The U.S. Senate Committee on Commerce, Science, and Transportation has scheduled a hearing for tomorrow, February 14, 2018, on the nominations of a new Chairman and three new Commissioners to the Federal Trade Commission (FTC). In recent years, FTC has become the primary national regulator of consumer data privacy and security, a responsibility that accords the Commission a staggering amount of influence over an American economy increasingly fueled by information.
When utilizing that authority over how businesses treat consumer data, the Commission has accorded little or no regard to the First Amendment. Data is speech, a reality that the incoming Chairman and Commissioners must incorporate into consumer-protection enforcement under § 5 of the Federal Trade Commission Act.
The First Amendment provides strong limitations on prohibiting and constraining the collection, use, and disclosure of information, including electronic data. In IMS Health Inc. v. Sorrell, the U.S. Supreme Court ruled a Vermont law prohibiting the sale and use of data for targeted marketing to doctors could not survive heightened First Amendment scrutiny.
Justice Kennedy wrote that consumers’ interest in the free flow of commercial information is strong, especially “in the fields of medicine and public health.” As attorney Thomas Julin argued in a 2016 WLF Legal Backgrounder, “Targeted and behavioral marketing is equally critical to the success of today’s Internet-driven free-enterprise system. Limits on the use of commercial data apply to truthful information lawfully acquired in the course of a consumer’s voluntary business transactions or visiting of websites.”
Also, in a 1999 decision, U.S. West, Inc. v. FCC, the U.S. Court of Appeals for the Tenth Circuit held that Federal Communications Commission (FCC) rules limiting the use and disclosure of personal information by telecommunications companies restricted the plaintiffs’ speech and therefore were subject to First Amendment review.
Past FTC Consideration of the First Amendment
FTC performed a rather cursory constitutional analysis of its authority under § 5 to pursue deception claims in 2002, concluding in a comment to the Food and Drug Administration that Commission actions comported with the First Amendment. FTC cannot rely on this 15-year old analysis when bringing deception actions, given the significant developments in the commercial-speech doctrine since 2002.
Further, the Commission has to our knowledge neither performed a similar, general First Amendment analysis of its unfair-practices authority nor considered speech rights in the specific area of privacy and data-security regulation and enforcement. That is deeply concerning, given that FTC has formed what it calls a “privacy common law” through individual consent decrees. In addition, those settlements impose certain privacy and data-security standards that are treated as legal obligations and enforced through court orders.
What Substantial State Interest is FTC Advancing?
Under the U.S. Supreme Court’s commercial-speech test, the government defendant bears the burden of first identifying a substantial state interest that it seeks to advance. In the U.S. West case, though it assumed for the sake of the appeal that the state interest was substantial, the Tenth Circuit strongly questioned FCC’s general interest in privacy protection. Privacy is “multi-faceted,” the court explained, and for that reason courts must “pay particular attention to attempts by the government to assert privacy as a substantial state interest.”
A general feeling of “discomfort,” the court asserted, did not make the interest substantial. It added, “We would prefer to see a more empirical explanation and justification for the government’s asserted interest.” The concept of privacy, especially for personal data and its online availability, has broadened substantially since the Tenth Circuit decided U.S. West in 1999.
Under § 5, FTC must establish that the unfair act or practice caused or is likely to cause substantial injury. The Commission essentially presumes substantial harm if the information disclosed is “sensitive,” and provides minimal justifications for its conclusion in other instances. Its “we know it when we see it” approach on harm leaves FTC vulnerable to arguments that the interest it advances is speculative or far less than “substantial.”
When bringing § 5 deception claims, FTC must show that the challenged statement was “material,” i.e. “likely to affect that consumer’s conduct or decision with regard to the product or service.” The Commission too often presumes materiality in deception cases, which also calls into question whether it can advance a substantial interest under the First Amendment. Incoming Commissioners should familiarize themselves, in this regard, with the 2015 deception case against Nomi Technologies. There, two dissenting Commissioners argued the majority failed to offer any evidence that consumers “would have chosen differently but for” the alleged deception.
Is the Interest Directly and Materially Advanced?
FTC’s actions must also directly and materially advance its stated privacy or data-security interest. FTC must show that the harms are real and materially alleviated by the restriction. The Commission would need to show that the privacy or data-security requirements sought in enforcement actions or imposed through its settlements would alleviate the identified threats to privacy or data-security interests.
In cases where FTC cannot establish substantial consumer injury, the Commission obviously couldn’t show that the harms are real or that they will occur. FCC’s privacy rules failed this part of the commercial-speech test in U.S. West: “The government presents no evidence showing the harm to either privacy or competition is real. Instead, the government relies on speculation that harm to privacy … will result.”
In addition, FTC may not be able to show that the privacy and data-security obligations imposed on a company will alleviate the risks to a material degree. Companies constantly face cyber-attacks, and no security measures have proven fully effective. For companies that already have implemented data-security measures, FTC may not be able to show that the measures it requires will make a material difference.
Are FTC’s Actions No More Extensive than Necessary?
Finally, FTC’s actions must be no more extensive than necessary to serve the privacy or data-security interests it is advancing. The actions must be in reasonable proportion to the interest served using a careful calculation of the costs and benefits associated with the burden imposed by the Commission.
The generic, one-size-fits-all privacy and data-security obligations currently pursued in enforcement actions or imposed through FTC consent orders are by their nature not reasonably tailored to the state interest. The Commission must take into consideration the size and type of company, the type of data involved, and the data-breach threats it faces. Failure to do that will impose far more restrictions on the collection or use of speech in the form of data than necessary.
Moreover, FTC’s typical consent order and the privacy and data-security requirements it imposes can remain in place for up to 20 years, which may be dramatically disproportionate to the harm being redressed. FTC consent decrees do not explain why 10, 15, or 20 years is the appropriate amount of time that settling parties must comply.
Integration of First Amendment considerations into FTC’s consumer-protection enforcement process is a worthy signature project for either the incoming Chairman or a new Commissioner. FTC could develop a guidance document for the staff’s case selection, or issue an enforcement policy which acknowledges that data-based expressive activity is constitutionally protected. In advance of or in conjunction with such actions, the Commission could undertake fact-finding and educational activities through workshops and solicitation of comments.
Unfortunately, the Commission may be hesitant to integrate new factors into its enforcement decision making that would limit its authority. It thus might be up to regulated entities, which have long been reticent about asserting their First Amendment rights, to push FTC in that direction by exploring or bringing constitutional challenges.
Also published by Forbes.com on WLF’s contributor page.