On February 10, 2021, acting Federal Trade Commission (FTC) Chairwoman Rebecca Kelly Slaughter delivered a keynote address on “Protecting Consumer Privacy in a Time of Crisis”1 at the Future of Privacy Forum’s annual Privacy Papers for Policymakers event. She laid out her views on how the FTC can make its privacy and data security enforcement more efficient and effective, and identified areas that the FTC should focus on under the new administration. President Biden designated Ms. Slaughter acting chairwoman of the FTC at the end of January after Republican Chairman Joe Simons announced his resignation. While we still don’t know who President Biden will choose to serve as the permanent FTC Chair in the new administration, acting Chairwoman Slaughter’s remarks provide useful insight into the commission’s potential privacy priorities under a new Democratic majority.
Efficient and Effective Enforcement
Acting Chairwoman Slaughter discussed the types of relief the agency should pursue in privacy and data security enforcement matters. In particular, she said that the FTC should pursue meaningful disgorgement (not just of money, but also of the data and benefits that a company amassed through its wrongful behavior) and effective consumer notice. As an example of meaningful disgorgement, acting Chairwoman Slaughter referenced the FTC’s recent settlement with photo app developer Everalbum,2 which requires the company to delete not just the photos and facial recognition data that was allegedly unlawfully collected, but also the facial recognition models and algorithms that the company developed using that data. With respect to effective consumer notice, acting Chairwoman Slaughter pointed to the FTC’s recent settlement with period and fertility-tracking app developer Flo Health,3 which requires the company to provide notice to its users about the settlement and the conduct at issue in the FTC’s case. Acting Chairwoman Slaughter indicated that she will be pushing FTC staff to include consumer notice requirements in privacy and data security orders “as a matter of course” going forward. This represents a departure from the FTC’s longstanding approach of requiring consumer notice in circumstances where there was some action that consumers needed to take in response to the settlement, such as changing their password or signing up for credit monitoring.
Policy and Enforcement Priorities
Acting Chairwoman Slaughter identified two substantive areas that she believes the FTC should focus on under the new administration: responding to the COVID-19 pandemic and combating racism.
COVID-19 Pandemic
Acting Chairwoman Slaughter identified a few areas of focus related to the pandemic: ed-tech, health apps, and broadband privacy. With respect to ed-tech, she highlighted some of the FTC’s efforts related to ed-tech services, including guidance for parents, schools, and ed-tech providers on protecting privacy, the FTC’s ongoing review of the Children’s Online Privacy Protection Act Rule, and the industry-wide study that the FTC is conducting on social media and video streaming platforms. With respect to health apps, acting Chairwoman Slaughter indicated that she would like the FTC to take a closer look at and pursue more cases against health apps, including telehealth and contact tracing apps. Finally, with respect to broadband privacy, she shared that she would like the FTC to issue a report this year on the industry-wide study of broadband privacy practices that it initiated in 2019.
Combating Racism
Acting Chairwoman Slaughter acknowledged that there is overlap between racial equity and the COVID-related privacy issues mentioned above. She then identified three key areas that she believes the FTC should focus on to help close the equity gap: algorithmic discrimination, facial recognition technology, and mobile apps’ use of protestors’ location data.
Acting Chairwoman Slaughter argued that it is vital to make sure that algorithms are not used in discriminatory ways. To that end, she shared that she has asked FTC staff to “actively investigate biased and discriminatory algorithms,” and that she is interested in further exploring the best ways to address “AI-generated consumer harms.” In a similar vein, acting Chairwoman Slaughter referenced literature on how facial recognition technologies can exacerbate existing racial disparities, and said that the FTC would “redouble” its efforts to identify law violations in this area. Finally, she addressed the use of mobile location data to identify protestors, and shared that while she is concerned about the misuse of location data generally, she is particularly concerned about the misuse of this data as it applies to Americans engaged in constitutionally protected speech.
The FTC has used its authority under the Fair Credit Reporting Act (FCRA) and the Equal Credit Opportunity Act (ECOA) to address bias and discrimination issues in the past, but these authorities are not without their limits. While Section 5 of the FTC Act gives the FTC the authority to regulate unfair and deceptive practices, this authority may prove to be an imperfect fit for addressing the racial equity issues about which the acting chairwoman is concerned. Companies should therefore expect that the FTC may focus its efforts on cases that fall within the FCRA or ECOA, and should look to the guidance that the FTC has provided on these issues4 for insight on how the FTC may seek to use its broader Section 5 authority in this context as well.
Key Takeaways
The key takeaways from acting Chairwoman Slaughter’s remarks were that, in this new administration, we can expect to see:
- Requirements in privacy and data security consent orders that represent a departure from the FTC’s typical approach to consumer notice and disgorgement, including requirements that companies “disgorge” the data and benefits that they amassed through their allegedly wrongful behavior, and provide notice to consumers of the FTC settlement and the conduct at issue in the settlement; and
- Increased FTC scrutiny of health apps, facial recognition technology, algorithms and AI, and other issues related to the pandemic and racial equity, particularly where those issues fall under the purview of the FCRA or ECOA.
Wilson Sonsini Goodrich & Rosati closely follows developments with regulatory organizations such as the FTC. For more information, please contact Lydia Parnes, Chris Olsen, Kelly Singleton, or another member of Wilson Sonsini’s privacy and cybersecurity practice.
Laura Ahmed contributed to this alert.
[1] Rebecca Kelly Slaughter, Acting Chairwoman, Fed. Trade Comm’n, Keynote Address at the Future of Privacy Forum’s 11th Annual Privacy Papers for Policymakers, February 10, 2021, https://www.ftc.gov/system/files/documents/public_statements/1587283/fpf_opening_remarks_210_.pdf.
[2] In the Matter of Everalbum, Inc., FTC Matter No. 1923172 (2021), https://www.ftc.gov/enforcement/cases-proceedings/1923172/everalbum-inc-matter. The FTC is accepting public comment on the proposed Everalbum order until February 24, 2021.
[3] In the Matter of Flo Health, Inc., FTC Matter No. 1923133 (2021), https://www.ftc.gov/enforcement/cases-proceedings/1923133/flo-health-inc. The FTC is accepting public comment on the proposed Flo Health order until March 1, 2021.
[4] See Andrew Smith, “Using Artificial Intelligence and Algorithms,” FTC Business Blog, April 8, 2020, https://www.ftc.gov/news-events/blogs/business-blog/2020/04/using-artificial-intelligence-algorithms; FTC Report, Big Data: A Tool for Inclusion or Exclusion?, January 2016, https://www.ftc.gov/system/files/documents/reports/big-data-tool-inclusion-or-exclusion-understanding-issues/160106big-data-rpt.pdf.
