FTC rulemaking and the case for a federal privacy law

00:00:00to see my doctor. I do want to, I do think that, and I'm just going to offer a perspective,

00:00:09at least at the federal level for whatever it's at worth, and to maybe add perspective to Wayne,

00:00:15you mentioned, I've been a believer that every Congress, to include this one, and I still will

00:00:22believe it for the next one, that this is going to be the Congress that we get a national data

00:00:27security and privacy law. I'm that sucker. I have a bridge to sell you.

00:00:33I keep believing it. My experience has been the three big issues, private right of action,

00:00:39certainly among them, but preemption and FTC rulemaking. I think those are the other two

00:00:43big ones to what degree and what is the federal law going to preempt. I think the battle over

00:00:51that has just been, one, just fascinating to me, the way that's played out. Then I think on

00:00:58the FTC rulemaking, especially now in repeal of Chevron, that whole discussion is going to make it

00:01:09I think more important to do this, but I don't think it increases the likelihood that we get

00:01:15a national data security and privacy law. To that, I will say that I was naive and believed

00:01:23that with the current administration, with the current vice president, there would have been

00:01:27something that would have addressed that because that was imminently involved.

00:01:33That's just a defense for being excited. It's never going to happen.

00:01:35But what I was going to say is that one of the problems with the FTC, which I think you've

00:01:39nailed it though, is there is a politicalization of that. But one of the things that sort of

00:01:45underlines in terms of how the FTC is creating these laws, it's all based upon deceptive trade

00:01:51practices, unfair deceptive trade practices. I'm reversing my words here. But the point is,

00:01:57you know, sort of what is that? So we think about, and going back to your comment to Wayne,

00:02:03we're talking about ethics, right? Is it ethical to collect the data? Well, at the end of the day,

00:02:08right? So the same people who think this is absolutely disgusting, whatever it may be,

00:02:13remember, are the same people, you know, within companies, within organizations who are collecting

00:02:18the data for these other purposes, right? So it's sort of a little bit two-faced, right?

00:02:22And sort of because I'll have those same conversations with companies who talk about,

00:02:26you know, everything from the profit motive, right, to the, you know, I think Corey,

00:02:32you mentioned it earlier in terms of using that information to track and sell things to people.

00:02:37So if that's the case, I mean, those same people who will, on one hand, talk about the ethics,

00:02:42and while it's unethical for someone to collect their information,

00:02:46the end of the day, they go, you know, they get into that car that's being tracked. But

00:02:50necessarily going into work and finding ways to collect that information, whether or not it's

00:02:56ethical or not, different story, but to collect that information to do the sale marketing,

00:03:00etc. So that's one issue just to think about is what is sort of the FTC's overview of that,

00:03:05right? What is ethical? What isn't? And that line of where ethics sort of that pendulum swings

00:03:11a little bit does depend upon, you know, who is in, you know, who's in the White House and

00:03:15Congress, etc. And there's that whole business, that whole ecosystem of the data brokers,

00:03:22you know, and all the other, you know, and the advertising firms and the surveillance and

00:03:28and everyone else that's, you know, involved in that ecosystem of trafficking of consumer of

00:03:35information. So, I mean, that's certainly one of them. But the question also is that, look,

00:03:40and the FTC has been working at this for how many years trying to, you know, to sort of find that,

00:03:45but, but as technology evolves, you know, you know, how, you know, these, you know, we talked

00:03:50about, we originally talked about collecting that information and using it. And then we talk about

00:03:54artificial intelligence and being able to analyze that information in all new ways. And so we

00:03:59think about any type of big data set or any type of algorithm or AI program that was designed,

00:04:05and this is like the bias of AI, which was right, you put data in there, you say, okay,

00:04:08I'm gonna put rules in place, right? We all thought AI was gonna allow us to put rules in

00:04:12place to say we don't, we want to exclude certain types of access to information, we want to exclude

00:04:17certain types of outputs, and correlations, etc. So what did I do say, well, I know it should be

00:04:23this, you're telling me I can't use this data, or I can't analyze in this way, I'm going to find

00:04:27another way around to get to the exact same spot. Why? Because that's what people are looking for,

00:04:32right? So the question is, how do you account for that, right? And so that then goes to the,

00:04:37okay, we talked about, and I think, Corey, you mentioned as well, of retention issues. Okay,

00:04:42so we get rid of retention. So we take a, you know, we take this program, we take the data,

00:04:45we ingest it, we create new outputs, right? We get any resultants from it. And we can get rid

00:04:50of that data, but we found a way to, you know, retain data without actually retaining data,

00:04:55right? That's what some of these programs do. So how does that...

00:04:58American ingenuity.

00:05:00Right, but how does that go to your point here as to, you know, you're collecting data and you

00:05:04want to put safeguards in place?

