 years of existence. The rule requires that vendors of
personal health records (PHRs) and their service providers notify
consumers and the FTC when a breach of identifiable health information
occurs. Failure to report such breaches carries civil penalties of up
to $43,792 per violation per day.
With its new policy statement, the Commission goes to great lengths
to elide the difference between a beach of security and a privacy
violation in hopes of expanding the rule's reach. Whereas the Health
Breach Notification Rule plainly states that it exists simply to ensure
that PHR providers and their service providers notify consumers ``when
the security [emphasis added] of their individually identifiable health
information has been breached,'' \12\ the policy statement asserts that
whenever a health app discloses sensitive health information without
users' authorization, this is a ``breach of security'' under the
rule.\13\ Notably, the Final Rule included several examples to
elucidate what exactly a data breach means, all of which reference
instances where information is taken or stolen without the provider's
knowledge.\14\ While we are sympathetic to the goal of preventing the
unauthorized sharing of users' sensitive information and agree that
there should be punishment when a company violates consumer trust, the
fact remains a data breach notification law is an odd vessel to
accomplish those goals.
---------------------------------------------------------------------------
\12\ Health Breach Notification Rule, 74 Fed. Reg. 42962 (Aug. 25,
2009), available at https://www.ftc.gov/system/files/documents/
federal_register_notices/2009/08/healthbreachnotification
rulefinal.pdf
\13\ Federal Trade Commission, Statement of the Commission On
Breaches by Health Apps and Other Connected Devices (September 15,
2021), available at https://www.ftc.gov/system/files/documents/
public_statements/1596364/
statement_of_the_commission_on_breaches_by_health_
apps_and_other_connected_devices.pdf
\14\ Health Breach Notification Rule, 74 Fed. Reg. 42966,
Sec. 318.2 (August 25, 2009), available at https://www.ftc.gov/system/
files/documents/federal_register_notices/2009/08/healthbreach
notificationrulefinal.pdf
---------------------------------------------------------------------------
The policy statement also stretches the definition of PHR, which is
defined in the rule to mean ``identifiable health information on an
individual that can be drawn from multiple sources [emphasis added] and
that is managed, shared, and controlled by or primarily for the
individual.'' The policy statement instead asserts that health apps are
covered by the rule even when the health information they collect comes
from a single source (such as an application programming interface) and
the user themself inputs non-health data, such as through a separate
calendar app. This directly contradicts existing FTC business guidance
on the very topic, which states that ``[i]f consumers can simply input
their own information on your site in a way that doesn't interact with
personal health records offered by a vendor--for example, if your site
just allows consumers to input their weight each week to track their
fitness goals--you're not a PHR-related entity.'' \15\
---------------------------------------------------------------------------
\15\ FTC Business Guidance, Complying with the FTC's Health Breach
Notification Rule, available at https://www.ftc.gov/tipsadvice/
business-center/guidance/complying-ftcs-health-breach-notification-rule
---------------------------------------------------------------------------
The Health Breach Notification Rule is simply a poor fit for
policing first-party privacy violations, and the FTC's new
interpretation could create numerous unintended consequences along the
way. For example, since the notification standard in the rule is
triggered when the entity discovers the breach, FTC's interpretation
seemingly blesses the underlying unauthorized sharing of data so long
as the provider proffers a notification after the fact. Or, instead,
should the provider notify consumers when it first discovers its own
plan to share the information with third parties? That either answer to
the policy statement's unanswered question generates a non-sensical
outcome speaks to the frailty of the Commission's interpretation.
To be fair, the Commission is genuinely seeking to address a rather
worrisome gap in our Nation's current privacy framework. And as
Commissioner Rebecca Kelly Slaughter indicated, she looks forward to
the Commission ``taking more action to limit the unfair collection and
use of data, especially through rulemaking.'' \16\ Commissioners want
to make the most of the authorities they have and we appreciate that
they are focused on healthcare privacy in particular. The productive
use of healthcare data no longer only occurs with healthcare providers
and other entities under the jurisdiction of the Health Insurance
Portability and Accountability Act (HIPAA). The creation and flow of
healthcare data outside the HIPAA umbrella has accelerated, even more
so during the COVID-19 pandemic, and although the FTC has been active
in enforcing its Section 5 authority, it does not possess first time
enforcement authority to punish particularly egregious offenders.
---------------------------------------------------------------------------
\16\ Statement of Comm'r Rebecca Kelly Slaughter Regarding the
Comm'n's Policy Statement on Privacy Breaches by Connected Health Apps,
Fed. Trade Comm'n, (Sept. 15, 2021), available at https://www.ftc.gov/
system/files/documents/public_statements/1596320/rks_remarks_on_
health_breach_policy_statement_09152021.pdf.
---------------------------------------------------------------------------
These limitations were painfully illustrated in the recent
settlement with Flo, a popular fertility and period tracking app that
the FTC alleged shared the ``health information of users with outside
data analytics providers after promising that such information would be
kept private.'' \17\ Moreover, not only did Flo mislead consumers about
its data sharing practices, but it also allowed third parties to use
the data it shared for their own purposes.\18\ In some cases, this
occurred in violation of the terms of service of those third parties,
the data having been shared via software development kits (SDKs) they
provided to Flo.\19\ These privacy missteps are especially concerning
given the highly personal nature of the health information at issue.
---------------------------------------------------------------------------
\17\ Press release, ``Developer of Popular Women's Fertility-
Tracking App Settles FTC Allegations that It Misled Consumers About the
Disclosure of their Health Data,'' Fed. Trade Comm'n (Jan. 13, 2021),
available at https://www.ftc.gov/news-events/press-releases/2021/01/
developer-popular-womens-fertility-tracking-app-settles-ftc.
\18\ Fed. Trade Comm'n, Flo Health, Inc., complaint (published Jan.
13, 2021), available at https://www.ftc.gov/system/files/documents/
cases/flo_health_complaint.pdf.
\19\ Id.
---------------------------------------------------------------------------
Although Flo's core deceptive statements in this case enabled the
FTC to enjoin further harmful conduct, existing statute limited the
Commission's authority to wield monetary penalties to punish the
company and signal to the marketplace that similar violations would not
be tolerated. This is especially troublesome given that each and every
headline detailing the deceptive conduct of firms using healthcare data
outside the HIPAA umbrella threatens to further erode consumer trust, a
key ingredient for success for our small business member companies. The
healthcare innovations our member companies produce--from heart
condition detection to chronic condition monitoring to simply managing
digital health information across health systems--are far too important
for us to let them fall victim to foundering consumer trust in digital
health earned by bad actors.
From our perspective, the answer is not for the FTC to create novel
or tenuous interpretations of its existing rules nor is it to extend
HIPAA to cover healthcare tools and services not currently subject to
HIPAA. As we've shown, the Commission will inevitably encounter
roadblocks as it seeks to retrofit old rules to address new use cases.
Meanwhile, HIPAA's overarching purpose is to ensure the portability of
health data between covered entities and business associates, and it
was not primarily designed to give consumers better control over their
own healthcare data or to manage the risks healthcare data processing
poses.
III. Congress Should Enact a Federal Privacy Framework
In our opinion, the best way to improve FTC enforcement
capabilities within the privacy sphere is to specifically grant those
authorities as part of a Federal privacy framework.
We urge the Committee to establish a set of Federal requirements
that puts in place baseline consumer rights and curbs data processing
activities that expose consumers to undue privacy risks. For example,
legislation introduced by the Committee chair and ranking member, as
well as bipartisan draft legislation circulated by House Energy and
Commerce Committee staff last year were a positive start representing
substantial agreement on aspects of privacy that previously struggled
for consensus. We urge you to continue the work on this effort and we
stand ready to support negotiations and oversight activities around it.
Specifically, the App Association supports a Federal framework with
the following attributes:
Transparency
Federal privacy requirements should ensure businesses
are transparent about the collection and use of information
about consumers. App Association members compete on privacy
and work hard every day to develop better ways to
communicate with their users about privacy and give them
meaningful choices. Consumers should have a clear
understanding of the types of personal data they are
sharing, and which companies are using that data and how.
Strong consumer rights
A Federal law should empower consumers to exert more
control over their personal information, including the
rights to access, correction, and deletion of such
information. Sensitive personal information should also be
subject to some limits on processing activities that pose
too great a risk to consumers, which is not outweighed by
countervailing benefits.
Accountability
As the FTC has long argued, privacy should be built
into the design and functionality of products and services.
If privacy is a functional feature of a product or service,
the protections, notices, and options it provides may shift
and take on different forms depending on the context.
Federal law should support the dynamic functionality of
privacy by design by making companies accountable for sound
privacy practices while allowing them to innovate on the
details of their privacy programs.
A single, national standard
New privacy legislation in Congress should establish a
single, national standard and avoid creating a patent
troll-style business model for trial attorneys to sue and
settle with small companies through a broad private right
of action. Our member companies may include the smallest
software and connected device companies, but they each
serve consumers across the Nation and around the world.
Complying with a patchwork of state laws would be
unnecessarily burdensome because their activities are not
limited by any single state's borders. If privacy
legislation does include a preemption provision, we would
support limited rulemaking authority within statutory
guidelines and limits for the FTC and allowing state
attorneys general to enforce the bill's provisions.
Scalable requirements
Federal privacy requirements should be scalable
depending on the scope of an enterprise or data processing
activities and the size and compliance capabilities of
companies. App Association members do not want to be exempt
from requirements--they want to comply with strong,
flexible, and reasonable requirements.
Additionally, though several promising frameworks passed into law
this year at the state level, including in Virginia and Colorado, we do
not recommend that Congress wait around until the states cobble
together a privacy patchwork that covers the Nation. Despite recent
progress, at the current pace of passage, it would take decades for the
individuals of all 50 states to gain coverage. Needless to say,
Congress should not stand by idly as data abuses continue to
proliferate in the states that opt against or are unable to pass a law.
Moreover, the more states that pass laws the greater the
ambiguities and contradictions for businesses and consumers. Each of
the three state privacy laws currently on the books include varying
definitions for key terms, applicability thresholds, and sectoral
exemptions. As more states enter the fray with their own laws, those
nuances are only likely to multiply which makes compliance
exponentially more difficult for businesses that operate across state
lines (or have consumers in multiple states), while also increasing
consumer confusion as to how their rights may or may not apply in a
given scenario.
Finally, each new state law also improves the odds of a dormant
Commerce Clause challenge, especially insofar as a new law directly
contradicts another state privacy law or takes aim at a specific
industry.\20\ While this issue has yet to rear its head given the low
number of state privacy proposals to make it from bill to law thus far,
a constitutional challenge under the Commerce Clause could quickly
stall the moderate progress at the state level bringing us back to
square one. A preemptive Federal law is the only option that can avoid
legal uncertainty, while effectuating uniform consumer rights across
the Nation at the same time.
---------------------------------------------------------------------------
\20\ Jennifer Huddleston and Ian Adams, ``Potential Constitutional
Conflicts in State and Local Data Privacy Regulations'', Regulatory
Transparency Project of the Federalist Society, (December 2, 2019),
available at https://regproject.org/wp-content/uploads/RTP-Cyber-and-
Privacy-Paper-Constitutional-Conflicts-in-Data-Privacy-final.pdf
---------------------------------------------------------------------------
IV. Congress Should Avoid Antitrust Measures that Presume the
Illegality of Platform -Level Privacy Protections
Software platforms (app stores together with mobile operating
systems) play a key role in managing an app ecosystem that offers
consumers a wide variety of options, while minimizing privacy risks.
These management functions form the core of the bundle of developer
services App Association members purchase from platforms, without which
consumer trust would be undermined. Some proposals in Congress, like
the American Choice and Innovation Online Act (H.R. 3816) would
presumptively prohibit these management functions, ostensibly to
address complaints from competitors with alternative products and
services on the platform. H.R. 3816 does this by prohibiting a software
platform from conduct that ``excludes or disadvantages the products,
services, or lines of business of another business user . . . relative
to the [platform's] own'' \21\ offerings. While the bill would benefit
some large competitors like Epic Games and Spotify, it would harm small
app makers like App Association members as well as consumers because
they would erode the trust consumers have in conducting digital
commerce in the app marketplaces.
---------------------------------------------------------------------------
\21\ American Choice and Innovation Online Act (H.R. 3816, 117th).
---------------------------------------------------------------------------
H.R. 3816's prohibitions create a presumption that many platform-
level privacy controls are illegal, which platforms could overcome only
in especially narrow circumstances. The bill would essentially allow
platforms to overcome that presumption only by showing that any measure
they take was ``narrowly tailored, could not be achieved through a less
discriminatory means, was nonpretextual, and was necessary'' \22\ to
provide privacy. This construct is in tension with the FTC's focus on
privacy by design and its privacy enforcement against bad actors on the
app stores. It is also inconsistent with App Association members' calls
for platforms to expeditiously remove harmful and fraudulent
content.\23\ In fact, a recent FTC settlement illustrates how a
statutory mandate for app stores to allow unvetted software onto smart
device operating systems could harm consumers' privacy and security. On
September 1, 2021, the FTC published an initial complaint, along with a
unanimously approved settlement, with SpyFone.\24\ According to the
complaint, SpyFone marketed itself as a surveillance app, enabling
purchasers to track targets in a variety of ways, including by spying
on live location, web history, contacts, pictures, calendar, files
downloaded onto a device, notifications, e-mails, video chats, and even
social media posts.\25\ The company explained to its users how to
download the app on a target's device, hide the app so the target would
not notice its presence, and bypass Android operating system controls
in order to track the target without their knowledge.
---------------------------------------------------------------------------
\22\ American Choice and Innovation Online Act, Sec. 2(c)(1)(B)
(H.R. 3816, 117th).
\23\ Statement of Morgan Reed, president, ACT | The App
Association, on App Store Review Fraud Scheme (Feb. 11, 2021),
available at https://actonline.org/statements/.
\24\ Press release, Fed. Trade Comm'n, ``FTC Bans SpyFone and CEO
from Surveillance Business and Orders Company to Delete All Secretly
Stolen Data'' (Sept. 1, 2021), available at https://www.ftc.gov/news-
events/press-releases/2021/09/ftc-bans-spyfone-and-ceo-from-
surveillance-business.
\25\ Fed. Trade Comm'n, Complaint, In the Matter of Support King,
LLC, and Scott Zuckerman, 192 30003 (Sept. 1, 2021), available at
https://www.ftc.gov/system/files/documents/cases/
192_3003_spyfone_complaint.pdf (SpyFone Complaint).
---------------------------------------------------------------------------
Stalkerware apps could easily claim that iOS and Android have
similar offerings because their legitimate uses, as marketed, involve
parents managing their children's devices. In this scenario, Android
clearly disadvantages SpyFone versus its own offerings by forcing it to
go through onerous steps in order for a purchaser to make use of the
app. For example, Android forces SpyFone to have its purchasers enable
the sideloading capability, which triggers a warning from Android that
``[i]f you download apps from unknown sources, your device and personal
information can be at risk. Your device could get damaged or lose data.
Your personal information could be harmed or hacked.'' \26\ Certainly,
these additional steps and a warning like this hurt SpyFone's business.
Likewise, iOS disadvantages SpyFone versus its own offerings because it
does not allow SpyFone on iOS devices at all. And the affirmative
defense H.R. 3816 provides in cases where a software platform needs to
remove an app for violating a law or threatening consumer privacy does
nothing to help because as drafted it is so inaccessible as to
discourage any sort of reliance on it. The overall effect of H.R. 3816
in the stalkerware context is to create a default rule barring the
removal of stalkerware like SpyFone from a platform, as well as any
privacy-related barriers that prevent stalkerware from taking advantage
of consumers, unless a platform is able to overcome that presumption,
likely in narrower forms, on a case-by-case basis.
---------------------------------------------------------------------------
\26\ SpyFone Complaint at para. 6.
---------------------------------------------------------------------------
The bottom line is that taking a nondiscrimination sledgehammer to
software platforms' role in removing bad actors rolls out the red
carpet for apps like SpyFone. More importantly, by widening the avenues
for fraudsters on app stores, an overbroad Federal nondiscrimination
regime would narrow the path for smaller app makers like App
Association members. It would also make the FTC's job in enforcing the
statutory prohibition on unfair or deceptive acts or practices that
much more difficult, as more bad actors enter the fray and less of
their activity is discoverable because platforms' hands would be tied.
Meanwhile, as consumers adjust to a more fraud and malware-ridden
marketplace, they would rationally shift away from experimentally
downloading apps with the shortest histories and smallest preexisting
distribution in favor of bigger brands. What is now a high trust
environment, thanks in no small part to rigorous gating, would then
evolve into a no-trust environment, which disproportionately harms
smaller companies while benefiting the platform's largest ``business
users.'' The effect would be similar with measures like the Open App
Markets Act (S. 2710), which takes a narrower approach but still
creates a presumption that platform gating functions to protect privacy
are illegal.
We urge the Committee to avoid measures like these in their current
form, because they would move Federal privacy policy in the opposite
direction from where it should be heading. Congress should not prohibit
(or presume the illegality of) privacy controls that are proven to
work; instead, it should require companies to adopt privacy
protections. Otherwise, Federal law would undo the privacy-protective
developments that enable online commerce, forcing consumers to accept a
single, more open approach to security, or even worse, bring us back to
an early 2000s online experience with fewer options, less meaningful
privacy protections, and diminished security.
V. Conclusion
We appreciate that the Committee seeks our views on approaches to
bolstering the FTC's ability to address consumer privacy more
effectively in the wide variety of industries it oversees and in which
App Association members compete. Federal privacy law is overdue for an
update to meet the challenges of the 21st century. App Association
member companies want stronger Federal privacy requirements in
particular, including a single set of national rules governing
authorized data processing activities and data security practices. This
Committee has made unprecedented bipartisan progress toward agreement
on a national privacy law, and we urge that this hearing and further
Committee activities help inform that process.
______
Appendix: App Economy Innovators in Your Districts
Majority
Chair Maria Cantwell (WA)
Company: Mighty Call
Located in Spokane, Mighty Call is a cloud-based communications and
customer service platform founded in 1999. Their virtual phone system
is designed specifically for small businesses and remote teams making
it easy for teams to connect from anywhere through mobile and desktop
apps. Their apps provide unique features like call availability
windows, scheduling services, and the ability to mask personal cell
numbers, given that privacy is a core pillar of Mighty Call's service.
Senator Amy Klobuchar (MN)
Company: Vemos
Located in the Twin Cities and founded in 2013, Vemos is a platform
solution for bars, restaurants, and other venues as a one-stop-shop for
the digital tools needed to manage and grow their businesses. Operating
with only eight full-time employees, Vemos found a way to harness and
present a venue's data in a humanized way, which helps venues
understand who their customers are and how to market to them
effectively.
Senator Richard Blumenthal (CT)
Company: Pixellet
Located in Stamford, Connecticut, Pixellet is a full-service web
and mobile development and design firm with dozens of offered services,
including digital marketing and ecommerce. Founded in 2014, Pixellet
only has one employee and has served a variety of industries including
real estate, health care, financial services, and education, among
others.
Senator Brian Schatz (HI)
Company: Smart Yields
Founded in 2015 and headquartered in Honolulu, Smart Yields is an
intelligent agriculture software that helps to connect farmers and
agricultural researchers to increase crop yield, revenue, and
productivity. With fewer than 10 employees, Smart Yields is committed
to helping Hawaii meet their commitment to doubling food production by
2030 and other communities achieve similar goals around the world.
