The FTC indicated that it will use its rulemaking authority under the FTC Act’s Section 18 to create a new rule that will likely seek to rein in broad data collection and use.

In October 2021, FTC Commissioner Rebecca Kelly Slaughter made two speeches in which she expressed a desire to move beyond the FTC’s “notice-and-consent” framework to address broader surveillance practices that underlie the digital advertising economy, specifically by applying “bright-line purpose and use restrictions that minimize the data that can be collected and how it can be deployed.”

Driving these changes is the concern that the notice and consent framework has left collection, retention, and sharing of data largely unchecked, which Slaughter argues can be harmful to consumers whether or not the collection itself has been disclosed in some way.  To underscore her concerns she cites an FTC staff report published in October 2021, which revealed the extent to which ISPs are able to amass consumer information.  The report details how this information can be combined with data from brokers to categorize and target consumers based on their race, ethnicity, sexual orientation, economic status, political or religious affiliation.

The FTC is concerned this information could be used by companies to discriminate against certain groups, and even if discrimination is not intended, could exacerbate economic or racial inequalities, marginalize workers, or deepen other disparities.  Additionally, Slaughter remarked on how the practice of unconstrained data collection, retention, and sharing has increased the severity of data breaches and fueled misinformation campaigns.

The FTC appears particularly skeptical about services that treat consumer data as a commodity to sell, rather than as a part of providing the service or product the consumer requested.  The agency is also concerned about secondary uses of data, meaning uses other than the purpose for which the data was initially collected.  Therefore, any new FTC rule is likely to tighten the acceptable practices around collection and use of consumer information, and require collection and use be linked to the purpose for which it was provided by the consumer.

Although the FTC has recently streamlined its Section 18 rulemaking process, it is likely to remain relatively slow moving and the FTC will be required to demonstrate that data collection and use problems are substantial, unavoidable, and not outweighed by countervailing benefits to consumers or to competition.

That being said, it would be wise for companies that do not already have minimization measures in place, to start developing them now.  In particular, it is important to review and tighten any polices that broadly allow for the secondary use of data.  Not only will this put companies in a better position should a new FTC rule be enacted (or alternatively, a federal privacy law be passed), but it is already recommended for companies who need or will soon need to comply with Colorado, California and Virginia privacy laws.  Moreover, as noted above, companies that collect and retain a lot of data are more vulnerable to attack, and if they are attacked, any required notification and/or remediation will be much more cumbersome and costly the more data there is.

Keep an eye on this space for new developments.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Amy Gordon Amy Gordon

Amy Gordon is an associate in the Litigation Department and a member of the Product Liability group. Amy’s practice focuses on a wide range of complex civil and commercial litigation matters, including product liability defense, class action defense, privacy and data security, and…

Amy Gordon is an associate in the Litigation Department and a member of the Product Liability group. Amy’s practice focuses on a wide range of complex civil and commercial litigation matters, including product liability defense, class action defense, privacy and data security, and telecommunications disputes. She is also a member of the litigation team representing the Financial Oversight and Management Board in the Commonwealth of Puerto Rico’s bankruptcy proceedings.

In addition, Amy advises clients across industries on economic sanctions and asset forfeiture related issues.

Amy earned her J.D. from the University of Texas School of Law, where she was a Cybersecurity Graduate Fellow and served as Chief Notes Editor for The Review of Litigation.  During law school, Amy interned for the Honorable Nicholas G. Garaufis in the United States District Court for the Eastern District of New York.

Photo of Ryan P. Blaney Ryan P. Blaney

Ryan Blaney represents health care, life science, and technology clients in a range of regulatory, enforcement, internal investigative and transactional matters, with particular expertise in privacy law, life sciences and digital health. He also has expertise in regulatory compliance, counseling clients on a…

Ryan Blaney represents health care, life science, and technology clients in a range of regulatory, enforcement, internal investigative and transactional matters, with particular expertise in privacy law, life sciences and digital health. He also has expertise in regulatory compliance, counseling clients on a range of matters, including health care fraud and abuse, third party reimbursement, data breach issues, data privacy and security, and FDA regulatory matters. He has substantial experience in pharmaceutical lifecycle management and competition issues, including the Hatch- Waxman Act and Biosimilars Price Competition and Innovations Act.

Ryan serves information technology companies, public and private health care companies, hospitals and physician organizations, manufacturers, medical device companies, and health plans. He guides venture capital groups, private equity funds, investment banks, and other investors on health care regulatory issues in connection with financing, mergers and acquisitions, and restructuring.

Ryan’s work is greatly informed by his experience as a teacher. Prior to attending law school, Ryan earned a master’s degree in education and taught at an under-resourced Catholic middle school. He is known for his ability to communicate clearly and to coordinate large teams working on complex matters. Outside of his health law practice, Ryan has been repeatedly recognized for his public service and pro bono work. He has successfully handled numerous education-related cases, helped establish three nonprofit organizations and defended qualified recipients of disability benefits.