The Emerging Conflict in Data Privacy Regulation: FCC, FTC, and the Proposed American Privacy Rights Act
May 2, 2024
Privacy Plus+
Privacy, Technology and Perspective
This week, let’s look at a brewing conflict between the Federal Communications Act (FCC) and the Federal Trade Commission (FTC) concerning the enforcement of data privacy laws. This issue is highlighted by the proposed American Privacy Rights Act (APRA).
Background:
The APRA, proposed in early April by Senator Maria Cantwell (D-WA) and Representative Cathy McMorris Rodgers (R-WA), aims to provide a comprehensive federal data privacy law. The full details are available in the Senate Commerce Committee’s announcement at the following link:
Concurrently, on April 29, 2024, the FCC announced nearly $200 million in fines against the major wireless carriers for mishandling customer location data as detailed in the announcement that follows:
https://www.fcc.gov/document/fcc-fines-largest-wireless-carriers-sharing-location-data
The Issue:
The APRA primarily assigns enforcement responsibilities to the FTC and proposes to preempt state privacy laws. However, the FCC currently enforces data privacy under Section 222 of the Federal Communications Act, codified at 47 U.S.C. 222, which you can read here:
https://www.law.cornell.edu/uscode/text/47/222
This raises a critical question: will the APRA displace the FCC's existing data privacy enforcement role? This question is further explored in a recent Washington Post article available at the following link:
Additional Considerations:
Senator Cantwell, in an episode of Kara Swisher’s podcast "On," argued that no single agency can fully keep up with the fast-evolving field of data privacy. She advocates for the APRA to include a strong private right of action, empowering consumers directly.
You can hear this episode of the podcast here:
https://podcasts.voxmedia.com/show/on-with-kara-swisher
Moreover, a broader legal issue involves the judicial deference to agency interpretations of law, known as Chevron deference. This principle is currently under scrutiny and expected to be addressed by the Supreme Court.
Our Thoughts:
Ensuring Clarity and Coordination Between the FCC and FTC: We recognize the need for specialized agencies like the FCC and FTC to regulate areas like data privacy, given their expertise in handling the complexities of modern technologies. However, with the introduction of the APRA, which is set to centralize enforcement primarily within the FTC, we believe it’s essential to maintain a balance of power. Ensuring that the FCC and FTC have clear, delineated roles will avoid overlaps and gaps in enforcement.
Importance of Clear Legislative Direction in Agency Rule-making: We also highlight the importance of clear legislative guidance for these agencies, especially as they navigate the evolving landscape of data privacy. This guidance should prevent the rule-making process from becoming merely reactionary or based on enforcement actions.
Supporting Agency Authority While Maintaining Accountability and Oversight: Ultimately, while we support the delegation of certain regulatory responsibilities to agencies equipped with specific expertise, such delegation shouldn’t diminish the agencies’ accountability or bypass necessary legislative oversight. The APRA presents an opportunity to redefine the scope and responsibilities of federal agencies in the realm of data privacy, ensuring they are equipped to handle this responsibility effectively while respecting legal boundaries and promoting consumer rights. By setting clear frameworks and roles for each agency involved, Congress can foster a more robust and effective data privacy regime that better adapts to technological advancements and protects individual rights.
Enhancing Data Privacy Through Private Rights of Action: Additionally, the incorporation of a private right of action, as proposed in the APRA, can significantly boost the enforcement of data privacy laws, not only increasing accountability for data handlers but also serving as a critical check on agency performance. This provision can lead to more vigilant practices within industries, as companies will likely feell compelled to adjust their privacy practices to avoid litigation. Thus, private rights of action can complement agency oversight by directly involving the public in safeguarding their own data privacy. Furthermore, as artificial intelligence continues to advance and integrate more deeply into our daily lives, the imperative for stringent data privacy measures becomes even more critical to ensure that personal information is handled responsibly.
---
Hosch & Morris, PLLC is a boutique law firm dedicated to data privacy and protection, cybersecurity, the Internet, and technology. Open the Future℠.