This piece originally appeared in RealClearMarkets.
Does protecting consumers online and addressing potential harm associated with digital platforms require creating a new regulatory agency? Some members of Congress think so. The newly introduced American Privacy Rights Act (APRA) is a comprehensive privacy bill that elevates the Federal Trade Commission (FTC) to handle a wide swath of regulatory rulemaking and enforcement related to data-driven commerce. While the bill does not go as far as proposals for a stand-alone internet agency, it accomplishes something similar: it anoints the FTC as the U.S.’s digital regulator. Expanding the FTC’s regulatory authority through rulemaking will detract from the FTC’s proper role as an enforcement agency focused on promoting competition and protecting consumers.
The bill would direct the FTC to draft rules for what types of data a firm can collect and how firms offer products and services using collected data, and creates requirements for audits of product design that must be provided to the FTC prior to public release. If passed, these legislative provisions will grant the FTC wide latitude to draft rules that could shape the creation, distribution, and evolution of firms’ digital products and services. This expansion of the FTC’s regulatory authority through rulemaking and informal guidance is problematic for several reasons.
First, granting rulemaking authority to the FTC over several areas would expand the FTC’s regulatory powers, diverting focus and resources away from its primary role as an enforcement agency. The bill would provide the FTC with the authority to draft rules in four areas related to data security and privacy through the Administrative Procedure Act (APA) as well as nine areas to issue guidance to clarify compliance with the law as written by Congress. Any violation of the law is considered an unfair or deceptive act or practice, triggering enforcement based on Section 5 of the FTC Act.
Continue reading in RealClearMarkets.