00:05:05So I think, in all seriousness, at the most practical level, because I hear privacy disputes,

00:05:15and I look at all this, and I think really, you know, getting past the clock's actions and the

00:05:20data security and the harms and all of those things, and at its core, right, the FTC published

00:05:25this rule, right, on NPR, right, Advanced Notice on Proposed Rulemaking for a Trade Regulation on

00:05:31Commercial Surveillance and Data Security. And I know it's interesting, but I think, you know,

00:05:39Wayne hit the nail on the head. Americans have a serious issue with discriminational and wrongful

00:05:45use of consumer data. The problem is, outside of discrimination, it is an extremely gray area,

00:05:52right? Even discrimination outside of some very binary categories is a very gray area.

00:05:59And the problem, why it's so hard to regulate, and why getting past all the lobbyists and all

00:06:05the influence and all the congressional people that mean good and have a falsely inspired hope

00:06:10for sessions after sessions of people, right, is the practical part of it. America is a diverse

00:06:17place, right? What you value, like an example, if you go down to Paris, Kentucky, or to Tupelo,

00:06:25Mississippi, you go, you buy your gun at Walmart, right? To those people, that is very personal

00:06:31information, right? And they're not okay if you take a survey down there of sharing that information.

00:06:38In other places, that's, you know, why would you not share that? What is the big deal, right? But

00:06:43in other places, you go, and it's other perceptions, right? And I think if you look

00:06:48at what the FTC tries, right, they try to generalize it to the collection and monetization

00:06:54of consumer data for marketing purposes. And I ask you guys, right, you know, nobody has perfect

00:07:03security, and they have this data security, right? But they invited broad public comment, right?

00:07:09And I think the ANPR has actually gone through, right? And there's 94 questions,

00:07:14and there's all this back and forth, right? But my question to you is, do consumers really

00:07:20understand, right? What is the point of the Federal Trade Commission for commercial surveillance of

00:07:26data security practices, and making sure your refrigerator isn't spying on you?

00:07:33At the most practical level, you know, how are we drawing these lines, right? What are you expecting,

00:07:41you know, for like children are like pretty protected, right? You know, children's a no-brainer,

00:07:48race and identity, sexual identity, right? There are certain categories that I think, you know,

00:07:53marketing to children, marketing to people that can't make decisions. But I mean, what do you guys

00:07:58think from the FTC sort of trying to, is the FTC playing in an area they shouldn't be playing?

00:08:05Because here's what hasn't happened. Congress has not stepped up. Nine states have stepped up,

00:08:11the plaintiffs bar stepped up. But what hasn't happened is the Congress itself hasn't stepped up.

00:08:17But is the Federal Trade Commission really the organization that should be stepping up to the

00:08:22plate here to take these actions? The viewpoint of the current active commissioners of the Federal

00:08:31Trade Commission is that if no one else is going to step up, then they have no choice but to be the

00:08:39ones to do it. And the entire reason for these questions is for them to get the cover and the

00:08:46authorization to start the rulemaking process as long and difficult and abhorrent as that process

00:08:54is, because they understand that Congress isn't going to move. I agree. I don't think the FTC

00:09:04wants to take this mantle forward, but if they don't take it forward, who will?

00:09:08Well, that's their viewpoint, and they also understand that MacMoss rulemaking is horrific.

00:09:18Yeah, and it takes a while. So, Corey, Aaron, what do you guys think?

00:09:28Aaron, I'll defer to you, but go ahead. No, no, go. I thought I already answered part of it.

00:09:34I mean, I'll, I mean, if the question is, like, what other actor? I think the FTC is the right

00:09:43actor to own this, like, data security, privacy, broadly. I think they're the right actor. The

00:09:50rulemaking, I mean, we, I believe we need Congress to act. I believe we can all probably agree that,

00:09:58although I keep hoping, and it's, I think, been, like, seven Congresses now, like, that just,

00:10:05it isn't happening for a number of different, a number of different reasons. The challenge is,

00:10:11and I mean, I, Wayne, you probably, you probably know that we're, any of you probably know this,

00:10:17the total number of FTC folks, like, in the enforcement side is for the nation.

00:10:26Eighty. Eighty. So, I mean,

00:10:28in Ireland, it's 1,100 for their equivalent. So, I mean, just to give you a perspective of, like,

00:10:35capacity and bandwidth to be able to, like, actually enforce, even if they do the rulemaking,

00:10:41is, like, a whole separate question. And certainly, I don't think their budget and resources

00:10:46are growing. So, there's legitimate questions about, you know, how this is going to be done,

00:10:53even post rulemaking. Let's just give them the rulemaking for a minute and assume it

00:10:57gets through this long. Well, I agree. So, what do you think

00:11:01happens with consumer consent and notices and disclosures to consumers about commercials? How

00:11:06are they even going to look at it? Like, I don't even, I don't, at the most practical level, let's

00:11:11say the rules get passed. How does it work? You submit your rule, your policies to the FTC,

00:11:18and then five years later, they're going to say it's okay?

00:11:22The, look, the FTC's ability to enforce is exceptionally limited.

00:11:30They bring enforcement actions only in the most egregious instances.

00:11:35They are now going to the point of trying to make their punishment far more severe and published

00:11:43in the newspaper because they want to have a greater interim effect on what they're doing

00:11:49because they can't do that much. And they're reaching out to the various regulators in the

00:11:56states to try and get them to support them because the state of California has a bigger budget than

00:12:03the Federal Trade Commission does to deal with commercial and more people to deal with it.