Senator Ed Markey (MA)
Company: Podimetrics
Established at the Massachusetts Institute of Technology in 2011,
Podimetrics is a medical technology services company that develops
hardware-enabled, thermal-imaging solutions to predict and prevent
diabetic foot ulcers. The Podimetrics SmartMatTM monitors
the temperature of diabetes patients' feet to identify temperature
asymmetries that signal the development of a foot ulcer. Coupled with a
monitoring service, the Podimetrics Remote Temperature Monitoring
SystemTM uses the wireless SmartMatTM to notify
patients and clinicians of temperature asymmetry and inflammation, the
first signs of foot ulcers preventing amputations and other health
complications.
Senator Gary Peters (MI)
Company: Workit Health
Workit Health is a women-owned digital therapeutics company based
in Ann Arbor that is focused on treating addiction. Their Workit Health
app connects patients with clinicians and a community, allowing
individuals to receive the communal support necessary for addiction
treatment, and routine contact with mental health and clinical care
givers in the discreet privacy and safety of their home or preferred
treatment site.
Senator Tammy Baldwin (WI)
Company: Birdwell Solutions
Founded in Madison in 2019, Birdwell Solutions is a concierge
software development agency focused on working with entrepreneurs and
startups to build web, digital, and mobile products that help their
clients launch and grow their business. With a team that ranges from
full stack development to design and project management, Birdwell
Solutions is working to foster and support the entrepreneurial
community in Wisconsin.
Senator Tammy Duckworth (IL)
Company: Devscale
Founded in 2018, Devscale is a custom app development company with
a focus on product strategy. With clients that range anywhere from
small to large, Devscale helps their clients through problems in their
digital strategy with a trained eye on unique user experiences and a
transparent development cycle. Although headquartered in Chicago,
Devscale has coders all over the world. They take clients all the way
through their creative process; from defining the project through user
experience stages and development, to the final rollout.
Senator Jon Tester (MT)
Company: Guidefitter
Headquartered in Bozeman, Guidefitter is an online and mobile
platform that connects people with guides, nature experts, and
sportspersons for safe and guided natural expeditions and sport
including hunting, fishing, hiking, and camping. The platform also
allows the experts to promote their business or experience and
facilitates payment for merchandise as well as the guided tour or
event.
Senator Kyrsten Sinema (AZ)
Company: Devsoft Group
Devsoft Group is a one-man custom development firm founded in 2010.
Focused on clients in manufacturing and energy, Devsoft Group works
closely with their clients, building web, cloud, SaaS, and mobile and
database solutions that meet the unique needs of each client's projects
and business needs.
Senator Jacky Rosen (NV)
Company: Pigeonly
Pigeonly is an online and mobile platform that connects inmates
with their loved ones. Their services provide a central place to send
letters, pictures, cards, and more. Through the platform, families can
also call their inmate at a lower cost and stay in touch throughout
their incarceration. The company's mission is to improve communication
and community for those incarcerated and to encourage families to stay
in touch with their inmates by simplifying and streamlining the
process.
Senator Ben Ray Lujan (NM)
Company: Snowball
Snowball is an all-in-one fundraising platform that connects users
with more than 15,000 nonprofits across the country. The app has two
parts. The first is for donors, giving them information about the
nonprofits in Snowball's network, donation opportunities, and notice of
emergency relief needs, and provides a secure place to track donations
and save credit card information. The second, for nonprofits, helps to
keep track of donors, grow their donor base, and communicate
opportunities.
Senator John Hickenlooper (CO)
Company: Atelier
Atelier is a mobile app that allows users to create their own
interior design, discover planet-conscious makers of furniture,
textiles, art, and more. Through the app, users can design a room and
then create 3D images of their designs giving them a clear sense of the
finished process. The app also allows users to purchase the pieces they
used in their design, supporting small and eco-conscious creators.
Senator Raphael Warnock (GA)
Company: Rimidi
Rimidi creates mobile apps that work directly within electronic
health records (EHR) to combine patient-generated health data with
clinical data, allowing for patient-specific clinical insights. They
have developed a COVID-19 screening application based on the widely
accepted Fast Healthcare Interoperability Resources (FHIR) standard for
health systems to identify and flag at-risk patients via survey prior
to existing appointments. Their tool enables health systems to mitigate
the spread of COVID-19, as well as optimize treatment.
Minority
Ranking Member Roger Wicker (MS)
Company: Buzzbassador
Buzzbassador is a management platform for brands that uses
ambassadors to promote their products across social media. The platform
gives brands the tools to track social media posts, engagement metrics,
sales, commission payouts, and more for each of their ambassadors and
provides simple analytic reports and a central dashboard.
Senator John Thune (SD)
Company: Infotech Solutions, LLC
Infotech Solutions, LLC is a concierge IT service helping
businesses with everything from implementing a new software system or
network to maintenance, general IT issues, security, and more. The
company also offers an app across platforms that helps their clients
troubleshoot IT issues, connect with their IT service team, and more.
Senator Roy Blunt (MO)
Company: Topik
In 2015, two friends co-founded Topik, a mobile blogging
application that makes it easy for anybody to create and share blog
posts on an easy-to-use mobile platform. Based in St. Louis, Missouri,
Topik is completely self-funded and, with only two employees, is set to
launch their first mobile app later this year.
Senator Ted Cruz (TX)
Company: For All Abilities
For All Abilities is a software platform that helps companies
address and provide for their employees with disabilities. The platform
assesses employees and then prescribes and trains them to use
individualized supports and accommodations that meet ADA requirements.
Senator Deb Fischer (NE)
Company: Quantified Ag
Quantified Ag is a tracking device and platform to monitor cattle
health and enables farmers to quickly remove sick or injured cattle
from the rest of the herd to treat them quickly and prevent further
infection. The device, worn on the cow's ear, monitors the cow 24/7 and
connects seamlessly with the Quantified Ag mobile app allowing ranchers
and farmers to easily monitor their cattle throughout the day. Recently
acquired by Merck, Quantified Ag built and continues to run the
business from Nebraska.
Senator Jerry Moran (KS)
Company: ActiveLogic Labs
ActiveLogic Labs is an innovative digital development agency
headquartered in Kansas City with a growing presence across the United
States, including an office in the Chicago area. They provide a number
of services from web and desktop software development to mobile app
development, all with a specific focus on user interface design and a
seamless user experience.
Senator Dan Sullivan (AK)
Company: StepAway
StepAway is a mobile application to help those with addiction
manage their day-to-day and make better decisions about their daily
habits to help prevent relapses. The app is primarily centered around
those who are unable to seek addiction treatment services but are
looking to make a change in their drinking habits. The app helps track
daily progress while also giving users insight in their triggers, and
provides useful information on how to make different and better
decisions related to their alcohol use in a safe and private space.
Senator Marsha Blackburn (TN)
Company: Quiet Spark
Established in 2011 in LaVergne, Tennessee, a wife and husband team
founded Quiet Spark after noticing their son's issues with spelling.
Their first app was SuperSpeller, an iOS app that makes learning
spelling fun for children through learning games and reward features.
They have also created other apps that help users keep track of their
lives through categories like exercise, reading time, scheduling,
homework, and more.
Senator Todd Young (IN)
Company: InGen Technologies, Inc.
InGen Technologies, Inc., is a software consultancy company focused
on improving customer experience for their clients and improving data
collection and analysis tools to improve their clients' use and
understanding of data analytics. The company's mission is to unite all
aspects of their clients' digital presence from apps to the web in
order to improve overall digital marketing and cohesiveness.
Senator Mike Lee (UT)
Company: 1564B
Located in Salt Lake City, 1564B is a one-man management consulting
group that provides advice on marketing and content development as it
relates to technical markets, like the Internet of things (IoT).
Founded in 2014, 1564B's clients range from startups and growing
companies to global corporations.
Senator Ron Johnson (WI)
Company: Xorbix Technologies
Founded over 20 years ago with a location in Hartland, Xorbix
Technologies is a custom software development firm helping businesses
meet their customers online. They offer a number of services such as
full-service custom software development, mobile app development, and
general IT consulting.
Senator Shelley Moore Capito (WV)
Company: TMC Technologies
TMC Technologies is an IT services company focused on helping their
clients, both Federal and local, with program and project management,
scalable system and software engineering, IT infrastructure design and
management, and network and telecom services. TMC Technologies has
focused a lot of their IT work in their own backyard providing IT
services for West Virginia companies, especially small business owners,
looking to bring their company into the digital age.
Senator Rick Scott (FL)
Company: Thinkamingo
Founded in 2011, Thinkamingo is an educational app company focused
on getting kids excited about writing. Their app, Story Dice, helps
give kids ideas for stories, while their apps Lists for Writers and
Story Spark help kids lay out their story, build out their characters
and plot points, and give them the tools they need to improve their
overall writing and story structure.
Senator Cynthia Lummis (WY)
Company: BlackFog
BlackFog is a cyberthreat prevention company that uses a unique
combination of behavioral analysis and data exfiltration technology to
identify, stop, and prevent future data hacks, unauthorized data
collection, and more across mobile and web endpoints. Their services
protect their clients and their clients' most sensitive data and
privacy while also strengthening their regulatory compliance.
The Chairwoman. Thank you to all the witnesses. I know
there is a vote that has started, so I am going to ask my
questions and then have Senator Wicker and Senator Baldwin ask
theirs, and then I am going to run and vote, and then we will
be back. And hopefully our colleagues who were over voting now
will join us.
I want to make something--I heard what everybody said in
their testimony. So, but just so we have clarity. So do each of
you support more resources at the FTC similar to what we have
been talking about as it relates to this reconciliation item on
the FTC having more of an enforcement--privacy enforcement
authority? Professor Vladeck?
Mr. Vladeck. Yes.
Ms. Ohlhausen. Yes, the FTC needs more resources.
Mr. Reed. Yes, the FTC needs more resources.
The Chairwoman. Mr. Soltani? Mr. Soltani, I am pretty
sure--do you support more resources like a privacy bureau at
the FTC?
Mr. Soltani. Correct. Yes, I do.
The Chairwoman. OK. So the question seems to be, and
actually Ms. Ohlhausen, I also heard you also say you were for
also first time civil penalties, so----
Ms. Ohlhausen. Yes.
The Chairwoman.--so everybody, I think, also agrees on
that, is that right? Everybody agrees on first time civil
penalties.
Mr. Vladeck. Yes.
The Chairwoman. Mr. Reed.
Mr. Reed. Yes, as part of a Federal privacy law, I think
that it is worthwhile to make that available.
The Chairwoman. OK, so the issue is that right now we have
a volume of cases, and we have a technology gap, and we don't
have people to do compliance. So, while we are--what do we need
to focus on when we say to the FTC, here are resources?
Definitely want to talk about a new privacy law, but what
do we need to focus on to make sure that the resources at the
FTC really focus on these issues, when Mr. Soltani mentioned--I
mean, my impression is we basically have been using current
tools to enforce basically deception in current privacy
practices and then having fines for failure--but as Mr. Soltani
says, the compliance of that post that seems to be greatly
lacking. So, Mr. Vladeck, what does this agency need to do to
focus this?
Mr. Vladeck. Well, as I said in my written testimony, the
FTC needs resources. One area in which we need resources is
being able to hire more technologists and engineers. I don't
think the FTC has ever had a cohort as many as 10 technologists
on staff. Ashkan was the second technologist we hired, and that
was in 2009. So there is really no end to the need by the FTC
for resources. But when it comes to enforcement, oversight of
existing consent decrees, there is a division within the Bureau
of Consumer Protection that has about 45 staff members that
oversees more than 1,000 ongoing consent orders or litigated
orders imposed by a court. And just the volume of orders that
need to be sort of reviewed and subject to reporting
requirements overwhelms the ability of staff to do the kind of
surveillance of a company under orders that is required.
And so this is one area where, you know, resources are
desperately needed because, you know, take a look at Facebook.
It is one of the first real major privacy orders we engaged in.
We did not have technologists and staff who could spend time
reviewing closely what the company was doing. And that is an
endemic problem. And it is going to be an enduring problem
unless Congress devotes more resources to the FTC.
I was a triage nurse for four years, really. That was what
I did. I tried to reallocate resources to the most dire, you
know, to the most dire function that the FTC could----
The Chairwoman. Well, I think that--I think I want to ask
Mr. Soltani about this, because I worry that people are paying
the fines and then going back to practices, knowing that we
don't have time for compliance. And this is everywhere, you
know, in the Federal Government. Senator Wicker and I had to
work very hard on aviation reform, which was the same issue of
what did the FTC--I am sorry, the FAA have as far as
technologists to really understand the technology that they
were reviewing.
So we need an upgrade across the Federal Government, but
clearly, if we want compliance on safety--Mr. Soltani, since
you mentioned a broad group of people, but don't we just need
basic people who understand software operations and technology?
Mr. Soltani. It depends on the scope of the order. But
absolutely, I think having expertise in, for example, the
matters under order. So Facebook has a compliance program that
they rely on a third party assessor for, and in some cases the
FTC doesn't even automatically receive those. They have to
request those assessments.
But then you, as David mentioned, you need not only
resources, but the right resources that can actually attest to
whether these assessments are accurate, are done in the right
scope, or even whether the assessor has the skills necessary. A
lot of them are just checklists. So I think we need expertise,
for example, on data security, APIs assessments in those groups
overseeing the orders, compliance with the orders.
The Chairwoman. Yes, I would--anyways, I would like to see
a more formal list from somebody, but we will get--we will keep
moving on the process and then seeing--yes, Senator--I mean,
Mr. Vladeck.
Mr. Vladeck. Yes, can I add just one quick thing. You know,
in most privacy cases there is no fine or nothing in terms of
redress for the first violation. There is no original fining
authority because privacy harms, you know, are not monetary.
You know, first--you know, the first violation is basically
sort of, you know, consequence free other than the ongoing
order.
The Chairwoman. I will get to you, Mr. Reed, but I--Senator
Wicker, go ahead and then I will get back to you when we come
back. And then Senator Baldwin.
Senator Wicker. Get your steps in, Senator Cantwell. Thank
you very much. First of all, I have in my hand an article from
today's Wall Street Journal, ``FTC Weighs New Online Privacy
Rules'' by John D. McKinnon and Ryan Tracy, and I ask unanimous
consent that it be placed in the record at this point. Hearing
no objection--thank you.
[The information referred to follows:]
FTC Weighs New Online Privacy Rules
Agency is looking at strengthening rules that govern how digital
businesses collect user data
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
The FTC has signaled interest in taking further action on digital
privacy concerns, particularly with regard to children.
PHOTO: GABRIELLA DEMCZUK FOR THE WALL STREET JOURNAL
By John D. McKinnon and Ryan Tracy--Updated Sept. 29, 2021 2:00 pm ET
WASHINGTON--The Federal Trade Commission is considering
strengthening online privacy protections, including for children, in an
effort to bypass legislative logjams in Congress.
The rules under consideration could impose significant new
obligations on businesses across the economy related to how they handle
consumer data, people familiar with the matter said. The early talks
are the latest indication of the five-member commission's more
aggressive posture under its new chairwoman, Lina Khan, a Democrat who
has been a vocal critic of big business, particularly large technology
companies.
Congressional efforts to assist the FTC in tackling perceived
online privacy problems was the focus of a Senate Commerce Committee
hearing Wednesday. If the agency chooses to move forward with an
initiative, any broad new rule would likely take years to implement.
In writing new privacy rules, the FTC could follow several paths,
the people said: It could look to declare certain business practices
unfair or deceptive, using its authority to police such conduct. It
could also tap a less-used legal authority that empowers the agency to
go after what it considers unfair methods of competition, perhaps by
viewing certain businesses' data-collection practices as exclusionary.
The agency could also address privacy protections for children by
updating its rules under the 1998 Children's Online Privacy Protection
Act. And it could use its enforcement powers to target individual
companies, as some privacy advocates urge.
The FTC might choose not to move forward with any major privacy
initiative. And action could be delayed as agency Democrats wait for
confirmation of President Biden's newest nominee to the commission,
privacy advocate Alvaro Bedoya.
But since taking office June 15, Ms. Khan has made a number of
moves to lay the groundwork for potential rule making, including by
voting with the FTC's two other Democrats to change internal procedures
to expand her control over the rule-writing process. Mr. Biden has
ordered the FTC to look at writing competition rules in a number of
areas, including ``unfair data collection and surveillance practices
that may damage competition, consumer autonomy, and consumer privacy.''
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Democratic FTC Chairwoman Lina Khan has taken a number of steps to
lay the groundwork for potential rule making.
PHOTO: GRAEME JENNINGS/PRESS POOL
This week, the progressive-leaning advocacy group Accountable Tech
petitioned the agency to ban ``surveillance advertising'' as an unfair
method of competition, defining the practice as targeted advertising
based on consumers' personal data. As an example of the harms that an
alleged lack of competition among online platforms can cause, the group
cited a recent Wall Street Journal article about the impact of Facebook
Inc.'s Instagram app on teens' mental health.
``The ability and incentive to extract more user data to unfairly
monetize, even at the expense of children's wellbeing, has proven too
great a competitive advantage for dominant surveillance advertising
firms to pass up,'' the group's petition said.
Facebook has said it faces stiff competition and that the Journal
mischaracterized internal research on Instagram's impact. It said this
week that it was pausing work on a version of the photo-sharing
platform designed for children under 13.
If the FTC decides to write a privacy rule, it would first have to
publish a draft and seek public comment. In some circumstances, the law
requires the agency to take additional, time-consuming steps such as
asking for public input before even publishing a draft of a proposed
rule.
Such efforts could get a boost from congressional Democrats seeking
more funding for the agency.
Sen. Maria Cantwell (D., Wash.), who chairs the Commerce Committee,
argued Wednesday for augmenting the FTC's resources to better address
problems of the online economy.
``The truth is that our economy has changed significantly, and the
Federal Trade Commission has neither the adequate resources nor the
technological expertise at the FTC to adequately protect consumers from
harm,'' she said in her opening statement.
Some Republicans said it wouldn't make sense to add significant new
funding to the FTC without passing new laws.
Earlier this month, House Democrats proposed giving the FTC a $1
billion budget to fund a new bureau dedicated to overseeing ``unfair or
deceptive acts or practices relating to privacy, data security,
identity theft, data abuses, and related matters.'' That proposal will
be subject to negotiations as the narrowly Democratic-led Congress
looks to pass a broad new spending plan this fall. Meanwhile, several
Senate Democrats wrote to Ms. Khan on Sept. 20 asking her to write
rules protecting consumers' privacy.
The lack of a broad Federal law protecting consumers' privacy has
become a bigger concern for advocates as online platforms and others
have amassed vast troves of consumers' search data and other
information. Many privacy advocates are particularly worried about
children, who can be more vulnerable to targeted online advertising and
attention-grabbing algorithms.
Legislation to establish broad-based Federal privacy protections
has stalled again in Congress this year over a range of concerns.
Efforts to update an existing 23-year-old Federal privacy law covering
younger children haven't gained significant traction among lawmakers.
Critics say the Children's Online Privacy Protection Act and the
FTC-written rules that enforce it are ineffective and out-of-date,
concerns that have helped lead the agency's newly empowered Democrats
to focus more on taking further action on privacy.
``I think it's a really, really important area for attention,''
Democratic FTC Commissioner Rebecca Slaughter has said of adopting
broad-based privacy rules. She said at a July congressional hearing
that a potential rule could target suspected online harms to children,
adding, ``That is an issue that's near and dear to my heart.''
