Cybersecurity Policy Report, Merits of Stand-Alone Privacy Watchdog Debated, (Oct 9, 2019)

By Lynn Stanton

Participants in a New America Open Technology Institute event on enforcement of a new, comprehensive, federal privacy law, should such a thing come to pass, debated the merits of establishing a stand-alone privacy enforcement agency, as opposed to allowing the Federal Trade Commission to continue as the main privacy watchdog in the U.S.

In a keynote address kicking off the event, David Medine, a former special counsel at the FTC's Consumer Financial Protection Bureau and former associate director for financial practices at the FTC, argued for a new, stand-alone agency, which he said would create efficiency. "There are lots of privacy statutes out there," he said. "Having them brought together under one roof for enforcement . . . makes sense."

Mr. Medine also pointed out that "most countries have a free-standing data protection agency. I think they would interact better with the U.S. if we had a free-standing data protection agency."

In addition, he said FTC commissioners already had "a lot on their plate" between "dealing with competition" and policing unfair and deceptive trade practices. Data privacy issues could benefit from the undivided attention of an agency dedicated to them, he suggested.

Then there is the budget issue. "If you put anything inside a larger agency, it's going to have to compete for funds," he said.

Mr. Medine recommended that the new agency be allowed to "sit on the old agency's infrastructure until it's ready to separate," just as the Consumer Financial Protection Bureau "sat on Treasury's infrastructure" when it started up.

He also suggested that the new agency "ought to have complete litigation authority," rather than having to go through the Department of Justice to bring cases to court the way the FTC has to.

During the ensuing panel discussion, Elizabeth Banker, vice president and associate general counsel at the Internet Association, said that "consumers need to understand what their rights are" and that "having a long delay to stand up a new entity might not meet that need."

Yosef Getachew, director of the Media and Democracy Program at Common Cause, said privacy was "too big for one agency to handle on its own." He advocated vesting rulemaking authority in whatever entity ended up with the primary role over privacy.

Bob Gellman, a former congressional staffer and current privacy and information policy consultant, was critical of the FTC's record on privacy enforcement, particularly its tendency to bring cases under its authority over deceptive practices, rather than unfair practices, which, he suggested, just teaches lawyers to write privacy statements that are vague and make no clear promises to be broken.

"The agency is institutionally incapable of doing what needs to be done. It is scared to death of using the power it has," Mr. Gellman said. He argued that the reason telecom companies wanted their broadband Internet access services classified as information services was so that the FTC, not the FCC, would oversee their privacy practices, because the FTC is "a weaker agency" than the FCC.

Mr. Getachew supported granting consumers a private right of action, criticizing the alternative of a forced arbitration framework both because it failed to establish precedents and because it was "not cost-effective for an individual to go through that."

Mr. Gellman said, "I'm largely in agreement… But it's not going to happen, [because a] full private right of action is too controversial. It's like preemption."

He added, "Maybe my fill-in-the-blank agency could be a clearinghouse, and you'd have to go there to get your ticket punched before you can proceed with class action."

Ms. Banker suggested that state attorneys general could "address a lot of the issues mentioned for private right of action."

Blake Bee, program counsel for the National Association of Attorneys General's Center for Consumer Protection, said, "I think you'll see states acting [to pass legislation] in this space come January.

News: Privacy