00:12:10And that's another discussion altogether. But, look, I mean, Commissioner Betoya,

00:12:17when he was sworn in two years ago, very clearly said that the FTC was going in this direction,

00:12:23that there was no choice in his mind. And he and Lena Kahn are of that viewpoint,

00:12:30and for as long as they remain holding their offices, and as long as they are in the majority

00:12:37of the Federal Trade Commission, they're going to try and get around whatever the Supreme Court

00:12:42is doing to rein in with Chevron their powers, and they're going to try and work with what they can

00:12:48do. Listen, there's an interesting argument that Chevron wasn't intended to rein in the, per se,

00:12:54power of the FTC. It's to make the FTC more accountable to Congress for what they're doing.

00:13:01But maybe the question is, did Congress intend this to happen? And that's something the courts

00:13:10inevitably interpret. But I think that someone's going to need to do this. And it's not even for

00:13:17whether you like it or not, just for the markets, for commerce. The litigation alone is going to

00:13:25compel us. The legal risk alone, just in the fracture that underlies the commerce, requires

00:13:34there to be some uniformity of process. Your point at the bottom is a sense of predictability,

00:13:42and that's spot on. That's what I think they need. Whether you're Walmart or you're

00:13:50some small mom-and-pop, you don't want to make 10 different notices if you have 10 different

00:13:54customers buying your stuff online and stick it in for California citizens, Washington citizens,

00:14:00Texas citizens. We don't want that. And I think that may be the only reason why we see a uniform

00:14:08federal law, once mom-and-pop stores. But I mean, if our past is any indication

00:14:15of our future, it's not always. But when you look at the trajectory with breach notification,

00:14:25I mean, our past, how we're going to deal with this has not been great, right? We left it up

00:14:31to the states, and then we got in the territories, and we got 54 different standards. And over a 19

00:14:37year period, and California was the first. If you look at data security and privacy, like

00:14:43California is the first, we're trending the exact same direction. And, you know, again,

00:14:48I hold out hope that we take care of this at the federal level. I think that's desperately needed

00:14:53for these, you know, for the reasons that you had in your slide. But it becomes just massively

00:15:01painful as each successive state passes. They become less likely as a delegation,

00:15:09like a congressional delegation, to support a national standard unless it

00:15:13incorporates in all their stuff. And it's just very

00:15:17In 2015, President Obama at the State of the Union called for national security legislation with the Democratic House and the Democratic Senate, and it was one of his priorities, and it didn't happen. And if it can't happen with data security, it's not happening with privacy.

00:17:56And so that creates its own business implication. And so the question is whether or not if it gets so chaotic that business would force a federal legislation.

00:18:07I don't know if that's going to happen either, but I think it's actually going to come that way, not from the constituents saying, I want you to create privacy legislation to protect my information.

00:18:17I think it's going to be business saying it's becoming intolerable to do business in the U.S.

00:18:21Hopefully not, but on a brighter note, I hope everybody has a great weekend.

00:18:29One of the things that that safeguard privacy does is detailed analysis of the various state laws to try for our clients and take the rules and simplify them.

00:18:41There are hundreds of state rules. You're right about that, but they're not inconsistent.

00:18:47And if you want to go to the lowest common denominator, you can reduce those rules by 75 percent.

00:18:56It is possible to comply. It's just very expensive to do that on your own.

00:19:02Requires, you know, hundreds of hours of lawyer time to do it.

00:19:06And that's that's the problem for the smaller or bigger industry that tries to take care of it on its own.

00:19:13And the laws are constantly changing. You know, that's our business model, frankly.

00:19:17But I do think that the result of that is 10 years from now, you're going to end up with what is effectively a national law.

00:19:25The problem is it's 50 states constantly changing it. So it's not sufficiently stable.

00:19:31It's not the type of thing that we lawyers like to see where it's predictable and long term.

00:19:37And you write your privacy policy simply and you don't have 50 little paragraphs in there saying.

00:19:42But if you live in Albuquerque, New Mexico versus Mexico as a whole, you also must display this notice in your store.

00:19:50And that's why more uniform legislation would be good or a model code of some kind or something that somebody can point to.

00:19:58And the only other thing I'll say to you is state of Connecticut, for example, has a very pragmatic approach.

00:20:04Follow the California regulations, follow the Colorado regulations and we'll be fine with you in Connecticut.

00:20:10And hopefully the states begin to start to do that sort of a thing.

00:20:14And then maybe it's going to get a lot easier. I have some hope there.

00:20:19I hope for common sense. You have more hope than all of us or hope for all of us.

00:20:23No, I agree with them. I think it's pragmatically speaking that that's probably where we end up.

00:20:28So we will get there, Daniel. That's all.

00:20:34Take some time. Now that's perfect. My friend. No, thanks. Perfect. All right.

00:20:38Well, thank you all for your time. I do hope you all have a great rest of the week.

00:20:41And well, everybody, if you have questions, please feel free to email anybody accordingly.

00:20:47Thank you. Thank you, Dan. Thank you. Thank you.

00:20:51Take care of it.