Ms. Khan and fellow Democratic commissioners indicated at that
hearing that the agency would be giving more attention to how platforms
might be abusing children's privacy, as many kids have spent more time
online during the Covid-19 pandemic. Democratic Commissioner Rohit
Chopra added that the FTC should examine the underlying business models
that can lead to privacy abuses.
Republican Commissioner Christine Wilson has become an advocate for
Federal privacy legislation, saying that consumers don't understand how
their data is collected and monetized, creating what she terms a
``market failure.''
``Without this information, they cannot analyze the costs and
benefits of using different products and services,'' she said last week
at Duke University. ``And the risks to consumers from the unchecked
collection of their data have intensified in recent years.''
Write to John D. McKinnon at john.mckinnon@wsj.com and Ryan Tracy
at ryan.tracy@wsj.com
Appeared in the September 30, 2021, print edition as `Federal Trade
Commission Weighs Stronger Online Privacy Safeguards'.
Senator Wicker. And it starts out, the Federal Trade
Commission is considering strengthening online privacy
protections, including for children, in an effort to bypass
legislative logjams in Congress. Ms. Ohlhausen, have--this just
came out this morning. Have you had a chance to read that?
Ms. Ohlhausen. I haven't had a chance to read that. But I
have heard some encourage that the FTC proceed through
rulemaking.
Senator Wicker. OK, and I take it from your testimony that
you don't think that is a very good idea?
Ms. Ohlhausen. I don't think it gives the FTC the necessary
statutory authority from Congress.
Senator Wicker. As you pointed out in your testimony. Mr.
Vladeck seems like Ms. Ohlhausen makes a pretty good case that
really the FTC should wait for Congress no matter how much of a
logjam we have, that really is ideal that Congress act on this
rather than the agency. What do you think about that?
Mr. Vladeck. Well, I agree that Congress is the right body
to finally decide what the law should be. I completely agree
with that. I am not sure--and you know, and I don't think an
FTC rule is anyone's first choice.
Senator Wicker. And she makes up--she makes some pretty
good points about what an FTC implemented rule would lack in
terms of a force and effect. Do you agree with her on what she
said in her statement?
Mr. Vladeck. No, I think she's incorrect about the
preemption issue. I think in the FTC rule promulgated under
Section 18 would preempt State law that conflicts with the FTC
rule. There is a lot of Supreme Court jurisprudence on
preemption. That one issue, I think Ms. Ohlhausen is incorrect.
Senator Wicker. That is a pretty powerful agency that can
do that. What do you think, Mr. Reed? Have had--have you read
the article? Anyone read the article?
Mr. Reed. Well, we have jumped off on to the rulemaking. I
think when it comes to the protection of children online, we
have been a strong supporter of the Children's Online Privacy
Protection Act. One of the things, though, that I was, and I
will repeat this for the chair is, it is worth noting that on
all of these rules, we run into a situation where we are all
talking about compliance.
To me in a small business capacity compliance means
lawyers. That doesn't mean developing products. That doesn't
mean people doing the job that they need to do. So what really
the FTC needs to have as part of this resource is to make sure
they are doing a better job educating people what the rules
are, how you follow them, what the expectations are, and get
back some of that trust. Because if we are only focused on
compliance, that means I am hiring a lawyer, not the other.
On onto your question about a patchwork of State laws,
somebody asked me earlier said, well, is a patchwork of State
laws going to--doesn't that create a floor, not a ceiling? And
I said from a small business perspective, that turns the floor
into lava, and you are hopping from couch to couch to trying to
figure out where you comply and how you comply. While I
understand that there is jurisprudence, as Professor Vladeck
said, from a small business perspective, the cost of figuring
out where you sit on that jurisprudence is incredibly expensive
and time consuming.
So, no, I think preemption is absolutely key for the small
business success. And we can't depend on a hopeful Supreme
Court decision down the road.
Senator Wicker. And perhaps Mr. Soltani can answer on the
record because that clock seems to keep ticking. Let's talk
about the inclusion of a private right of action in data
privacy legislation. Oftentimes, a private right of action
hinders innovation, consumer choice, and ends up benefiting
trial lawyers rather than consumers. For the record, and we
will start again with Ms. Ohlhausen, and talk to all four of
you.
How would a broad private right of action and data privacy
legislation impact member companies, particularly small app
developers, and what do you think about a private right of
action where consumers can recover actual monetary damages
where an individual has suffered concrete harm? Let's start
with Ms. Ohlhausen but we'll take time for all four of you.
Ms. Ohlhausen. So I would support a private right of action
that allows a consumer to get actual damages. I think concerns,
you know, are appropriate for a very broad type of right of
action as the way we have seen that used when it has been in
other statutes, where it really hasn't serve consumer interests
well and it is certainly been a big burden on businesses,
including small businesses, who have to spend a lot of money,
you know, defending against----
Senator Wicker. What would you--what would you allow and
what would you not allow? Can you help us make a distinction
there?
Ms. Ohlhausen. Sure. So I have some concerns about having
something that has high punitive damages for an initial
violation of the Act, particularly of something that, you know,
doesn't have like, you know, a bad intent. If you had something
that was, you know, really focused on repeated or egregious
violations, that focused on making consumers whole and
protecting consumers going down the road, I think that is the
appropriate focus for a private right of action.
Senator Wicker. Mr. Vladek.
Mr. Vladeck. I think private rights of action are essential
to enforcement, but I think there are ways of addressing the
concerns that you and others have raised. So, for example, the
Federal Privacy Act has a private right of action. It only
permits nominal damages unless there are actual damages. And
under the Equal Access to Justice Act, it curbs the amount of
attorney?s fees that can be recovered.
And so there are ways of both providing a right of action
which would be essential to real enforcement but minimize the
kinds of concerns that you and my colleagues here today have
raised. Look at the Federal Privacy Act. It has been in effect
since 1974. It has worked quite well, but it has a private
right of action. It allows nominal damages, and it curbs
attorneys' fees.
Senator Wicker. Mr. Reed, what about your small members?
Mr. Reed. So, Professor Vladeck mentioned some guardrails,
but I think if we are going to have a private right of action,
guardrails are the key aspect. Obviously, injunctive relief--
injunctive relief would probably be ideal. But if we are
limiting it to just monitor actual monetary damages, not
statutory, I think the two problems small businesses are going
to see is without a period to cure, you run the risk of I
didn't respond to that e-mail in 30 days, I responded to it in
31 days.
That should not lead to a sue and settle situation where I
have got to pay someone--I have got to pay someone $50,000 for
that. So there has to be a period of cure. The other thing that
we have heard from everybody is the concept of C-enter. There
has got to be some kind of intent behind it. A missed deadline
for responding to a request shouldn't be the kind of thing that
leads you into an expensive court case. So guardrails are the
key aspect.
Senator Wicker. Mr. Soltani, is a period of cure OK with
you?
Mr. Soltani. Yes, I think that the cure provision does
provide some guardrails, as Mr. Reed outlined, and we have that
in California. I will say that those guardrails, though, need
to be specific, not just based on the size of the company,
because oftentimes small companies will actually affect and
reach millions of consumers and handle sensitive data like
health information or period tracking apps.
So I am not sure that just the size of it alone--it has to
be a consideration based on, as others have said, the nature of
the harm and the severity if the information does breach. You
know, at the end of the day, the private right of action makes
up for the concern if there is not enough enforcement capacity.
So I think as long as there are ways to ensure that the laws
and regulations are properly overseen and enforced and there is
resources to do so, I think that will balance the private right
of action as well.
Senator Wicker. Thank you. Senator Baldwin, take the gavel
and take 8 minutes if you need to. We will hold up----
[Laughter.]
STATEMENT OF HON. TAMMY BALDWIN,
U.S. SENATOR FROM WISCONSIN
Senator Baldwin. I have noted in previous hearings in this
committee about data privacy that I am not sure that my
constituents really differentiate between a company's decision
to use their data or give it to others in ways that they didn't
expect or agree to, and a company's failure to keep that data
secure from third-party criminals who steal it. Unfortunately,
since our last hearing on this topic, we have seen a lot more
large scale data breaches and ransomware attacks that endanger
consumers' personal and financial information and threaten the
operations of critical businesses and services.
So I am pleased that the legislative proposals introduced
by the leaders of this committee tackle the issue of data
security as part of the broader data privacy issue. Ms.
Ohlhausen, during your tenure at the FTC, the agency dealt with
a number of major data breaches. How critical do you believe it
is that Congress tackle data security alongside sort of hand in
hand with data privacy issues? And what in particular is the--
is it most important for Congress to do in the data security
lane?
Ms. Ohlhausen. Thank you, Senator. I think you are correct
that there is a fine distinction between data privacy and data
security, but they are very closely related. And I think it is
important that Federal legislation tackle both.
And some of the provisions that have been in the bills
require companies to have processes in place to ensure that the
data is protected, that they also might be subject to fines if
they don't, because that is--you know, as my colleague, Mr.
Vladeck said, sometimes the harms from a data breach aren't
necessarily financial harm.
Sometimes they are, but they aren't always. And so you want
to be able to have the right incentives in place for companies
to take those protections. And I think legislation that looks
at both privacy and data security helps kind of cover both
sides of that.
Senator Baldwin. Thank you. All of you have testified about
the need for the FTC to have greater resources and in
particular, technologists, engineers. And so I want to--I had a
question on that, but you pretty much put that on the record. I
do want to ask something more specific about it, though, and I
will direct this to Mr. Soltani. In your testimony, you
recommended that the FTC grow its staff of technologists,
provide them with more competitive pay, allow them to engage in
meaningful work that would not prevent them from seeking future
employment elsewhere.
While I agree, and there seems to be a strong consensus on
the panel that the Commission needs substantially more staff,
resources, and authority to effectively address data privacy
and security, I also have long standing concerns about
revolving doors--a revolving door between Federal regulatory
agencies and the industries that they regulate.
So how would you suggest we go about approaching that,
strengthening the FTC's ability to effectively engage with an
ever changing and expanding technology sector while also trying
to avoid industry capture?
Mr. Soltani. Thank you, Senator, for the question.
Absolutely in agreement with you regarding the revolving door
we see, and this committee is intimately familiar with staff
going to large tech companies and working after the fact once
they gain that expertise here. The comment in my testimony and
I have coauthored a paper on this, has to do with the way
contract rules apply to technologists.
And I also said in my testimony, often technologists--when
I was at the Commission, I worked on nearly every case at DPIP
at the time. So I was working hands on, on many cases. And so
as such, it essentially creates enhanced conflict rules,
particularly based on the way the FTC interprets their conflict
authority. And furthermore, they apply those conflict rules not
just to working with the companies that are under order but
working with other enforcement agencies.
For example, I worked firsthand on the Facebook matter in
2010 as one of the lead investigators, technologists in the
matter. I was prohibited by the FTC from helping a multi-State
AG action on the same matter because they considered that to be
in the conflict rules even though it was on the same side of
consumer protection, and it would be essentially seeking
injunctions or remedies that the FTC themselves didn't seek.
So I think there is some work that needs to be done, but
absolutely with the focus that this can't be a revolving door.
In the same way that we want to prevent a revolving door, not
just for staff attorneys, but for Commissioners as well.
Senator Baldwin. Thank you.
The Chairwoman. Thank you, Senator Baldwin. I know Senator
Fischer is here, but you are allowing your colleague, Senator
Moran, for a time constraint, sensitive issue to go remotely
ahead of you. So, thank you. Senator Moran. Senator Moran, are
you available? Maybe he already had to depart for his--well, we
will give it a minute here. Give it a second. See if we can get
it corrected. If not, would it be OK if we went to Senator
Tester, and then back to Senator Moran, is that OK? OK, Senator
Tester.
STATEMENT OF HON. JON TESTER,
U.S. SENATOR FROM MONTANA
Senator Tester. Well, goodness, thank you. This is a
question for--actually, it is a question for the panel. We have
witnessed the FTC fine some larger tech companies a pile of
money in my book, billions of dollars. Number one, do you think
this enforcement is effective? And number two, if you don't
think it is effective, because, quite frankly, I think it is a
drop in the bucket to some of these companies, but if you don't
think it is effective, what should the FTC be doing? We will
start with you, Mr. Vladeck.
Mr. Vladeck. You know----
[Technical problems.]
The Chairwoman. If you could turn your microphone on, I am
not sure, or pull it closer.
Mr. Vladeck. Thank you. I think $5 billion actually is a
bucket of money. And having litigated cases for 45 years, I
doubt, seriously the FTC would have gotten that kind of civil
penalty in litigation. But here's the problem. For most privacy
violations, there is no financial, you know, harm to the
company. They don't pay a penny in most privacy violations.
Why? Because it is not money. And the FTC, of course, redress
authority was clipped by the Supreme Court in AMG. But for
first time violators, the only real sanction is an ongoing
consent decree.
And as--we talked about this a little earlier, Senator
Tester, but part of the problem is the FTC has got 1,000
companies and people under order. And monitoring those consent
decrees, it takes a lot of time and resources, which the FTC
lacks. And so the real problem is once you get a company under
order and during my tenure at the FTC and Maureen's, we got a
lot of these companies under order.
The real question is, does the FTC have the resources to
make certain the company is following the consent decree? And
the answer to that question is plainly no.
Senator Tester. Yep.
Ms. Ohlhausen. So I agree, I think $5 billion is a big fine
and is actually much larger than--we often hold up Europe as
sort of this paradigm for privacy and it far dwarfs anything
they have ever obtained there. But I think the other part that
you need to look at is the conduct obligations that are in that
order.
And so when you look at legislation and the ability to
impose some of those kinds of obligations on all companies, I
think that is why Federal legislation could be really a good
path forward, not just unfair and deceptive acts and practices
enforcement, which, again, I think the FTC has done a good job
with, given the limitations that that has.
Mr. Reed. So from the small business perspective, $5
billion is a lot of money. However, what you are really asking
is, did it create behavior change? And the practical mention is
we keep talking about compliance. Well, without Federal
legislation, you are never going to see--you are never going to
see behavior change, because what the companies are doing is
they are looking at what the length and breadth of the law are
and figuring out how close they can come to the line to comply
and then figure they will fight it out in court and delay it.
So until the Congress comes in and steps in and says this
is what is appropriate, this is what people--what their
expectations are, and restore some trust to the system, then it
is always going to be a matter of $5 billion. So as Ms.
Ohlhausen said, really, it is up to Congress to actually give
the FTC the tools they need. But if you want behavior change,
it starts with you.
Senator Tester. Mr. Soltani, would you like to comment?
Mr. Soltani. I would agree with what the previous panelists
have said. Indeed $5 billion may be a lot of money depending on
the company, however, the kind of the core behavior change
comes about not only from the fine, but also any injunctions or
restrictions that are imposed on the company.
In the case of the--from the Facebook settlement, not only
were there very limited injunctions on the behavior of the
company, the settlement indemnified the company for all
violations prior to the settlement date, which there is some
evidence that there was a number of other ongoing violations at
the time, which the FTC then loses its ability to oversee or
enforce.
So I think in addition to statutory fines, I think it is
important to have strong, meaningful injunctions, which then
the agency can, in fact, enforce. And that goes to the resource
question as well as the authority question.
Senator Tester. Several of you, if not all of you, have
talked about the fact that they don't have--the FTC does not
have enough money to do what we think they should be doing. The
House marked up a bill that gives them basically $100 million a
year for 10 years to create a new privacy bureau. I am curious,
and I would love to ask you all this question, but I only got
13 seconds left. So I will just ask you, Mr. Vladeck, since you
are closest to me, what should we be looking at as far as the
funding level for the FTC?
Mr. Vladeck. I think an additional $100 million a year is a
good start. It would move the FTC to parity with some of its
other sister agencies, but I am not sure that is actually
enough. I mean, when we start--the first time we see Google,
they had 600 lawyers.
Today, I don't know, probably over 1,000. You know, we are
not ever outgunned, but we are always outmatched in terms of
resources. And as the tech sector grows and it is the most
dynamic sector of our economy, the FTC is going to need
resources commensurate with that. So I think $100,000--$100
million is a good start, but I don't think that is the end of
the story.
Senator Tester. Thank you. Thank you, Madam Chair.
The Chairwoman. Thank you, Senator Tester. Senator Moran,
are you now available? Senator Fischer.
STATEMENT OF HON. DEB FISCHER,
U.S. SENATOR FROM NEBRASKA
Senator Fischer. Thank you, Madam Chairman, and to our
witnesses for being here today. This committee has had
productive discussions on data privacy in recent years. And on
several occasions, we have heard directly from FTC
Commissioners past and present, and from both parties for that
matter. What struck me from those conversations was that while
many Commissioners had different recommendations, they
consistently pointed to one area of agreement, and that is the
need for Congress to clearly define authorities and boundaries
for FTC rules in statute. Commissioner Ohlhausen, do you think
it makes sense for lawmakers to throw as much as $1 billion at
a new privacy bureau as some are trying to do without passing
corresponding legal authorities for FTC enforcement?
Ms. Ohlhausen. I think you really need both. You need more
resources financially and you need stronger statutory guidance
and clarity for the FTC to enforce. Because if it keeps trying
to enforce in a way that doesn't quite match up with the
authority Congress gave it, it is always going to be at a
disadvantage.
Senator Fischer. Without the right legal tools provided by
legislation, I am afraid that this funding would waste taxpayer
money on unsuccessful agency litigation that would ultimately
fail, and it is not going to protect consumers in any way.
Mr. Vladeck, I noticed in your testimony you mentioned
digital harms that are related, but beyond the immediate
privacy space, such as dark patterns. I am working to
reintroduce the Detour Act with Senator Warner, prohibiting the
use of dark patterns that trick consumers into giving consent
online. How do you think that legislation addressing these
manipulative user interfaces could improve the FTC's ability to
protect consumers online?
Mr. Vladeck. Well, first, you know, the FTC protects
consumers online largely through litigation. And unless the FTC
has the resources that it needs today, the FTC is not going to
be able to do that. In terms of dark patterns, there is a
difficult--there is a really difficult First Amendment question
there. The question is, what is the difference between advocacy
and manipulation?
And I think the trick that you and your colleagues are
going to have are going to be to craft legislation that gets
out--really gets after the kind of manipulation that you are
worried about without, you know, without trenching on First
Amendment rights. So I applaud what you are doing, but I think
you have a very difficult road ahead of you.
Senator Fischer. I am also very troubled by the recent Wall
Street Journal reports that describe Instagram's mental health
effects on its users, particularly young girls. This follows
our concerns about Facebook previous mood studies that they did
to manipulate users' emotions that came to light in 2014.
The DETOUR Act seeks to address consumer harms like these,
as well as by banning online behavioral studies without
informed consent and banning certain dark patterns aimed at
children. How would you tie in your previous comments on First
Amendment issues to be careful about, to be cautious about, on
those instances?
Mr. Vladeck. I am deeply troubled by the Wall Street
Journal reports about Facebook. You know, anyone who has ever
raised children, I think, particularly in this digital age,
should be worried about it. I think the Constitutional issues
definitely are less substantial when you are trying to protect
minors.
And you know and the FTC enforces COPPA. I would like to
see changes to COPPA. The COPPA statute is very difficult to
enforce because of the actual knowledge standard. I would hope
Congress could wrestle with that question as well. But I agree
with you, we need tighter regulation to protect our kids.
Senator Fischer. How can we aid you in that enforcement?
