Slaughter: New Privacy Law Would Require Doubling FTC Budget

If Congress passes the House Commerce Committee’s bipartisan privacy bill, it would need to double the FTC’s budget for the agency to meet the new law’s requirements, FTC Commissioner Rebecca Kelly Slaughter said Thursday.

Slaughter’s “first anxiety” is that Congress won’t pass the American Data Privacy and Protection Act, which House Speaker Nancy Pelosi, D-Calif., said isn’t strong enough (see 2209020059). Slaughter’s “second anxiety” is that Congress won’t increase agency funding with the new law. “If you want us to“ carry out the law, “you have to fund the agency better,” she said during an International Association of Privacy Professionals event. “You have to do that anyway, even if you don’t pass this law, but especially if you do.”

The ADPPA is a strong federal bill that allows states to add new privacy protections, said Slaughter. She agreed it’s difficult to comply with multiple state laws with contradictory requirements, but she’s not in favor of passing a weak federal law that supplants state law. In the absence of congressional action, the FTC is urgently moving forward with its privacy rulemaking, she said, noting the high bar Congress set for issuing such a rule. The agency can issue rules only if it shows the conduct in question is already a violation of the FTC Act and “prevalent” in the market, she said. Getting to a final rule also requires hearings on disputes of fact and regular oversight from Congress, she added. She doesn’t envision the process taking 10 years, as some suggested.

Slaughter wants the rulemaking to explore “substantive limitations on data collection, use and retention.” Handling teen user data and social media addiction is another issue the agency needs to address, she said: Addiction and “harmful content issues” aren’t “traditionally what we think about as privacy problems, but they stem from the same data ecosystems,” she said. Another item is civil rights and technological tools that are used to discriminate against marginalized communities, she said.

It’s possible the agency will gather feedback in its rulemaking process that doesn’t support the notion there’s illegal conduct that’s prevalent in the market, Slaughter said. But the record could identify market problems and motivate Congress to act, she said: “The record will have incredible value.” In her view, the law supports challenging unfettered collection of personal data, beyond consumer expectations, as “unfair.” It can cause substantial injury unavoidable by the consumer and not offset by countervailing benefits, she said.

The FTC’s location data case against Kochava isn't a novel enforcement approach (see 2208290052), said Slaughter: The agency has long treated location data as particularly sensitive. It’s not a novel case, but it “lands differently” for people in the aftermath of the Roe reversal (see 2207220053) because people have a better understanding of how location data can be used against them, she said: “It feels very personal for people, as it should.”