You know, when we are looking at consumer harm, can you give me
a couple of examples of areas that you think we need to focus
on in order to aid you in that enforcement? What are some of
your ideas? What do we need? What do you need?
Mr. Vladeck. Well, the first--if we are talking about
children, COPPA needs to be revised. I helped work on the 2000,
you know, 2011, 2012 rethink of COPPA, and we were constrained
by the statute. The hardest problem for the FTC is the actual
knowledge standard that it requires us to prove from the get-go
that an app developer website actually understood that it was
tracking children, even though, you know, there is a lot of
circumstantial evidence that would have proven constructive
knowledge.
So the first thing I would do about COPPA is change the
standard from actual knowledge to constructive knowledge. The
second thing I would do is get rid of the safe harbor programs.
They give people one serious bite at the apple without FTC
oversight. I do not think the Safe Harbor program has worked
particularly well. And the last thing is I think there needs to
be a rethink about the age limit. I don't know whether, you
know--Senator Markey is not here. I don't know--oh, oh, there
you are, Senator.
The Chairwoman. He is pretending to be a staffer.
Mr. Vladeck. Oh, I apologize.
The Chairwoman. He is so knowledgeable. He is at the staff
level of knowledge. He is so smart.
Mr. Vladeck. Well, I mean, in some ways he was remarkably
prescient. The statute goes back to 1999. But I think that we
need to rethink what the right age is.
Senator Fischer. Thank you. Thank you, Madam Chairman.
The Chairwoman. Thank you, Senator Fischer. Is Senator
Klobuchar available? She may--she has been trying----
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Can you hear me, Madam Chair?
The Chairman. Yes. Yes, Senator Klobuchar.
Senator Klobuchar. Thank you, Madam Chair. Thank you. I am
going to Senator, a former Senator wife's funeral, and I
apologize for just being on the phone here. I am on the bus,
but I really wanted to be part of this important hearing. And I
thank you for your leadership, Senator Cantwell and so many
others.
Mr. Soltani, in your testimony in opening, you highlight
probably FTC's Division of Privacy and Identity Protection has
only about 40 attorneys as compared to other countries' data
protection agencies such as Germany, with one-quarter of the
U.S. population, with nearly 745 staff. You also note how a new
FTC privacy bureau would provide the agency with the resources
it needs. Can you elaborate on how this bureau will help build
upon the agency's work to protect consumer privacy?
And I would also add to that, Senator Grassley and I, of
course, have a bill that would help both the FTC and DOJ
antitrust, when it comes to antitrust enforcement that is
passed the Senate. And there is also efforts to beef up the
resources on that side of the work, which I think does lead
into privacy because, you know, there is no incentive to do a
lot on privacy when there is only one competitor in a dominant
platform. So could you address both things, Mr. Soltani? Thank
you.
Mr. Soltani. Absolutely. I think, as I said before,
regulation and even Section 5, without adequate enforcement and
oversight, is just dead letter. And effectively the enhanced--
kind of the creation of this new agency plus the staffing
expert resources--sorry, the creation of this new bureau with
staffing of key resources will help the agency not only kind of
enforce and oversee the myriad of harms we are concerned about,
but in fact go after a number of companies rather than just one
or two at a time. And as you know, often these matters take
years to complete.
So it gives the ability to, for the agency to actually
oversee more of what you are all concerned about. To your
second point, absolutely, privacy and antitrust are deeply
related. I don't think you could solve one without solving the
other. And I do think that efforts to try to deal with some of
the market failure resulting in some of the privacy abuses is
critical.
Senator Klobuchar. Thank you very much. Professor Vladeck,
I recently held a hearing in antitrust about consumer data and
how literally so much information feeds into the profiteering
of the tech companies that's off of consumers' back. I think
Facebook makes their own reports $50 bucks a quarter from each
user in America. And so could you talk about how a large data
set held by a small handful of companies can raise competitive
concerns such as barriers to entry?
Mr. Vladeck. Thank you. Thank you, Senator. I do think
these enormous reservoirs of personal data, which are
constantly being updated frictionlessly with no cost to the
companies, is an enormous asset that is a barrier to entry and
is a barrier to rivals trying to replicate these kinds of data
banks. And so I think that, you know, I agree with you that
these aggregations of enormous amounts of sensitive personal
data are an enormous asset. Of course, the accounting industry
hasn't really caught up to this, but we have at the FTC. And,
you know, the frictionless acquisition of personal data on an
ongoing basis is an enormous advantage in this marketplace and
will freeze out rivals.
Senator Klobuchar. OK, thank you. Last question. Ms.
Ohlhausen, there is a lot of concern about health technologies.
I have done work with Senator Murkowski on this and many
others, whether it is tracking apps, whether it is Halo, you
name it. Could you just briefly talk about that? Thank you.
Ms. Ohlhausen. Thank you, Senator. Your question was a
little hard to hear. So----
The Chairwoman. Halo. Halo Technology.
Ms. Ohlhausen. Halo Technology? OK, I am not actually
familiar with Halo Technology, so--but I will say the FTC has
been active in paying attention to apps that are
surreptitiously tracking consumers. They recently brought some
enforcement actions in that area. I think that that is
something that, you know, going back to our time with David,
the Golden Shore's flashlight app, where they were collecting
data. You know, they said it was a flashlight, it worked as a
flashlight, but it collected data and consumers didn't know
that.
So I think--designer wear, yes. So there is--so I think
that that is an area where the FTC has been active, continues
to be active, and certainly any legislation should address
those kinds of concerns as well, because if there is sensitive
data that is being collected unknown to consumers, you know,
that is that is an issue. There should be an opt-in consent
there.
The Chairwoman. Thank you. Thank you, Senator Klobuchar.
Senator Scott.
STATEMENT OF HON. RICK SCOTT,
U.S. SENATOR FROM FLORIDA
Senator Scott. First of all, I want to thank Chair Cantwell
for hosting this important hearing. Online platforms and big
tech companies actively track, collect, and sell the data of
Americans, often without their users' knowledge or consent. I
think all of us are alarmed by this, and it is an infringement
on Americans' privacies. Our job in Congress is to hold these
companies accountable and protect the rights of all Americans.
There are privacy policy frameworks in the EU and states
like California that purport to give more ownership of data to
users. But I am concerned that these frameworks do not actually
give individuals more control of their data and burdened small
businesses do not have the legal and compliance resources of
big tech. Congress needs a thorough review and reform existing
privacy law to make sure Americans have more control and
transparency about how their data is being used, as well as the
ability to protect their data. I have a bill, the DATA Act,
which would require big tech platforms like Facebook, Snapchat,
and Twitter, to receive expressed consent to use American's
personal information and also provide a recourse for Americans
if the right to privacy is violated.
I think this bill is a step in the right direction to give
Americans greater transparency and control of their personal
information. To all the witnesses, thank you for being here. If
we pursue Federal legislation, how can Congress ensure it is
carefully crafted to ensure that small businesses do not face
burdensome new requirements?
Mr. Reed. Well, I guess as--from the small business
perspective, I will start, Senator Scott. There are some basic
guardrails that need to be in place around any private right of
action. Specifically, we talked about it earlier, the baseline
concepts have to be that it cannot be a private right of action
that would result in, for example, a small business getting an
e-mail from someone and responding to it in 31 days instead of
30 days.
We need a period of cure. We need to be held to the point
where there was no intent to harm and there is a way to clarify
or fix the problem and get right with our consumer, because at
the core, the small business needs the consumer trust. We don't
have the big brands of a Facebook. We actually need our
consumers to trust us. And so setting up a system of PRA that
becomes sue and settle, where the cost of going to court to
defend myself is $500,000 but paying off the lawyer $50,000
becomes a cost of doing business.
So I would say that, as you have heard from all the
panelists, there is support for some kind of PRA, but it needs
to have guiderails to respect the realities of small business.
And those start with making sure that we can fix the problem
and make sure we are on the right side of trust with our
customers.
Ms. Ohlhausen. Senator, I also agree that we need to come
up with a system that doesn't overburden small business.
Regulatory complexity makes it very difficult. So having a
uniform national law that sets out clear standards, clear
obligations, I think will go a long way toward reducing that
complexity for small businesses.
Mr. Vladeck. Senator, I share your concern about
overburdening small businesses, but one of the things that we
need to take into account is in the digital space, a small
business can create massive harm. And the FTC saw cases like
that. And so I do think that, you know, you have a fair point,
but you need to craft legislation that, you know, that is
commensurate with the amount of harm that can be caused. And so
there were cases that we litigated when I was at the FTC, frost
wire, designer wear, where there were app developers that could
really just create massive harm. And so we need to--we need to
balance those two factors, Senator.
Mr. Reed. And just to followup, I actually agree. I think
small businesses can have data pools that are very significant
and therefore the harm that they cause can be serious. The
questions of the ability to cure, the ability to solve the
problem, the ability to regain trust is true regardless of
size, but it is more profoundly felt by small businesses. It is
one of the reasons why we need preemptive Federal legislation
to help us, you know, get the trust of our users.
Senator Scott. Thank you. What can we--how can----
Mr. Soltani. Senator----
Senator Scott. Go ahead.
Mr. Soltani. If I may. So, I agree with you, and I agree
with the previous panelists that in fact the burden on small
business and innovation should be considered. In California, we
have a threshold which considers not only the company size, for
example, if it has an annual gross revenue of over $25 million,
but also the amount of data that it sells or shares, for
example, over 50,000 consumers, which is updated in the CPRA.
The--you know, to Professor Vladeck's earlier point, oftentimes
small businesses may still handle and deal with a lot of
personal information, sensitive personal information.
So we need to have a framework that is flexible enough to
deal with the compliance issues as Mr. Reed just pointed out,
but also deal with the harms that can come about around a fast,
rapidly growing business. Think about Twitter. When the FTC
brought the order against Twitter, they were at that time
perhaps a small business, but that impacted quite a lot of
people's lives in 2009, 2010.
Senator Scott. Thank you, Chair Cantwell.
The Chairwoman. Thank you. Thank you so much. Senator Moran
tried to join us earlier and now he is available. Senator
Markey is it OK if--he is trying to get to the same funeral our
colleagues are trying to attend, and I--we all mourn the loss
of Evan Bayh's wife, and so I guess they are having a memorial
service this morning for her. So, Senator Moran, would you like
to try to connect here?
STATEMENT OF HON. JERRY MORAN,
U.S. SENATOR FROM KANSAS
Senator Moran. Chairman, I thank you very much, assuming
you can hear me. Thank you for your assistance in allowing me
to testify, but it is hugely an important issue to me and to
the country and issue that I and you and Senator Blumenthal and
Senator Wicker have spent a lot of time on. I have a couple of
questions. I guess I will begin with Commissioner Ohlhausen and
Mr. Vladeck. There seems to be significant agreement on what a
comprehensive data privacy bill should include, but there is
still a few sticking points, and they are certainly difficult
ones. One of those serious ones is the remaining issue of
whether to include the private right of action. And if so, what
form should that take? Where do you believe we can find common
ground on this particular issue? Commissioner.
Ms. Ohlhausen. Senator, thank you for your question. I do
think there can be common ground found on private right of
action, as we have--I think fellow panelists have also talked
about, having a private right of action that is very focused,
that does not invite abusive litigation. That is focused on
getting actual redress to consumers rather than just generating
attorneys' fees. So I think that, you know, that and my
colleague suggested the Federal Privacy Act as a model and
definitely would want to take a look at that.
Senator Moran. Thank you.
Mr. Vladeck. Let me just quickly add one thing. A privacy
bill needs to be enforced, and the only effective real
mechanism of enforcement are private right of actions. Now,
there are concerns about frivolous litigation or excessive
costs. There are statutes that deal with that kind of question.
The Privacy Act is just one, but there are ways of limiting
recoveries to nominal damages and actual damages and to cap
attorney?s fees as the U.S. Government does when it is involved
in litigation under the Equal Access to Justice Act. So those
are solvable problems.
Senator Moran. I take that as encouragement as we have
tried to solve them for about 2 years now. Let me ask Mr. Reed
before I need to go. You know Colorado--Virginia, Colorado,
they have enacted data privacy legislation and we call that up
concerned about a patchwork of laws. We have been warned
previously steadily about a reality of increasing pressure on
Congress as more states adopt those State laws.
What about the nature of doing business on the Internet
makes it untenable for businesses to operate in an environment
with different states, where different States have different
privacy standards?
Mr. Reed. I think I caught most of that, but the answer,
Senator, would be--well, Virginia and Colorado bills were both
excellent bills, but ideally a Federal preemption would be
better for some simple reasons. Even within the confines of
those two plus California plus a few other states, there are
terms and specific differences between there. As you know, in
breach was a classic example. There are 47 different breach
bills in some states. If you got a request from law
enforcement, you needed to wait to tell the customer that it
happened. In another state, you had a situation where you
needed to tell the customer immediately and then inform law
enforcement. For small businesses, that kind of compliance
regime, the same thing in privacy of how do I see consent?
For example, if one state says the size of your belt is
biometrics, then I need to get your consent if I want to know
your belt or shoe size, because I am an app that helps you buy
shoes. In another state, biometrics may be defined as a retinal
scan or a fingerprint. So from a small business perspective, it
is not just the language of the bills, but it is the way the
definitions are done, the way the report language in each state
is done.
And that raises our compliance costs and our lawyer costs.
And it is a really solvable problem because our goal is to get
the customer to--to give them a product they want and to earn
their trust.
Senator Moran. Mr. Reed, thank you. Thank you, Chairman.
The Chairwoman. Thank you. Thank you so much. Senator
Markey, I don't know if you are ready to go now, but I want to
thank you for your indulgence there with our colleagues and
also thank you for your leadership on COPPA and your work back
there, getting your staff more up to speed on what you are
going to do--as opposed to the other way around.
[Laughter.]
STATEMENT OF HON. EDWARD MARKEY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Markey. Thank you. Thank you, Madam Chair, very
much. Thanks to our expert panel. Yes, we are in a crisis.
Children are being targeted as we sit here right now by
hundreds of companies that just don't care about kids, don't
care about their privacy. And that should be the one thing we
all agree upon, that children should not be allowed to be
preyed upon. Here are the numbers. It is frightening.
Children's time on their devices has doubled over the last
year, doubled over the last year.
A study of kids Internet use found 144 percent increase in
the number of messages children sent and received online in
2020 versus 2019--one year. Today, 70 percent of parents
estimate that their children spend at least 4 hours with
screens every single day. So to each of you, please, yes or no.
If we can't pass a bill which protects adults' privacy,
should we ensure that we pass a bill that protects children's
privacy in this Congress? Yes or no, Mr. Vladeck?
Mr. Vladeck. Yes.
Ms. Ohlhausen. Children's privacy is very important, and I
often point to COPPA as a very positive----
Senator Markey. Yes or no, should we increase the
protection?
Ms. Ohlhausen. Well, I haven't seen the bill, so I don't
know.
Senator Scott. I am not asking you for a bill. Should we
protect children? If we can't protect adults, should we at
least get children done in this Congress?
Ms. Ohlhausen. Yes.
Senator Markey. OK. Yes. Thank you. Mr. Reed?
Mr. Reed. Sure.
Senator Markey. OK, good. Thank you. And----
Mr. Soltani. Yes.
Senator Markey.--Mr. Soltani. OK, thank you so much. Now
the reality is--thank you, Mr. Vladeck. Going back to 1998,
1999. Yes, I put to limit it to children under 13, but that
wasn't my goal. It was to have it under 16 but the industry
said no back then. You didn't have to be a genius to figure out
a business model to exploit children, because historically
industries had done it on television with television
advertising, which is why we need children television
advertising. So, you know, I was just blocked back in 1998,
1999 from raising it up to 16. So it is not a new issue.
It is like all of a sudden, oh my god, who would have ever
thought that people would exploit children with technology that
have been going on, you know, for many, many decades up to that
point. And that is why Senator Cassidy and I have introduced
Children and Teens Online Privacy Protection Act to increase
the protections up to age 16. Mr. Soltani, can you briefly
discuss the importance of banning targeted ads to children?
Mr. Soltani. Yes, absolutely. Thanks for the question. So I
think there is a key issue that COPPA doesn't really solve for
data abuses once the consent has been given. And ads that are
inherently manipulative, kids have a harder time detecting or
knowing particularly when they are hyper targeted and
personalized, using their kid's name or age or using their
friend's likeness.
More importantly, the harms of collection for kids are also
higher. Kids have a limited ability to detect misuse or abuse
of their data, identity theft, et cetera. So absolutely, I
think considering a ban on OBA and targeting for kids is
incredibly important. I think it would essentially deal with
not just the privacy issues, but some of the other addiction
and manipulation issues, dark patterns, etcetera, the kids are
much more susceptible to.
Senator Markey. Yes, and--thank you, Mr. Soltani. And that
kind of targeting is banned in the bill, which Senator Cassidy
and I have introduced. And again, I just think we have to put
these laws on the books. And Mr. Vladeck, in terms of the with
what the UK has done in implementing its age appropriate design
code, a law to protect young people online--we are behind the
UK right now. So can you talk a little bit about how what the
UK is doing anticipates what we should do in the United States
to upgrade the protections for children?
Mr. Vladeck. I am sorry, I am not up to date on what the UK
is doing.
Senator Markey. You are not? Mr. Soltani, are you up to
speed on that?
Mr. Soltani. I am not an expert on it. I do agree that the
code requires that app developers and software developers
maintain certain standards. And I do agree that this Congress
should absolutely consider or provide the FTC rulemaking
authority to provide some of those.
Senator Markey. And the reason I mentions it, Mr. Vladeck,
is that you mentioned constructive knowledge in your statement,
and that is pretty much what the UK has done in terms of the
protection offered to children.
Mr. Vladeck. Right, and from enforcement standpoint, that
is the key question.
Senator Markey. Thank you--that we need to protect. We need
to assume constructive knowledge in terms of the activities.
Mr. Vladeck. Yes, that is correct. That is the key change
in the statute.
Senator Markey. Yes, thank you. And again, we need to
change the law so that if we are successful in putting the
funding in to the Federal Trade Commission, that they have a
law under which they can act in order to say to companies that
are exploiting children, no, we are coming after you. And so it
is all tied together. And if we put in the money for a privacy
bureau at the Federal Trade Commission, but we don't change the
law, so the kids are protected, then we really haven't finished
the job. Thank you, Madam Chair.
The Chairwoman. Thank you. Senator Thune, I believe, is
joining us remotely.
STATEMENT OF HON. JOHN THUNE,
U.S. SENATOR FROM SOUTH DAKOTA
Senator Thune. Thank you, Madam Chair, and thanks for
today's hearing. I believe that enacting comprehensive privacy
legislation should be a top priority of this committee. And
since we began privacy conversations in the aftermath of the
Cambridge Analytica scandal, when I was--served as Chairman of
the Committee, I have stated that there is no question we need
a Federal law to protect consumers privacy. And I do not
believe we should relinquish all responsibility by simply
increasing our Federal bureaucracy, by putting a significant
amount of funding at the FTC, I should say. So it is my hope
that we can work together in a bipartisan fashion to establish
uniform national policy. I push for more transparency about the
algorithms used by big tech companies to analyze consumer data
and make predictions intended to influence consumer behavior.
Many consumers are unaware that much of the content that
they see on the Internet platforms is determined by
sophisticated algorithms that draw on data about each
consumer's online activity. Billions of people are being fed
content on Internet platforms as basically selected for them by
opaque algorithms designed to keep consumers engaged on the
platform. The powerful artificial intelligence behind these
platforms creates a unique universe of information for each
user, phenomenon that is often referred to as the filter
bubble.
Earlier this month, the Wall Street Journal revealed that
Facebook altered its opaque algorithm after seeing a decline in
user engagement. They change in the algorithm that was intended
to optimize user engagement resulted in more divisive,
manipulative content being pushed to users. This troubling
report is exactly why I introduced the Filter Bubble
Transparency Act, and I am proud to have strong bipartisan
support for this bill with Senators Blumenthal, Blackburn,
Moran, Schatz, Warner, Collins, and Klobuchar as co-sponsors.
Our legislation would give consumers more transparency
about how algorithms are used to select content that they see
online. And it would give consumers the option to engage with
Internet platforms without being manipulated by opaque
algorithms. So very quickly, I don't have a lot of time left, a
couple of questions here. This is for each of you. Are Internet
platforms doing enough to provide users with the transparency
they deserve to make informed decisions about how they interact
with the platform's services, yes or no?
The Chairwoman. Who wants to start----
Mr. Reed. Well, I will start and say no, but part of the
problem is we are taking it from a compliance perspective.
Merely adding another page to a terms of service or a click
through doesn't actually achieve knowledge and doesn't actually
allow the user to understand what is going on. So we have got
to find a way to solve the problem that just doesn't add
another page to a compliance document.
Senator Thune. OK. Yes or no, other members of the panel.
Ms. Ohlhausen. So I agree that legislation could be very
beneficial to provide additional transparency to consumers.
Mr. Vladeck. There is really no transparency to consumers.
So, yes, we do need legislation to enable consumers to have a
better sense of how decisions are being made.
Mr. Soltani. Senator, no, I don't think enough is being
done, and often the companies don't themselves know how their
systems work, and that is why it is important not just to have
transparency by the companies, but also have resources at the
Federal Trade Commission that can verify those claims and those
representations.
Right now, to my knowledge, while the FTC has great staff
and great technologists, there is not a single AI or
algorithmic transparency expert at the Commission that can
verify the claims that companies make. So to your question of
big--Government, I do think it is important that they have
expertise and resources to support the great legislation you
are proposing.
Senator Thune. And very quickly, do you agree that
consumers ought to have the ability to use Internet platforms
like Facebook, Twitter, and YouTube without being manipulated
by algorithms designed to keep them engaged on the platforms?
Mr. Soltani. Is that to me?
Senator Thune. Anybody. Just yes or no? Yes, I mean, it is
a pretty straightforward question.
Mr. Soltani. So I will jump in. So I--Go ahead, David.
Mr. Vladeck. No, you go ahead, Ashkan. Sorry.
Mr. Soltani. Sorry. I do think that having the ability to
at least understand how the system works and there is you know,
there is algorithmic targeting based on general machine
learning of the population and based on your personal data. I
think the latter, or I'm sorry, the former will be harder to
limit but you can provide transparency to it. The latter,
targeting and manipulation based on information about you, I
think clearly you should have the ability to disable that hyper
personalization and filter bubble activity.
Senator Thune. Alright. Very quickly, do you all believe
that we ought to need--that we need a national standard that
says the same rules across the entire United States to ensure
consumer protection?
Mr. Reed. Yes, we need Federal preemptive privacy bill.
Ms. Ohlhausen. Yes, I agree,
Mr. Vladeck. I too, I agree as well.
Mr. Soltani. I don't think the standard needs to
essentially preempt the states, but allow experimentation in
the states, particularly because there is a bunch of different
approaches and issues here. So as long as the standard can
allow states to go further, then, sure.
Senator Thune. Thank you all. Thank you, Madam Chair.
The Chairwoman. Thank you. Senator Hickenlooper.
STATEMENT OF HON. JOHN HICKENLOOPER,
U.S. SENATOR FROM COLORADO
Senator Hickenlooper. Yes, thank you. And thank you all for
putting in the time and your public service. Really is
illuminating. I am a former small business owner, as has been
discussed already. I think regulations had to be carefully
tailored to ensure fairness in regulation, but also appropriate
oversight.
I think you are all aware of the Colorado Privacy Act,
applies to businesses with at least 100,000 data records or a
business with 25,000 data records held and deriving some
revenue from sale of data. It is different than other State
laws in terms of applying revenue--other laws applying revenue
threshold as a percentage. So Mr. Vladeck, would applying a
privacy law to any business earning any revenue from the sale
of personal data, does that efficiently promote broad
compliance to require consumer protections? And why or why not?
Mr. Vladeck. Well, there may be some constitutional issues
with Congress under the Commerce Clause regulating really small
businesses. But, you know, my own view is that at some point,
State laws are going to fall, and not because of Congress
necessarily, but because of the dormant Commerce Clause. And,
you know, you are going to get a collision of State laws, which
is why at some point Congress is going to need to pass a
comprehensive privacy statute.
But, you know, I worry that carve outs for small businesses
without some subtlety to it would allow companies that can be
incredibly disruptive on the Internet, tiny companies to evade
regulation. When--during my tenure as Bureau Chief at the FTC
of Bureau of Consumer Protection, we went after some small
companies that created massive harm. So----
Senator Hickenlooper. Can you give me an example?
Mr. Vladeck. Sure. So Frost Wire was about to send out an
app, a file sharing app with a default that would--hard to
disable, that would have required--that would have permitted or
encourage file sharing. Designer Wear designed an app that
allowed remote activation of a computer's camera, you know, and
so--you know, and that is--you know, that app was installed in
millions of computers that were then rented and then sold to
consumers and the clerks, you know, in the rental office did
often just simply turn on the computer and see what was going
on in your house.
So, you know, there are small companies that can cause
enormous harm. And so I am sympathetic to the need to promote
an innovation with small incubators that need to be protected.
But there also has to be a balance because some of the small
companies have caused great harm.
Senator Hickenlooper. Those are sufficiently gruesome that
I am almost sorry I asked.
Mr. Soltani. And Senator, if I may--it I may jump in.
Additionally, it is no longer the small developer in their
bedroom. Oftentimes these are VC supported or, you know, angel
supported companies. When I was at the FTC, we did kind of a
road show where we met and interviewed a number of VCs in the
investment community. And often they do not absolutely invest
in security or privacy from the start. They don't look--it is
actually what they consider a waste of money. And as Professor
Vladeck mentioned, oftentimes small companies can have a real
significant harm to consumers and completely obliterate their
requirement to do any investment in security or privacy and
cause great harm.
So I think it is--it needs a bit of nuance, as you consider
that carve out.
Senator Hickenlooper. No, absolutely. I appreciate that.
Mr. Reed, again, the Colorado Privacy Act was passed in July of
2021 and again allows a narrow and temporary right to cure on
private deficiencies. But this right of cure defaults after 2
years. And I know we have discussed about this a little bit,
but I thought more specifically though, how could a narrow and
temporary cure period help small businesses, let's say, well
intentioned small businesses and startups to adapt to new
regulations for privacy?
Mr. Reed. Right. And as you know, we actively supported
passage of the Colorado bill and we are hopeful that it and
some like it serve as a model that we can move forward on. So
you asked for how does it--how does it work, right. So, again,
for a legitimate business that isn't trying to manipulate or
spy on people through rental computers, all of those things are
exactly the kind of harm that the FTC should be going after.
If you are a legitimate business that is trying to acquire
customers or deal with people, then the right to cure allows
you to fix something that either, a, you didn't communicate
clearly through your terms of service or, b, that didn't match
the expectations of customers. And so the period of cure is
really critical because if you failed in one of those two
things, your primary job is to solve it because you want to
stay in business.
So absolutely, that is how we see a narrow period of cure
working. And again, that doesn't prohibit the ability of the
FTC or State AGs to go after truly bad actors like the one that
Professor Vladeck raised earlier.
Senator Hickenlooper. And thank you very much, Madam Chair.
Thank you.
The Chairwoman. Thank you. Senator Lummis.
STATEMENT OF HON. CYNTHIA LUMMIS,
U.S. SENATOR FROM WYOMING
Senator Lummis. Thank you, Madam Chairman. We all know that
large technology platforms have been given unfettered access to
collect data on the most sensitive areas of our lives, often
without our knowledge or consent. This data is then repackaged
and sold to the highest bidder or used to fuel algorithms that
target us with overly invasive advertising.
So I applaud the Committee. I applaud you, Madam Chairman.
It is long past time that Congress shine a light on these
unsupervised practices. I am concerned, however, that despite
our best efforts, Congress may be outmaneuvered by these tech
platforms. It is like a magician who uses misdirection to
distract his audience. These companies have already used
practices that bypass the guardrails that Congress intends to
put up, and more are on the way.
I had an Op-ed published yesterday that underlined some of
these activities, and I ask that it be included in the record.
The Chairwoman. Without objection.
[The information referred to follows:]
The bipartisan reason Congress should regulate big tech
BY SEN. CYNTHIA LUMMIS (R-WYO,), OPINION CONTRIBUTOR--09/27/21 7:00 PM
ET
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
In Wyoming, privacy is a way of life. We are the smallest state by
population, but among the largest in physical size. Privacy is baked
into our lifestyles since many in the Cowboy State live miles from
their nearest neighbor.
The Internet has aided our relatively isolated way of life. It has
enabled us to more easily keep in touch with relatives, conduct
business, and entertain ourselves. But it has not changed that very
Wyoming desire for personal privacy.
What concerns me, is that some of the companies serving as the
chief enablers of our connected lifestyles and Internet access are
undermining our privacy rights. And they are doing so in broad
daylight, but going mostly undetected.
Let's start with the latest example: Apple. Apple recently
announced a welcomed delay to its program that would have begun
scanning iPhones for images of child abuse. Now, let's start with the
obvious: as a mother and grandmother, I abhor child abuse. But,
Americans must take threats to their civil liberties seriously. In
fact, reports claim that some of Apple's own employees were protesting
against the adoption of this new policy, fearing that it could be
exploited by bad actors. Thankfully, your voices were heard, but we
must remain vigilant.
It was only a few years ago that Apple fought the U.S. government
tooth and nail when the FBI pressured them to unlock a terrorist's
iPhone. Even by considering this proposal, it seems those days are long
gone. And when the government pressures private companies to invade
your privacy, every American should be concerned. The reason is simple:
we oppose the creation of a surveillance state. Once built, who's left
to stop this technology from being repurposed to surveil other intimate
parts of our lives, or to monitor political speech, as they already do
in China or Russia?
And what about Facebook? For several years, Facebook has created
``shadow profiles'' of non-Facebook users for its own ad services. The
data it collects on each person allows Facebook to build a
comprehensive profile of a person who is largely unaware that it is
happening, and is unable to control it. This means if you've never had
a Facebook profile, but your friends do, then Facebook uses information
posted about you and compiles it into a ``shadow profile.'' Unlike
users, you never gave Facebook any information about yourself. Frankly,
Facebook doesn't care. This raises all kinds of red flags.
Up next is Google's Federated Learning of Cohorts, or FLoC. FLoC is
Google's replacement for third-party trackers. Rather than
individualized ads based on your browsing history, Google uses FLoC to
place users into an anonymous cohort with other users based on web
searches and other behavior. This is troublesome because, for example,
a user might be placed into a mental health related cohort for googling
about substance abuse treatments. Additionally, this means that your
browsing history is still being tracked. It is entirely possible that,
despite Google's efforts, it will be easier for companies down the road
to reverse engineer, or ``fingerprint,'' exactly who a user is based on
these cohorts.
Finally, Amazon. Amazon recently received approval from the FCC to
use radar technology to monitor your sleep habits and ``motion in a
three-dimensional space.'' This technology has not been implemented
yet, but Amazon is clearly gearing up for deployment. Certain Amazon
hardware like Alexa has already been shown to continuously ``listen''
to pretty much every conversation within its radius, but this 3-D
monitoring is a realm of science fiction that we have never before
realized. If we can't enjoy privacy in our own bedroom, then what is
left?
This is not a comprehensive list, just some of the most egregious
examples from the largest tech companies. These are also not instances
of political policing or preference. The right to privacy is a
bipartisan issue.
Such actions are incredibly alarming and sobering. However,
ultimate blame belongs with Congress, for not taking action.
As a freshman senator, I have been mostly sitting on the sidelines
of the big tech debate, monitoring the issue and learning.
Unfortunately, our tech companies are not quietly waiting for us to
come up with confines for them. They are innovating and pushing
boundaries because we have not set any.
It's time to act, and I look forward to learning more at this
week's Senate Commerce Committee hearings on protecting consumer
privacy. In the privacy-loving Cowboy State, we know that fences make
good neighbors. It's time Congress puts up some fences around big tech.
Senator Cynthia Lummis is the junior senator from Wyoming.
Senator Lummis. We all must gain a better understanding
about the types of data collection activities that the large
platforms are utilizing. We must know who has our data? What
types of data do they have? When are they collecting our
information? Where is it being sold? And how is it being used?
We can't hope to craft a strong bipartisan, consumer oriented
framework for data privacy without that information.
So I am hoping this hearing is moving us closer to enacting
that framework. And now I have a question for any of the
witnesses that feels you want to weigh in on this. So my first
question is on specific data collection practices. I am
concerned that these don't fall within the scope of the
California CPA or the European Union's GDPR or the proposed
bills here. An example is the Facebook pixel. The Facebook
pixel is used by numerous websites to identify unregistered
visitors to that site.
Since the pixel loads with the webpage, consumers have no
ability to opt in or opt out. This practice allows Facebook to
determine that person's identity and record specific data about
their web activity. This enables Facebook to collect data on
nearly every consumer and target them with high precision
advertising. Does this panel feel that this type of data
collection would be covered under any of these laws?
Mr. Soltani. I am happy to start.
The Chairwoman. Yes, that is a good idea. Mr. Soltani.
Mr. Soltani. So, I am quite aware of the kind of
surreptitious tracking you describe and I won't speak about
GDPR, but under CCPA and CPRA, the essentially third party
tracking, where the transfer of data, for example, by the first
party to Facebook would be constituted--would constitute a sale
under the CCPA and the CPRA, and consumers are allowed to opt
out of that transfer by indicating, for example, on The New
York Times that they don't want their information sent or sold
to Facebook.
Importantly, the CCPA and CPRA also provide consumers
rather than having to opt out on every website they click on,
or they visit, they can set a setting in their browser called
the Global Privacy Control, which essentially sends that signal
and indicates their opt-out preferences to every website they
visit.
So, for example, if I have and today, if I go to The New
York Times or The Washington Post using a browser that supports
this protocol, I am automatically opted out of the sale of my
personal information to those third parties and the California
AG is able to enforce when that transfer does occur.
Senator Lummis. So could that also apply to the example I
used like this Facebook pixel, which loads with the webpage?
Mr. Soltani. Exactly. So that is precisely the type of
transfer it is intended to curb. Essentially, The New York
Times is making available consumers data to Facebook as a sale.
And so when you opt-out of a sale, you essentially have--The
New York Times would restrict that data transfer to Facebook.
There are some caveats with regards to whether Facebook
would operate under the context of the service provider and
therefore not use users' data for their own benefit, but only
for, for example, measurement for the benefit of New York
Times. And that is in the AG's rulemaking. But effectively,
this surreptitious silent pixel based, third party pixel based
tracking is intentionally one of the key aspects of the law.
Senator Lummis. Are any of you aware of other data
collection practices that similarly bypass, at least opt-in
requirements of existing privacy laws?
Mr. Soltani. Happy to jump in on that one. Go ahead.
Mr. Reed. Yes, no, go ahead.
Mr. Soltani. So, absolutely. So one of the biggest gaps, I
think, in privacy law today, including with CCPA and CPRA, are
a collection from websites that consumers don't interact with.
So not just when I interact with The New York Times' best
seller, share my data with Facebook, but really the myriad of
data brokers that collect my information either from across the
web, either from me to public records or private records, where
they purchase it from companies that I have essentially--I am
not aware of, or even when companies will, for example, capture
data that appears in public records, as I said.
And so that--curbing that behavior is incredibly difficult
because consumers don't have a direct relationship with the
third-party data brokers that are selling their information.
And no framework really is able to curb that today. Consumers
can today go under the California law and opt-out of each data
broker, but they have to take some action or employ an
authorized agent, a company, a service that will go and delete
or opt-out their data for them, right. And this is a huge gap,
right.
So a good example is I don't know if you have Full Contact.
They are an e-mail provider that, for example, in order to use
a service for free, I give that provider access to all of my e-
mails, which includes the e-mails I have sent to you, Senator.
And therefore, they are able to get your contact information,
your phone number, all that information from those e-mails and
then further sell or share that information. That is something
we have a very difficult time really addressing today.
Senator Lummis. Thank you for your response. I would love
to--yes, sir.
Mr. Reed. Just very quickly, there is one aspect of this
that we keep coming back to. And part of it is you asked a
question about consent to. Another former FTC alum, Professor
Lorrie Cranor, who is also the CTO at the FTC. She has done
significant research about, do people understand what they are
consenting to in the first place?
And so as we are talking about all of these consent
mechanisms, the thing to really remember is what are we trying
to achieve? What is the behavior change? What is the outcome we
are trying to achieve? So when we asked the question about, did
they did they consent? Did they know what they consented to?
The Chairwoman. Thank you. Senator Peters. Although I
think, Senator Lummis, you just made the point of why we need
more technologists at the agency, because the only person who
could answer the first question was Mr. Ashkan Soltani. So
anyway, these things aren't mysterious. They aren't that
mysterious. You just need people who understand the technology
to basically help inform the lawyers and the other policymakers
about some of the--thank you, though. Senator Peters.
STATEMENT OF HON. GARY PETERS,
U.S. SENATOR FROM MICHIGAN
Senator Peters. Thank you, Madam Chair, and thank you for
this hearing. And I want to pick up on some of the answers to
the questions by Senator Lummis and actually a bill that the
two of us have introduced related to data brokers. And I had
asked additional questions of Mr. Soltani. But when I think
about data brokers and why we have introduced this bill as an
example, in 2019, a data broker tried to sell the names, the
addresses, the high schools, and the hobbies of 1.2 million
children. And this was uncovered through a violation of
Vermont's recently enacted law.
And those State law--and through State law was discovered
that another company called Amerilist was selling the name,
home address, age, religion, education level, and income of
5,000 people for $150. And so that is why Senator Lummis and I
have joined together trying to seek more transparency in this.
We have introduced the Data Broker List Act to ensure that data
broker companies actually register with the FTC. The bill would
require companies to provide the agency with the types of
information the company has collected and an explanation for
the purpose of why that data is collected.
First question for you, Mr. Reed, in this. In your
testimony, you noted that 89 percent of mobile devices have
denied data features to apps they didn't trust, and over half
of the users have deleted apps due to privacy concerns. So I am
interested in hearing your suggestions on how we improve and
expand the Vermont law that I have already mentioned had an
impact in identifying abuse, as well as California data broker
laws at the Federal level. Particularly how to ensure that data
brokers are transparent with this information. What suggestions
do you have for us?
Mr. Reed. So first of all, I think that looking at both
Colorado and Virginia's recently passed bills are also
incredibly helpful on this. But one of the things to be aware
of is something that Mr. Soltani mentioned. Right now in
California you can go to the website, and you can see the list
of data brokers. You can click to them. How many consumers
actually go to the Government page and wallow through their
poorly written HTML code to find the click link to go to figure
out who their--what the data brokers are and what they have on
them.
So part of it is not merely finding a way for the data
brokers to say, yes, you know, find me here. But to actually
engage with the consumer at the point of which their data is
collected and make sure that the party who is collecting that
information is responsible or at least is communicating
clearly, and I don't mean page 37 of a terms of service, about
what they are doing, who they are providing it to.
Because you are talking about the data brokers, but the
data brokers have to get that data from somewhere. And that is
the point of inflection in which the consumer has the most
impact. So while I think it is good to have a list of data
brokers and I think it is good to have transparency, let's
start at the point of impact. And that means my members, they
have to communicate clearly to user. Here is what I want. Here
is what I am going to do with it.
Here is what I am not going to do with it. And I think you
will enjoy my product. And if they can't say that, then they
shouldn't be on a platform.
Senator Peters. Some smaller data brokers have suggested
that they should be completely exempt from reporting and
disclosure requirements. They are a small business and that----
Mr. Reed. Absolutely not.
Senator Peters. You have already--the question is, should
Congress consider FTC exemptions for data brokers? Should we
treat them like we do your average small business down the
street?
Mr. Reed. No, because they aren't the small business down
the street and they are not the point of inflection, right.
They are not the point at which you, the consumer, engaged with
the activity that provided your data. So they are opaque to
most users. And so, no, I don't think that they should be
exempt completely because they are no different than the local
small business or the bike store.
Senator Peters. Absolutely. And one final question, Mr.
Reed. I am a founding member of the Senate's Artificial
Intelligence Caucus, and I would like to hear from you about
how companies are using AI to preserve privacy. And where do
you see some challenges and what role do you think the FTC
should play in ensuring that we are dealing with some of the
challenges of AI while not discouraging innovation?
Mr. Reed. Well, I have to put a plug in for our white paper
on good machine learning practices, which we have developed.
But you are asking a really important question. AI can help to
preserve privacy. It can do so by making sure that you strip
out data that is personally identifiable before you actually do
the learning. The place that has created the most, and I am
looking at time, the most difficulty in understanding how we
move forward is in health care.
I am honored to serve on Federal Advisory Committee for HHS
on some issues around education and outreach. One of the
biggest problems in the AI space is, I don't need to know if
you like blue interiors on cars, right? I don't need to know
that Senator Peters likes blue interiors. I just need to know
that a large group of people like blue interiors and so I make
a marketing decision. Now, if I need to know what medication
works best for a group of people with several comorbidities,
then I need detailed information. And that means I need your
private information, your most private information to know what
medication works, what treatment regime work best, what are the
things that I should warn you about in advance. Digital
retinopathy.
There is so many places where knowing more about you allows
me to keep you healthy and safety earlier in the process
through the physician. So when it comes to AI, the questions
that are to ask, is it necessary to have that extra data to
provide some very specific value, especially in health care, to
the customer--to the person--I keep talking customers. They are
people--to the people.
If it is something where I just need to know, hey, you like
blue interiors and 10,000 other people like blue interiors. Oh,
but they also like silver trim. Great. I need to remove the
identifiable information on you when I am training that engine
to develop what I am going to do for my marketing material. So
I think there is this split. Sometimes we need it to provide a
need and a good, sometimes we don't.
And in that way AI can actually be useful to strip out the
parts that we should be--we should be leaving on the sidelines.
Senator Peters. Right. Thank you. Thank you, Madam Chair.
The Chairwoman. Thank you. Senator Lee.
STATEMENT OF HON. MIKE LEE,
U.S. SENATOR FROM UTAH
Senator Lee. Thank you, Madam Chair. And Ms. Ohlhausen, I
would like to start with you, if that is all right. Earlier
this year, the FTC took some steps to remove some rulemaking
barriers to their authority under Section 18 of the Federal
Trade Commission Act. They wanted to make it easier for the
Commission to engage in rulemaking.
Now, these procedural requirements that they are trying to
get around were put in place in the 1970s after the Federal
Trade Commission had gone on something of a rulemaking binge.
So Congress put in place restrictions on that power so they
would be less inclined to do it again. So I find it a little
bit surprising, shocking, in fact, to see these rather blatant,
bold efforts by the Commission to seize rulemaking power
against manifested Congressional opposition and statutory
impediments put in place designed to discourage that.
Now, I am skeptical that Congress should even grant the
Federal Trade Commission broad rulemaking power, APA universe
style rulemaking power, to the Federal Trade Commission. But
setting that aside, should Congress even consider granting this
rulemaking power with the current trajectory being undertaken
by the Federal Trade Commission to flaunt, rather cavalierly
disregard restrictions on the rulemaking power that it is
already in place?
Ms. Ohlhausen. So, Senator, you know, the FTC definitely
has a checkered history with rulemaking, and that is why the
Magnuson-Moss Act and the Federal Trade Commission Improvement
Act got enacted by Congress to put particular guardrails in
place. So the more clarity Congress can give to what it wants
the FTC to do, I think that comes--you know, that works much
better.
So when you think about the Children's Online Privacy
Protection Act where Congress set the boundaries, Congress set
the age limit, and then gave the FTC the authority to update
what is personal information based on how technology changed, I
think that was a really good model.
Senator Lee. Yes. No, clarity certainly helps. And I am
sure you can understand my frustration and my reluctance to
give them anything in light of the fact that they haven't
complied with existing restrictions and seem to be looking for
ways to get around them. Now, as we consider what else we might
do with the FTC and as we take into account the rulemaking
abuse over the decades, I want to analyze that against the
current backdrop of the proposal to create a new FTC privacy
bureau.
My understanding is that the FTC's Fiscal Year 2022 budget
request amounted to $389 million. The House's reconciliation
bill, the $3.5 trillion reconciliation bill proposes including
an additional billion dollars on top of that to give to the
FTC. And the intended purpose for that is, and I am going to
read the entirety of the legislative text that deals with this
issue. Here it is. It is to, ``create and operate a bureau,
including by hiring and retaining technologists, user
experience designers, and other experts, as the Commission
considers appropriate to accomplish the work of the Commission
related to unfair or deceptive acts or practices related--
relating to privacy, data security, identity theft, data
abuses, and related matters.''
So, Commissioner Ohlhausen, setting aside for a minute
whether we have $1 billion to spend on this right now, which I
don't believe we do, but setting aside that issue for a moment,
how would this--what kind of conflict might this create within
the FTC? Conflict, for example, with the Bureau of Consumer
Protection. And how is that language--you referred a moment ago
to the need to give them clear directives. How does this
comport with that or does it?
Ms. Ohlhausen. So I think it is important to pair both
additional resources and additional statutory guidance and
clarity to the FTC for its privacy enforcement. We have talked
a lot about privacy. I think that, you know, is a useful thing.
But the FTC does a lot of other important enforcement in areas,
you know, as varied as unsafe products, you know, deceptive
advertising, credit issues. I mean, the list kind of goes on
and on. So I do think that, you know, we don't want to sort of
disregard the other important things that the FTC does. But I
think those--the resources and the statutory clarity need to be
paired.
Senator Lee. OK, I see my time has expired and so I am
going to move on. I wanted to ask you a little bit more detail
about the nature of the data privacy harm but i will do that in
writing. Thank you, Madam Chair.
The Chairwoman. Senator Rosen is next.
STATEMENT OF HON. JACKY ROSEN,
U.S. SENATOR FROM NEVADA
Senator Rosen. Thank you, Chair Cantwell and, of course,
Ranking Member Wicker for holding the hearing today, it is so
important. I want to thank all the witnesses. The testimony has
been very good. I appreciate everything that you are working
on. And I want to talk a little bit about health data privacy,
because I am a member of both this Commerce committee and the
Health committee. And so I have an opportunity to see up close
the intersection between technology and health care. Wearable
technology has been at the forefront of the Internet of Things,
and it offers greater insights into our health every day, how
we can improve it, monitor it, et cetera, et cetera.
You know, last year alone, there were more than 90,000
health apps that were released, including apps for fertility,
medication, even to sleep better. So despite these exciting
developments, I am concerned with the ability of companies to
use that data that they have accumulated from the health apps
and the wearables to draw inferences about individuals and
groups.
And so these assumptions are that we as individuals may not
have the opportunity to verify, but they can nonetheless
significantly impact our lives, sometimes even leading to
profiling or discrimination. That is why Senator Cassidy, and I
reintroduced the bipartisan Smartwatch Act, which extends
existing health care privacy protections under HIPPA to
personal health data collected by apps and by wearables,
preventing this data from being sold or used commercially
without the consumer's consent.
So Ms. Ohlhausen, can you discuss some of the challenges
with protecting consumer health data that we are seeing and
some of the examples of best practices for protecting this data
that might not currently--might not currently be under HIPPA?
Where do we need to expand?
Ms. Ohlhausen. Yes, Senator. It is--it became apparent as
health apps and other online sort of uses for health data were
not covered by HIPPA, so they didn't necessarily have those
HIPPA-like protections in place.
So I think the FTC has actually been fairly vigilant about
making sure that the collection and use and sharing of
sensitive personal data, which health data would be considered
that, is done with the knowledge and consent of consumers, and
that it is not done in a way that harms consumers. And
certainly discrimination would be, you know, one of the
prohibited harms for that. So I think that the FTC has been
active in that space, and I hope it will continue to be.
Senator Rosen. Thank you. I appreciate that. But you know,
we need to address some of the challenges. The Federal Trade
Commission has issued a policy statement affirming that health
apps and connected devices that collect or use consumers'
health information must comply with the health breach
notification rule. This rule requires that apps and devices
notify consumers when their information is breached.
So, Mr. Soltani, do you believe the FTC's policy statement
goes far enough to protect consumers' health data? And if not,
what recommendations might you have for us here in the Senate
regarding these policies to strengthen the protection of
consumer health data?
Mr. Soltani. That is a great question. Thank you.
Absolutely, I think we would need to expand those definitions
to not only include the kind of narrow definitions of health
data, but also some of the related health related data and that
my co-panelists mentioned, particularly when thinking about
things like AI and inferences and machine learning, where
oftentimes the data is inferences that the consumer didn't
necessarily provide, but that were made by the software system
about the consumer.
And so we want to make sure that the agency has adequate
ability to identify those problems and also create rules and
standards for safeguarding that information.
Senator Rosen. Thank you. I want to quickly kind of add on
to that because we have very vulnerable populations,
particularly our visually impaired and our hearing impaired
populations. So these technology advancements, they really can
help people locate in places and mobility impairment. We have
all kinds of things in that space. And so these kinds of
populations are vulnerable populations that really rely on this
adaptive technology to--for their day to day lives.
So this technology is not a choice where it might be for
some other app. So, again, Mr. Soltani, how do you think we can
add to our privacy laws to protect our medically vulnerable or
vulnerable populations, such as a hearing impaired, mobility
impaired, or visually impaired?
Mr. Soltani. Absolutely. I think those considerations,
again, have to be made. When you think about, it is not just
vulnerable populations, although I think they are incredibly
important, but even today, due to COVID and due to the way we
are living our lives, we are forced to use and adopt
technologies because our doctors will push them on us, right.
And so we need to essentially make sure that those
realities of the fact that we don't often have choice and are
required to provide consent, even though we may not want to,
creates a lot of problems with regards to the data collection
and use. So the ability to, for example, opt-out of any
secondary use, restrict the data to be--or require the data to
be deleted after was immediately used and require companies to
store it securely for the time they do have it, I think are
going to be critical both to any future legislation, but also
guidance to the FTC.
Senator Rosen. Thank you. I think those are--excuse me,
some great suggestions. And I look forward to us being able to
work with you to find ways to implement those. Thank you, Madam
Chair.
The Chairwoman. Which one of you showed--Senator Lujan,
Senator Warnock, which one of you--I thought--anyways,
whichever one of you is next. Senator Warnock, thank you.
STATEMENT OF HON. RAPHAEL WARNOCK,
U.S. SENATOR FROM GEORGIA
Senator Warnock. Thank you so very much, Madam Chair.
Privacy violations affect all of us and so we are grateful for
this hearing. While all of us are affected by privacy
violations, those harms can fall unequally across communities.
We have seen historically how marginalized communities or
historically marginalized communities particularly suffer from
tech companies' unchecked data collection and use.
In 2019, HUD actually sued Facebook for housing
discrimination, because its algorithms targeted housing ads
based on sensitive information, such as where people lived,
whether they were a mom, if they were--or their religion. We
have also heard reports of how platforms allow businesses to
discriminate on who actually sees certain job advertisements so
that the technology is re-inscribing in new ways old problems
of discrimination and marginalization.
Showing ads to young men and not to women or older
Americans. Professor Vladeck, how can the FTC use its
investigation and enforcement powers to hold tech companies
accountable when they enable and further deepen patterns of
discrimination?
Mr. Vladeck. That is a great question and I think your
description of the problem is spot on. The FTC has the
authority to push and to force companies to not engage in
biased activity online. And that--you know, those problems
would be sort of under the unfairness jurisdiction of the FTC.
And the FTC has done some, but probably not enough work in that
space. And, you know, my bottom line is, give the FTC more
resources and give the FTC a nudge in that direction and it
will do its job. But again, the FTC has never had more than a
few technologists on staff.
In order to sort of surveil the advertising practices,
because that is really where the problem stems from, the FTC
would need more resources. We need people online doing the kind
of day to day oversight or surveillance that if the FTC were
better resourced, the FTC could do.
Senator Warnock. I agree that the FTC needs the resources
in order to provide this kind of enforcement, which is why 20
civil rights organizations sent a letter last month asking the
FTC to create an Office of Civil Rights. Mr. Soltani, what
types of structural changes do you think would help the
Commission to build expertise and capacity to protect consumer
rights in general and marginalized communities in particular?
Mr. Soltani. Senator, thank you for the question.
Absolutely. I think the effect of these new technology systems
on already marginalized communities is immense. Most of the
kind of machine learning and AI simply, you know, is machine
learning based on what we have historically done in the past.
So often they fundamentally re-enforce existing inequities
since they just learn from past behavior.
So absolutely, either creating an Office of Civil Rights,
an OCR, that works across the agency or as I have suggested,
perhaps including that function, making sure that the new
bureau that gets created with this funding also has experts and
expertise that work across the agency's mission on these issues
of discrimination, algorithmic fairness, and bias, I think are
incredibly important. Additionally structural changes, to go to
the previous Senator's comment, I think rulemaking here, or at
least the authority to create rules, the rules of the road are
incredibly important.
So I personally have done a lot of this work. I have done
worked with The Wall Street Journal showing that, you know,
companies will charge different prices to consumers based on
where they live, how far they are from a competitor's store,
particularly in disadvantaged communities and an area codes. So
it is very difficult and hard stuff to do from the outside.
So additional resources would help, but so would
essentially guidance to companies that they need to self-test
and self-attest, self-verify that their systems do not bias
against consumers on areas like, you know, race, gender, age
for protected categories like housing, credit, employment,
right. And I think companies are in the best position to do
this and can provide those attestations to the FTC.
And if the FTC has qualified staff to then review and
verify, that would help really move the ball forward, I think.
The Chairwoman. And just to clarify on that, Ashkan, to the
earlier question about transparency and Senator Thune?s'
question to the panel, if you had algorithm transparency, you
would then determine whether that algorithm did have bias in
it, so.
Mr. Soltani. To some degree. Oftentimes, as I said, with
machine learning, most of the creators of the system---like in
the HUD example, right. So it wasn't that the advertisers
themselves or even Facebook intentionally was guiding the
algorithm to have disparate impact on who was served certain
advertising to who HUD made offers to. It's that the systems to
learn.
And so that is kind of difficult to provide just from
transparency alone, because it consists of both the algorithms
and the underlying data, which is often not available for
privacy reasons. So what you would rather do is, in addition to
transparency, you want to provide testing and accreditation
that the bias doesn't exist on these protected categories.
Senator Warnock. Thank you so much. I think with data
collection and algorithms and the technology, there is this
this sort of perception of objectivity and what we are seeing
is a ways in which it further creates increased
marginalization, and we have to be vigilant in order to protect
that.
The Chairwoman. Thank you. Thank you, Senator Warnock.
Senator Lujan.
STATEMENT OF HON. BEN RAY LUJAN,
U.S. SENATOR FROM NEW MEXICO
Senator Lujan. Thank you, Chair. I want to thank you and
our ranking member for holding the hearing to discuss critical
issues involving consumer privacy. As we know today, companies
and platforms collect an unprecedented amount of data. And I
believe that this committee and Congress should act to protect
consumers' data from bad actors. The Commerce Committee has a
clear responsibility to ensure that consumers' personal data is
only used when the informed consent of consumers is given.
Congress must give the FTC sufficient resources to do its job.
I support additional funding for the FTC to establish a new
privacy bureau.
The Chair fought for such a bureau in the Consumer Online
Privacy Rights Act, and I am encouraged to see this critical
initiative moving forward. Now, companies have failed to
adequately protect data and user privacy. Bad actors have
gained access to my constituents' health records, financial
information, and Social Security numbers. They have used this
data to threaten families' livelihoods, and it has impacted
hundreds of thousands of people in New Mexico and millions
across America.
This is a real problem, and the problem is only getting
worse with every data breach that we learn about. Mr. Soltani,
yes or no. Today, does the FTC have the technical expertise to
fully protect consumer privacy?
Mr. Soltani. Unfortunately, no, Senator.
Senator Lujan. Mr. Soltani, yes or no. Would hiring more
technologists at the FTC help protect families from data
breaches and bad actors?
Mr. Soltani. Absolutely, yes. Particularly if you consider
technologists broadly, not just folks like myself.
Senator Lujan. And Mr. Soltani, you have advocated
repeatedly for Congress to invest more resources for
technologists at the FTC, so thank you for the work you have
done on this topic. In your testimony, you highlighted the
importance of having technologists who are empowered to serve
the entire agency, and I share your view. That is why I am
introducing a bill, the Federal Trade Commission Technologist
Act, will establish an office of technologists within the FTC
that can work across the Commission to solve these problems.
An office like this would give the privacy bureau the Chair
has put forth the tools it needs. It would also provide
critical technological expertise in areas like antitrust and
competition. Mr. Soltani, do you support my goal of making
technologists available across the Commission?
Mr. Soltani. Absolutely. I think that is exactly the right
move.
Senator Lujan. And there are a few other questions I have
in that space. I will submit them to the record. The current
State of Federal privacy law is a patchwork of requirements
varying from industry to industry with many holes. Many of my
colleagues today have raised the concerns where HIPPA is a
clear example that Federal law was a game changer. HIPPA is a
household term now. The legislation and its protection of
health information has become fundamental.
For example, if I go to my doctor to get an echocardiogram
or genomic testing, the health information they collect from me
and my body is protected by HIPPA, but collect the same
information from the same place, but with an Apple watch,
health app, or consumer biotech, and it is the Wild West. It
makes zero sense to me. This month, the FTC announced that they
will be increasing enforcement for applications that collect
personal health information. But an FTC--but as the FTC Chair
noted, this action reflects a more fundamental problem, the
commodification of sensitive health information.
As we embark on the task of creating more comprehensive
privacy requirements for technology companies, are there any
lessons learned from HIPPA and how to effectively protect
health data? And I would ask any of the witnesses to come
forward.
Mr. Reed. Yes, I think--I think one of the things, Senator,
that is interesting is, I doubt we have had a more poorly
understood law than HIPPA or rather the privacy rule of it. And
it actually gets to the core thing that all of the witnesses
have been asking for here today, and that is a Federal privacy
legislation. As you know, when HIPPA was passed, the privacy
rule was actually done years later, and it was not done by
Congress.
And part of the problem is, it is hampered by the fact, and
this is why we need Federal privacy legislation---it is
hampered by the fact that it is actually triggered by the
filing of an electronic insurance claim tied to record
portability. And the reason it cannot cover the other material
that you asked is because the statute that gave HIPPA its
origin story is very closely tied to portability of data.
So a Federal privacy law that actually starts from the
premise of we need to protect privacy is the place to start
rather than starting from data portability, oh, yes, let's add
privacy to it. So it is really the origin story of HIPPA that
causes so much of the confusion. And now that is why we are all
here today to say, let's have Federal privacy legislation that
starts from a discussion of privacy rather than tail on the
dog.
Senator Lujan. I appreciate that. Well, I am about out of
time, so if we could ask you to submit that into the record. I
am also going to be submitting a question to the record with my
concerns about what the chair pointed out with commodification
of sensitive health information. I am very interested in your
response there. Last, Chair Cantwell, in the space that was
raised a few times by my colleague from Wyoming, Ms. Lummis,
specific about Facebook and collecting user information on
people that have never agreed to terms of service.
Will also be submitting a follow up to a round of
questioning I had with Mr. Zuckerberg when I was a member of
the House around how the FTC and Congress can protect the
privacy of our constituents who have never signed up for an
account or assigned terms of service agreements. Very much
appreciate this hearing and look forward to following up.
The Chairwoman. Thank you and thank you for crystallizing
the issue about technologists with the legislation. That will
be very helpful. Thank you. Senator Blumenthal.
STATEMENT OF HON. RICHARD BLUMENTHAL,
U.S. SENATOR FROM CONNECTICUT
Senator Blumenthal. Thank you, Senator Cantwell, and thank
you for having this hearing. There are now some pretty good
indications that the Federal Trade Commission is going to have
or begin rulemaking on privacy. This development would be very,
very welcome. Last week, I wrote to Chair Khan, along with
Senators Klobuchar, Markey, and Schatz, and Lujan, and four
other colleagues urging the FTC to start rulemaking concerning
privacy. A coalition of 24 major national civil rights groups,
privacy advocates, and consumer groups have joined in the call
for that action.
The reason is very simply that Congress has failed to act,
in fact, failed abjectly to fulfill its responsibility. Not
that the issues are simple or easy, but the FTC is supposed to
fill gaps that occur when Congress sometimes fails to do so. I
understand that members of the panel have expressed
reservations about it. I am not sure I understand the
preemption objection. I think the resource issue can be
surmounted.
And if Congress were willing to act, of course, that might
be everyone's preference, but it is what it is, and in the
meantime, states are also filling the gap. That is the nature
of our Federal system, right, laboratories of democracy. But
the FTC should start the clock on primary rule--privacy rules.
Either Congress acts or the Commission does, and FTC rulemaking
at the very least would build a record and provide
recommendations to Congress for action. Tomorrow, Senator
Blackburn and I are holding a hearing in our subcommittee on
Consumer Protection about how platforms like Facebook and
Instagram harm the mental health of children and teens, not
only invade privacy, but actually knowingly harm children, and
in fact, how they have concealed that harm and their knowledge
of it.
Over the last two weeks, there have been some pretty
chilling revelations about Facebook, including an article just
yesterday about its efforts to insert itself into the play
dates of children. This would be laughable to a parent who
finds it impossible to insert himself or herself into play
dates, but it is deathly serious. There are widespread issues
with Facebook and kids, including the fact that there are
already millions of teens on Instagram, despite restrictions
under the Children's Online Privacy Protection Act.
The decision to pause Instagram for Kids is a positive
step, but too little, and there should be a permanent pause. I
am troubled that the mental health and safety of teens and
children are seemingly treated as an afterthought by big tech.
These issues of grooming, manipulative advertising, addiction
and abuse are rampant.
These practices hurt kids. And what we have all seen from
Facebook, I think is deeply disturbing. I know, in Connecticut,
outrage is an understatement as to what many moms feel about
how their daughters are exposed to the kind of harm that has
been depicted so graphically by the whistleblower and the
documents that whistleblower revealed to The Wall Street
Journal.
So I would like to ask Mr. Soltani, in your testimony you
talk about how existing enforcement tools don't sufficiently
address, and I am quoting, ``the psychological harms caused to
teens by social media.'' What additional resources and
authorities do you believe the FTC needs to confront this toxic
relationship between teens and big tech? And if we have time, I
will let others comment on it as well. Mr. Soltani?
Mr. Soltani. Thank you for the question, Senator.
Absolutely, I think you need both resources and authorities. So
as I have said previously, the FTC has limited ability to go
after these types of data abuses or data harms under the
unfairness authority, particularly because they are often hard
to demonstrate. Perhaps, maybe not as much on the issue of
kids, but often in any discrimination or any manipulation and
dark patterns, it is very hard to get to in fairness. So often
the FTC relies on its deception or its deception authority
under Section 5.
And so I think having either in legislation or additional
authorities for the FTC or at least clarifying that the FTC
should issue rules around abuse--data abuse and the use of
essentially manipulating dark patterns. Additionally, I think
the resources that we are discussing in this hearing today are
absolutely critical, right. So right now, if you go to Facebook
or Instagram, there are multiple data scientist roles for
Instagram youth. And they are essentially for to find
innovative ways to tackle appropriate content standards via
data analysis, experimentation, and statistical modeling.
The FTC needs experts that can understand and perform the
same research, evaluate the work that Facebook and others are
doing to perform the manipulation and the targeting in order to
assess whether it is, in fact, harmful or problematic. And so I
think in addition to authorities having experts in kids
psychology, behavioral economics, design the UX and choice
architecture, which is a lot of what this work is, is giving
people, you know, manipulating people's choice, I think are
going to be critical.
Senator Blumenthal. Thank you very much for that response.
I--my time has expired, so I would invite others to respond in
writing, if you wish to do so. Very much appreciate all of you
being here. Thank you.
The Chairwoman. Thank you, Senator Blumenthal. And thank
you for your leadership at the Subcommittee level on this
important issue and for your work with many of our colleagues
on this and your letters. Thank you. That is continued focus on
a very needed area.
I thank all of our witnesses today for testifying before
the Committee. The hearing will remain open for a time period
for members to submit questions. We ask you to respond to those
in a timely fashion. And again, we appreciate the details and
the information from the hearing today. We are adjourned.
[Whereupon, at 12:29 p.m., the hearing was adjourned.]
A P P E N D I X
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Response to Written Question Submitted by Hon. Ray Ben Lujan to
David C. Vladeck
Question. As FTC Chair Lina Khan noted, the commodification of
sensitive health information for behavioral ads or user analytics is a
serious concern for user privacy. Question. How should Congress and the
FTC protect sensitive health information from commodification? What
additional safeguards are necessary to ensure this information is
protected from data breaches or other nonconsensual distribution?
Answer. The question is a vexing one because it exposes the
weakness in the statutory mandate of the Federal Trade Commission to
safeguard consumer privacy. The FTC's consumer protection remit is to
``prevent'' ``unfair and deceptive acts and practices in or affecting
commerce.'' 15 U.S.C. Sec. Sec. 45(a)(1) & (2). Congress has confined
the FTC's ``unfairness'' mandate by requiring that an act be not only
``unfair'' to consumers, but also that the consumer could not
``reasonably avoid[]'' the unfair act. Id. at 45(n). Equally
problematic, the FTC's deception authority depends on false,
misleading, or omitted claims. Because consumers must ``consent'' to
use websites, the harvesting of data is not necessarily deceptive. The
FTC has long sought legislation to enable it to provide robust
protection of sensitive data. After all, companies often use that data
used for purposes that may be harmful to consumers. As I made clear in
my written testimony, I urge Congress to enact more targeted general
legislation giving the FTC the tools it needs to protect consumer
privacy--tools the FTC has sought for several decades.
______
Response to Written Question Submitted by Hon. Raphael Warnock to
David C. Vladeck
Question. Consumer Comprehension. Since the COVID-19 pandemic, we
have all learned how to use a lot of new online tools--whether for
work, school, or telehealth. And most of the time that we log into
these new applications, we're given a 10 or 20 page ``privacy policy''
that is full of complicated legal language and jargon, and many
consumers are left confused about what their rights are and what they
have signed away. Question. How can Congress and the FTC make it easier
for consumers--especially those with lower levels of digital literacy--
to understand and control how their data is used and collected?
Answer. At least since my tenure at the FTC, starting in 2009, the
Commission has railed at the ``privacy policies'' as little more than
obfuscation for consumers. Consumers have to endure to try to
understand the basic questions about what consumer data is being
harvested, by what companies, and for what purposes? What are companies
doing with that data? Is the data being used for targeted ads? Are
companies using your personal information to make ads even more
effective? Are the companies engaged in geolocation tracking? Are
companies selling your data to other companies? And if so, to what
companies, and for what purposes? I could go on. But you see my point.
Lawyers write privacy policies to provide enough information so that
the policy is not deceptive, but no more information than is absolutely
necessary.
My view is that the term ``privacy policy'' is a gross misnomer.
These policies are not ``privacy policies'' at all. Most of these
policies deal with data-acquisition and use; not privacy. In truth,
they are data use policies, which are invariably non-negotiable.
Consumers use websites and apps on a take-it-or-leave it basis, and
consumers rarely leave it because they need to be able to engage in our
digital economy.
As with the prior question, the FTC cannot change the status quo
without clearer, more powerful, and more targeted tools to protect
consumer privacy on line. This question, like the one submitted by
Senator Lujan, goes to the heart of the FTC's limited ability to
protect consumer privacy. I urge the Committee to continue to develop
legislation aimed at addressing these and other issues relating to
online privacy.
______
Response to Written Question Submitted by Hon. John Thune to
David C. Vladeck
Question. Do you believe that a single national privacy standard
should provide consumers with more control of their data and how do we
ensure that data is protected?
Answer. Yes, I believe that it is time for Congress to enact
comprehensive privacy legislation that provides consumers far more
control of their data than they can exercise at the present. The FTC's
existing mandate permits the Commission to reign in practices that are
deceptive and unfair, but that mandate is insufficient to provide
robust privacy protection, especially when services are offered on a
take-it-or-leave it basis.
Equally problematic is that all too often companies do not make
sufficient investment in safeguarding data, including data that has
commercial value (like payment card information) or is sensitive for
other reasons. The FTC has brought dozens of enforcement cases against
companies that have failed to take reasonable measures to secure
sensitive information, but apart from bringing an enforcement action
and getting the company under order, there is no redress or penalty for
first violations under the Federal Trade Commission Act. As a result,
deterrence kicks in only after a company has experienced a breach due
to unduly lax security. Congress needs to authorize the FTC to impose
civil penalties on first offenders, or else the status quo will remain
in place and companies will get at least one free bite at the apple.
______
Response to Written Question Submitted by Hon. Marsha Blackburn to
David C. Vladeck
Question. Over the past few years, developers have been creating
new financial services apps directed towards children. As more parents
sign their kids up for these apps, it raises questions about what kinds
of data they are collecting and how they use it.
Do you share these concerns and what steps do you think we should
take to get a better handle on this issue?
Answer. I share your concerns, and worry that parents might sign up
their children for these apps without any understanding about what data
the companies are collecting and how that data is being used. Of course
Congress, with its broad investigatory powers, could undertake an
investigation. But so too could the FTC. But your question underscores
the need to provide more resources to the FTC, which is severely under-
staffed and under-funded. Until the FTC is adequately resourced, it
will necessarily engage in triage, leaving some important matters
unaddressed, or deferred. With needed resources, the FTC could
undertake an investigation of these apps to answer the questions you
pose about data harvesting and use. The FTC could do so by
investigating a few companies offering these apps, or, if appropriate,
through a broader industry study under the FTC's authority under 6(b)
of the FTC Act. In that event, the FTC would then issue a report
addressing the questions you posed, and thus give parents the
information they need to make an informed decision.
______
Response to Written Question Submitted by Hon. Ben Ray Lujan to
Maureen K. Ohlhausen
I'm especially concerned by websites collecting personal
information when a user hasn't entered into any agreement or been
presented with information on how that collected information may be
used or sold.
Question. How should the FTC and Congress protect the data of
individuals who have never signed up for an account or signed terms of
service?
Answer. Section 5 of the FTC Act gives the FTC authority to prevent
``unfair'' acts or practices that cause or are likely to cause
substantial harm to consumers that consumers cannot reasonably avoid
and that are not outweighed by countervailing benefits to competition
or consumers. Using this authority, the FTC has brought enforcement
actions in situations where websites that do not have relationships
with individual consumers collect their personal information and use it
in a way that harms them or collect consumers' sensitive personal
information without their consent.
While the FTC has used its limited authority in these situations,
Congress can provide even greater protections to consumers by enacting
comprehensive, technology neutral, national privacy legislation that
provides clear protections for consumers, articulates specific limits
on companies' ability to collect, use, and share sensitive personal
information, and grants the FTC the resources and explicit authority
necessary to enforce a new law.
______
Response to Written Question Submitted by Hon. Raphael Warnock to
Maureen K. Ohlhausen
Consumer Comprehension. Since the COVID-19 pandemic, we have all
learned how to use a lot of new online tools--whether for work, school,
or telehealth. And most of the time that we log into these new
applications, we're given a 10 or 20 page ``privacy policy'' that is
full of complicated legal language and jargon, and many consumers are
left confused about what their rights are and what they have signed
away.
Question. How can Congress and the FTC make it easier for
consumers--especially those with lower levels of digital literacy--to
understand and control how their data is used and collected?
Answer. Due to the COVID-19 pandemic, we have seen a rapid shift to
online work and learning, which makes even more apparent the need for
comprehensive privacy legislation that makes privacy protections
uniform, clear, and transparent. Congress should enact Federal privacy
legislation that includes several key attributes that will help make
privacy policies clearer and simpler for all Americans. First,
legislation should provide a national and uniform set of protections
and consumer rights throughout our digital economy. Second, it should
ensure strong enforcement that protects consumer information that could
result in harm if disclosed or misused, while also allowing companies
to provide and develop innovative products and services that consumers
want. Third, it should provide consumers clarity and visibility into
companies' data collection, use, and sharing practices, as well as
easily understandable choices regarding these practices, calibrated to
the sensitivity of that data. Fourth, legislation should be more
comprehensive than current state laws, such as the CCPA, addressing
more elements of the data cycle. Fifth, Federal privacy legislation
should be enforced by the FTC, which has the experience and skill to
meaningfully enforce a new law's protections, supplemented by state
attorneys general.
______
Response to Written Questions Submitted by Hon. John Thune to
Maureen K. Ohlhausen
Question 1. Do you believe a single national privacy standard
should provide consumers with more control of their data and how do we
ensure that data is protected?
Answer. Yes, I believe a single national privacy law would provide
consistent enhanced protections to consumers throughout the United
States, which means they would have this increased control regardless
of where they live, work, or visit. Congress should ensure that a
single national privacy law includes strong privacy protections.
Question 2. I believe it is Congress' responsibility to take action
on privacy legislation rather than punting it to the FTC. Can you talk
about some of the challenges the FTC would have by conducting a non-
preemptive rulemaking to address privacy concerns?
Answer. I have three primary concerns about a non-preemptive FTC
rulemaking. First, given the scope of the FTC's current statutory
authority, an FTC rulemaking could not be as comprehensive as
legislation. Second, under the FTC's Magnuson-Moss rulemaking
requirements, a general privacy rulemaking involves a cumbersome
process and is time-consuming. Third, a non-preemptive rulemaking could
cause confusion and uncertainty about what requirements apply in a
particular state and create regulatory complexity that hurts small
business.
Question 3. The PACT Act, Section 230 legislation I introduced with
Senator Schatz would, among other things, provide that the immunity
provided by Section 230 does not apply to civil enforcement actions
brought by the Federal government.
Do you believe that by reforming Section 230 to ensure that the
immunity provided by Section 230 does not apply to civil enforcement
actions brought by the Federal government, such as the FTC, would
benefit consumers?
Answer. Unfortunately, Section 230 is beyond my areas of expertise.
______
Response to Written Questions Submitted by Hon. Marsha Blackburn to
Maureen K. Ohlhausen
Question 1. I share the concerns you highlighted in your testimony
about the FTC moving forward with a privacy rulemaking without a
Federal law enacted by Congress to set the guidelines for consumers and
businesses. I introduced the Browser Act (one of the first bipartisan
privacy bills in Congress), as well as the Safe Data Act with Senator
Wicker, and am fully committed to getting a Federal privacy law across
the finish line. So I'm understandably wary of actions the FTC has
taken to short circuit its rulemaking procedures in order to plow ahead
with a privacy rulemaking.
Can you walk us through some of the problems here?
Is this a way to enact policies that might not get bipartisan
support in Congress--or even things the FTC might not be legally
authorized to do?
Answer. I have three primary concerns about an FTC general privacy
rulemaking. First, given the scope of the FTC's current statutory
authority, an FTC rulemaking could not be as comprehensive as
legislation. Second, under the FTC's Magnuson-Moss rulemaking
requirements, a general privacy rulemaking involves a cumbersome
process and is time-consuming. Third, a non-preemptive rulemaking could
cause confusion and uncertainty about what requirements apply in a
particular state, and create regulatory complexity that hurts small
business.
Question 2. When you were an FTC Commissioner, you played a key
role in negotiating the privacy shield for international data transfers
after the ``safe harbor'' provisions were struck down.
How was the U.S. able to come to a deal with the EU last time, and
why are we struggling to provide this certainty to businesses and
consumers now?
Answer. While we reached an agreement on the Privacy Shield last
time, the European court eventually found it was not sufficient. Having
a comprehensive Federal law may help support a lasting EU determination
that our privacy law is adequate under EU law, thereby providing
greater certainty to businesses and consumers.
______
Response to Written Question Submitted by Hon. Ben Ray Lujan to
Ashkan Soltani
NOTE: The following responses are provided in my personal capacity
and do not reflect or represent the views of any employer, past or
present.
Question. In your testimony, you refer to the need to enable to FTC
to better compete and retain talented individuals with relevant skills
and experience. What reforms do you believe would be most impactful in
making the Commission more competitive when hiring for top-level
talent?
Answer. As I noted in my testimony, based on my experiences as
Chief Technologist of the Federal Trade Commission (FTC), the FTC needs
more resources to hire technologists and to attract top talent. I
appreciate Senator Lujan's continued commitment to helping to ensure
that the FTC has the resources it needs to build its technology staff.
For example, Senator Lujan's Federal Trade Commission Technologists
Act, which was introduced in the House of Representatives by Rep.
McNerney of California, provides funding to create a separate Office of
Technology in the FTC, staffed with at least 25 technologists. This
would be an excellent first step in building the FTC's capacity to
police unfair and deceptive practices related to privacy and data
security.
Senator Lujan's bill is important not only because it would allow
the FTC to hire more technologists, but because the creation of a
separate office for technologists would allow them to more effectively
support all FTC divisions. Technologist support is important not only
for the Division of Privacy and Identity Protection (DPIP), which
initiates investigations, but for the enforcement team as well, which
is a separate division that oversees compliance with FTC orders across
all divisions. Technologist support is also needed at the Bureau of
Competition, since technology and data pervade nearly every case that
comes before the Commission. Housing the technologists in a separate
office will make it more likely that they will be able to provide
support across the Commission.
Of course, it's also important to attract and retain top talent.
Top technologists would likely make far less in the public sector than
they could in the private sector. At minimum, the FTC should be
prepared to match candidates' existing salaries.
______
Response to Written Questions Submitted by Hon. Raphael Warnock to
Ashkan Soltani
Consumer Comprehension. Since the COVID-19 pandemic, we have all
learned how to use a lot of new online tools--whether for work, school,
or telehealth. And most of the time that we log into these new
applications, we're given a 10 or 20 page ``privacy policy'' that is
full of complicated legal language and jargon, and many consumers are
left confused about what their rights are and what they have signed
away.
Question. How can Congress and the FTC make it easier for
consumers--especially those with lower levels of digital literacy--to
understand and control how their data is used and collected?
Answer. I can certainly sympathize with consumers who are
frustrated by incomprehensible privacy policies. Businesses should be
required to clearly outline their data practices--not only to inform
consumers, but so that enforcement authorities can hold businesses
accountable for wrongdoing. California has been a leader in this space,
and as early as 2003, adopted the California Online Privacy Protection
Act (CalOPPA), becoming the first state to require businesses to
outline their data practices in a public privacy policy.
In addition, the California Consumer Privacy Act of 2018, as
amended by Proposition 24, the California Privacy Rights Act of 2020
(CCPA), takes steps to make privacy policies accessible for the public.
Under the CCPA, California consumers have the right to know what
personal information a business has collected about them and how it is
used and shared. The California law requires businesses to inform
consumers of the categories of information it has collected, the
categories of sources from which it was collected, the business or
commercial purpose for collecting, selling, or sharing personal
information, and the categories of third parties to whom the business
discloses personal information.
Importantly, the CCPA regulations require businesses to ensure that
the notices and information that businesses are required to provide,
are presented in a manner that may be easily understood by the average
consumer, are accessible to consumers with disabilities, and are
available in the language primarily used to interact with the consumer.
This performance-based approach clarifies that disclosures and
communications must be designed and presented in a way that is easy to
read and understandable by consumers, including those with
disabilities. And the regulations use the language of ``reasonably
accessible to consumers with disabilities'' to acknowledge that the
definition of disabilities may be broad, and thus, the business's
obligations are tied to a generally recognized industry standard such
as the Web Content Accessibility Guidelines.\1\
---------------------------------------------------------------------------
\1\ Cal. Code Regs. tit. 11 Sec. 7011
---------------------------------------------------------------------------
In addition, businesses are currently required by CCPA regulation
to honor browser privacy signals as a global opt out of sale, so that
consumers can exercise their privacy preferences with covered
businesses in a single step,\2\ rather than needing to seek out
cumbersome settings with every business they interact with. These
provisions together help make the CCPA workable for consumers of all
levels of literacy and sophistication.
---------------------------------------------------------------------------
\2\ Cal. Code Regs. tit. 11 Sec. 7026
---------------------------------------------------------------------------
Lastly, the CCPA is not only designed to make it easy for consumers
to exercise their rights, it also provides protections beyond just
``notice and choice'' through its data minimization and purpose
limitation provisions. The CCPA, as amended by the CPRA, introduces
data minimization and purpose limitation provisions that put limits on
the collection, use, retention, and disclosure of personal information
in the first place, so that consumer privacy is protected by
default.\3\ These provisions are described in more detail in the next
response.
---------------------------------------------------------------------------
\3\ Civil Code Sec. 1798.100(c).
Data Minimization Requirements. In 2018, the Supreme Court held
that under the Fourth Amendment, law enforcement officers must apply
for a warrant to obtain cell-site location data from wireless carriers.
That is because location data can reveal intimate details about our
lives. Recently, however, we have seen reports that law enforcement
agencies are obtaining consumers' location data through commercial
vendors, bypassing these Constitutional protections. One way to curb
these practices would be to require that technology companies employ
data minimization practices, so that data could only be stored for
---------------------------------------------------------------------------
specific purposes.
Question. Do you believe data minimization procedures would help
protect consumer privacy?
Answer. Yes. Data minimization and purpose limitation provisions
are increasingly common in privacy legislation. These provisions
typically prohibit unnecessary collection, use, retention, and
disclosure of personal information--and in so doing, enable consumers
to use online products and services safely, without having to take
additional steps to protect their privacy. Data minimization and
purpose limitation language was added to the California Consumer
Privacy Act by Proposition 24, and uses language consistent with
language in Europe's General Data Protection Regulation (GDPR), the
Virginia Consumer Data Protection Act, the Colorado Privacy Act, and
Connecticut's new privacy law--highlighting its increased currency. The
CCPA as amended by Proposition 24 states, ``A business's collection,
use, retention, and sharing of a consumer's personal information shall
be reasonably necessary and proportionate to achieve the purposes for
which the personal information was collected or processed, or for
another disclosed purpose that is compatible with the context in which
the personal information was collected, and not further processed in a
manner that is incompatible with those purposes.'' \4\
---------------------------------------------------------------------------
\4\ Civil Code Sec. 1798.100(c).
---------------------------------------------------------------------------
In addition, two new California laws have placed new data
minimization requirements on certain covered businesses. For example,
SB 1172, the Student Test Taker Privacy Protection Act, provides that,
subject to certain exemptions, ``a business providing proctoring
services in an educational setting shall collect, use, retain, and
disclose only the personal information strictly necessary to provide
those services.'' \5\
---------------------------------------------------------------------------
\5\ SB 1172, The Student Test Taker Privacy Protection Act (2022),
https://leginfo.legislature
.ca.gov/faces/billNavClient.xhtml?bill_id=202120220SB1172.
---------------------------------------------------------------------------
Similarly, AB 2273, the California Age-Appropriate Design Code, has
several provisions that minimize data processing. For example, it
provides that, subject to certain exemptions, a covered business may
not collect, share, sell, or retain any personal information that is
not necessary to provide a product, service, or feature with which a
child is actively and knowingly engaged, unless the business can
demonstrate a compelling reason that such processing is in the best
interests of children likely to access the product, service, or
feature. Additionally, the law provides that businesses may not
collect, sell, or share precise geolocation information of children by
default, unless the collection is strictly necessary to provide the
requested product, service, or feature, and only then for the limited
time that such collection is necessary to provide it.\6\
---------------------------------------------------------------------------
\6\ AB 2273, The California Age-Appropriate Design Code (2022),
https://leginfo.legislature
.ca.gov/faces/billNavClient.xhtml?bill_id=202120220AB2273.
---------------------------------------------------------------------------
Both measures, like the CCPA as amended, limit the personal
information businesses can collect and use to what the average consumer
would expect in that situation without having to obtain explicit
consent.
______
Response to Written Question Submitted by Hon. Raphael Warnock to
Morgan Reed
Consumer Comprehension. Since the COVID-19 pandemic, we have all
learned how to use a lot of new online tools--whether for work, school,
or telehealth. And most of the time that we log into these new
applications, we're given a 10 or 20 page ``privacy policy'' that is
full of complicated legal language and jargon, and many consumers are
left confused about what their rights are and what they have signed
away.
Question. How can Congress and the FTC make it easier for
consumers--especially those with lower levels of digital literacy--to
understand and control how their data is used and collected?
Answer. ACT | The App Association recognizes that the modern notice
and consent model is not always a sufficient means of communicating
privacy expectations or establishing a relationship of trust. Consent
often fails to contemplate dynamic uses of data and does not
encapsulate consumers' future expectations given the passage of time or
changing contexts. We believe Congress has the best position, through
the framework of a Federal privacy law, to retool the consent model so
that it centers on consumer experience while preserving the ability for
small innovators to compete and develop better privacy practices and
communication methods.
Our members currently leverage several promising efforts developed
at the platform level to enhance consumer understanding and control
over their data outside of the traditional privacy policy paradigm. For
example, Apple recently introduced privacy ``nutrition'' labels that
allow app developers to give users a more intuitive sense of the app's
privacy policies, allowing good actors to easily demonstrate their
commitment to responsible privacy stewardship. The nutrition label
surfaces key information for users, saving them from having to dig
through the entire privacy policy. Apple's new App Tracking
Transparency tool also provides an easy and efficient way for users to
opt-out of unwanted tracking that follows them outside of the app onto
websites or even other third-party apps. Proposals introduced by the
Chair and Ranking Member of the committee, including the SAFE DATA Act
and Consumer Online Privacy Rights Act (COPRA), align with those
advancements by requiring consumer friendly opt-out rights for non-
sensitive personal information. As Congress and the Federal Trade
Commission debate future policymaking on privacy issues, they should
consider how they can encourage and incentivize further development of
such privacy-enhancing technologies. At the same time, Congress should
also reject proposals like the American Innovation and Choice Act (S.
2992), which would expand the scope of antitrust law in ways that
presume the illegality of these platform level privacy controls.
Another consideration is that our Nation's current patchwork
approach to privacy, with incongruous sectoral privacy laws (including
the Health Insurance Portability and Accountability Act and the Gramm-
Leach-Bliley Act) and growing differences among the states, greatly
contributes to consumer confusion. A Federal privacy law that creates
strong consumer rights will raise the baseline of protection, ensuring
that no matter where in the country a person lives, they enjoy certain
protections. In particular, a Federal law should empower consumers to
exert more control over their personal information, including the
rights to access, correction, and deletion of such information.
Sensitive personal information should also be subject to some limits on
processing activities that pose too great a risk to consumers, which is
not outweighed by countervailing benefits.
______
Response to Written Questions Submitted by Hon. John Thune to
Morgan Reed
Question 1. Do you believe a single national privacy standard
should provide consumers with more control of their data and how do we
ensure that data is protected?
Answer. Yes. Let me break this question down into its constituent
parts:
1. A single, national privacy standard. Ensuring that a general,
Federal consumer privacy law is the law of the land across all
states is critical to achieving Congress' goals in this space
and is the best outcome for App Association members and your
constituents for a few reasons:
a. Compliance. Our member companies may be the smallest software
and connected device makers, but they are not afraid of
complying with strong privacy laws. Yet, what separates
them from much larger companies is that they have a lower
tolerance for compliance with slightly differing regimes
across states, whether those differences directly conflict
or not. This is especially true if complying with different
obligations requires substantial expenditures that do not
result in greater consumer protection. Compliance for
compliance's sake imposes needless costs on small firms in
the app economy and is an inefficient way of changing
behavior, which we know is a major aim of privacy
legislation. In fact, the lack of a single set of Federal
rules has led small companies not to invest, in large part
due to uncertainty about how states will legislate on
privacy. As our member company Walker Tracker has shared,
they mainly ruled out smaller clients and smaller contracts
due to uncertainty about privacy compliance costs in the
next year. These are tangible costs that affect your
constituents and our member companies.
b. Consumer benefit. Although states actively compete with each
other to provide better (a subjective concept) privacy
protections than their peers, these differing regimes may
actually be unhelpful for consumers, especially in today's
mobile environment. A major feature of most of these state
proposals and new laws is a set of consumer rights to
access, correct, and delete information about themselves
held by covered companies. To the extent that the
dimensions of these rights and the process used to
effectuate them differ, consumers are likely to be confused
about how it is supposed to work. Each state might
carefully design the process they envision to be user-
friendly and therefore effective protections, but a South
Dakota resident might think California's privacy law
applies to her, but she would be wrong. If South Dakota
enacts a general privacy law with consumer rights, covering
South Dakota residents, she would be able to exercise those
rights--but how do they differ from California's process,
which the press continues to cover much more extensively?
Is it even worth trying to make use of them when the
company actually calibrated its compliance program to
California's law and has not yet figured out how to deal
with South Dakota's? This scenario does not help the South
Dakota resident much.
c. Global Competitiveness. Europe's General Data Protection
Regulation (GDPR), despite its flaws, is mainly preemptive
of analogous Member State privacy laws. Through a single
set of privacy laws that govern the continent, the European
Union (EU) made a statement to its global trading partners
and others that it is both serious about privacy and that
processing data on EU subjects would involve compliance
with a single set of laws (albeit enforced differently by
Member State data protection authorities). Placing American
companies at a relative disadvantage by saddling them with
anywhere from three to 50 different privacy regimes across
the states hurts our privacy profile in the trade context
and also undermines global competitive of U.S. based
industries.
2. Putting consumers more in control of their data. A Federal law
should empower consumers to exert more control over their
personal information, including the rights to access,
correction, and deletion of such information. Sensitive
personal information should also be subject to some limits on
processing activities that pose too great a risk to consumers,
which is not outweighed by countervailing benefits.
3. Better data protection. Federal privacy legislation should
include a data security requirement. We support the SAFE DATA
Act (S. 2499), a version of which you co-authored last year.
This Congress' version includes a data security requirement at
Section 203, which strikes a good balance. Specifically, it
requires covered entities to maintain reasonable a)
administrative, b) technical, and c) physical data security
policies and practices to protect against risks to the
confidentiality, security, and integrity of covered data.
Notably, the requirements are scalable insofar as they must be
appropriate to the size and complexity of the covered entity;
the nature and scope of the covered entity's collection or
processing of covered data; the volume and nature of the
covered data; and the costs of available tools to improve
security and reduce vulnerabilities. Section 203 also provides
that the required data security practices take baseline
measures to address security threats, and that they are
designed to: identify and assess vulnerabilities; take
reasonable preventative and corrective action to address known
vulnerabilities; and detect, respond to, and recover from
security incidents. These are robust requirements that exceed
most state law requirements and would better protect consumers
from the threat of data security incidents, while allowing
flexibility for smaller companies to comply and compete.
______
Response to Written Questions Submitted by Hon. Marsha Blackburn to
Morgan Reed
Question 1. You represent many members of the app ecosystem.
Are any of your members engaged in marketing financial service apps
to kids? If so, what are they doing to protect kids' personal and
financial data?
Answer. REGO Payment Architectures offers an app available now on
the App Store, Mazoola, marketed to parents to enable their kids to
engage in limited digital transactions, with parental control and
guidance. As a financial services company, Mazoola is subject to the
Gramm-Leach-Bliley Act (GLBA)--but is not necessarily required to
comply with the Children's Online Privacy Protection Act (COPPA).
Nonetheless, Mazoola complies with both GLBA and COPPA and requires
parents to provide verifiable parental consent (VPC) before they
collect any data pertaining to children under the age of 13. By
complying with both regimes, Mazoola observes strict rules around
consent for collection of data found in COPPA rules and also complies
with the robust Federal Trade Commission (FTC) Safeguards Rule under
GLBA. The FTC is actively reviewing the Safeguards Rule and has
proposed updates including a requirement for financial institutions to
use strong encryption to protect financial information, including when
it pertains to children.
Your question also raises a concern we have with how the FTC tries
to address privacy gaps in the absence of Federal privacy legislation.
For example, the FTC issued a policy statement on September 15, 2021,
indicating its intention to enforce its health breach notification rule
in situations that do not involve a data breach. Specifically, the
statement articulates the FTC's position that the rule applies when
companies engage in ``sharing of covered information without an
individual's authorization.'' \1\ Sharing of information on purpose
with a third party without proper consent or authorization, or in a
manner that disrespects the context and expectations of a consumer, is
a privacy issue, not a data breach. The FTC's statement, therefore, is
concerning and is both an inadequate and a confusing fix in the absence
of Congress providing authority for it to stop and prevent privacy
harms. A similar situation could arise in the context of financial
services, where a gap arguably exists in the applicability of COPPA to
financial institutions. Leaving gaps creates risks for consumers and
businesses, especially with the aggressive posture of the current FTC,
and that further underscores the need for Congress to enact a single,
Federal set of rules on privacy that address these gaps.
---------------------------------------------------------------------------
\1\ Fed. Trade Comm'n, Statement of the Comm'n on Breaches by
Health Apps and Other Connected Devices (Sept. 15, 2021), available at
https://www.ftc.gov/system/files/documents/public_statements/1596364/
statement_of_the_commission_on_breaches_by_health_apps_and_other_
connected_devices.pdf.
Question 2. In your testimony, you mention the Open App Markets
Act, my bill with Senators Blumenthal and Klobuchar, and suggest that
legislation like ours would open the door to malware and privacy harms.
While I fully appreciate the need to ensure privacy and security on all
of our devices, I also find it interesting that a senior engineer at
Apple was quoted as saying its app store security now is like
``bringing a plastic butter knife to a gun fight.'' It's also curious
that other decisions to exclude apps, like the Navalny opposition app
in Russia, are made without any claims about security or privacy.
It seems like these companies should be able to protect user
privacy without using it as a smokescreen to keep out competition or to
justify political decisions--do you have ideas on how to do that?
Answer. While Apple's security capabilities are not perfect--and
perfect security really does not exist--its track record is
demonstrably better than other software platforms in the market. For
example, over the past four years, Android devices were found to have
15 to 47 times more malware infections (the variation attributable to
the variety of different kinds of Android devices) than iOS devices.\2\
This is no accident. Even if there is something to what the senior
engineer who called out Apple's security practices said, the policy of
prohibiting sideloading is not a technical measure but a structural
control to avoid risk surfaces altogether. While some critics suggest
software platforms need not prohibit sideloading to maintain a secure
environment, experience shows the opposite is true. Disallowing
sideloading--or in Android's case, requiring consumers to overcome
default settings to allow sideloading--helps keep both marketplaces
safer and more trusted than they would be otherwise. And that focus on
security creates the necessary conditions for App Association members
to succeed.
---------------------------------------------------------------------------
\2\ Apple Inc., Building a Trusted Ecosystem for Millions of Apps:
A Threat Analysis of Sideloading (Oct. 2021), available at https://
www.apple.com/privacy/docs/Building_a_Trusted_
Ecosystem_for_Millions_of_Apps_A_Threat_ Analysis_of_Sideloading.pdf.
---------------------------------------------------------------------------
App store decisions with respect to allowing or disallowing apps on
their platforms are also imperfect. Political pressure to allow or
disallow apps is unfortunately common and our member companies have
concerns if approval or removal decisions appear to have political
motivations, especially if they might be applied differently from how
they would be applied to smaller companies that do not appear in
political headlines. However, App Association members currently have a
choice between distinct software platforms through which to offer their
products and services. Even though they are not happy with every app
review decision, they are not asking government officials or a Federal
regulation to supplant app store determinations, and if that were to
happen, undue political influence on app removal or approval decisions
could worsen. They would prefer the market for developer services to
drive those results.
A Federal privacy regime, similar to what you proposed with the
SAFE DATA Act, would help ensure that privacy is not a smokescreen for
anticompetitive conduct in a few ways. First, SAFE DATA includes a
right to data portability that requires covered entities to provide
certain data of an individual in a portable, structured, and machine-
readable format that is not subject to licensing restrictions. This
provision would help ensure that large social media platforms, for
example, are not thwarting a consumer's ability to port their own data
to a new service with obstacles that have little privacy value and an
anticompetitive purpose. Second, it is important that strong privacy
and data security requirements accompany any portability or
interoperability mandate and this Congress' SAFE DATA Act checks both
of those boxes. Portability and interoperability should not flip the
FTC's own mantra of ``privacy by design'' to a new ethos of ``access by
design.'' Lastly, a Federal privacy regime would establish a common
understanding of privacy requirements, definitions, and obligations
across the broad swath of the economy not otherwise subject to Health
Insurance Portability and Accountability Act (HIPAA), GLBA, or similar
industry-specific laws. Such a regime would help policymakers and
enforcers distinguish legitimate privacy measures the law requires or
condones against those that harm consumers and competition more than
they benefit the market.
[all]