Changes to FTC Rulemaking Procedures Herald More Aggressive Action on Consumer Privacy

On July 22, 2021, the Federal Trade Commission finalized important changes to its procedures for rulemaking under Section 18 of the FTC Act. Section 18 authorizes the Commission to make regulations, termed “Trade Regulation Rules,” (or “Magnuson-Moss Rules” after their authorizing statute), which “define with specificity” conduct that violates the FTC Act’s ban on “unfair or deceptive” business practices. Section 18 rules are promulgated through a “hybrid rulemaking” process that includes, if an interested party requests it, an “informal hearing” with limited opportunities for oral presentation and cross-examination by representatives of stakeholder groups.

The Commission’s recent changes are intended to streamline, and increase the Commission’s direct control over, Section 18 rulemakings. They roll back measures, adopted in the early 1980s, in response to Congressional action intended to constrain what was widely viewed as Commission overreach without public accountability. These changes will likely have a significant impact on the Commission’s oversight of privacy and cybersecurity issues. In the past, the Commission has not used Section 18 rulemaking in the privacy space due the complexity and length of the process—which were unsuited to rulemaking in such a rapidly-evolving field.

With a more streamlined Section 18 process available, it is likely that the Commission will be more willing to engage in privacy- and cybersecurity-related rulemaking. Indeed, one Commissioner has already indicated as much publicly. The Commission majority’s apparent plan to move forward with Section 18 privacy rules has already, however, drawn opposition from Congressional Republicans. In a hearing held September 29, 2021, Senator Roger Wicker of Mississippi (Ranking Member of the Committee on Commerce, Science, and Transportation), argued that a federal privacy framework must come from Congress, and that any attempt to do so under Section 18 would be “a blatant overreach that would almost certainly invite legal challenges.” Senator Wicker’s statement echoed an editorial he had previously published along with Rep. Cathy McMorris Rodgers (Ranking Member of the House Energy and Commerce Commission) and FTC Commissioner Noah Phillips.

Those future rulemakings will not only be important from a compliance perspective, they will likely offer a roadmap to the Commission’s future enforcement priorities. The Commission’s decision to streamline its Section 18 procedures appears to be intended to facilitate more aggressive creation and enforcement of Section 18 rules in the wake of a recent Supreme Court decision sharply limiting the Commission’s ability to seek monetary penalties and restitution under other provisions of the FTC Act. For many years, the Commission primarily sought monetary remedies under § 13(b) of the FTC Act, which allows the agency to seek relief directly in court without any prior administrative action. See 15 U.S.C. § 53(b). Section 13, however, does not mention money damages at all—only permanent injunctions. And in April, the Supreme Court held in AMG Capital Management v. FTC that the Commission’s settled practice was wrong. The Court explained that § 13’s narrow reference to an injunction meant what it said, and that if the Commission wanted to obtain monetary remedies in court, it would have to do so according to the procedures set out in the portions of the FTC Act that specifically authorized such relief.

One such provision is § 19 of the Act, which authorizes the Commission to file an immediate civil action seeking a broad range of remedies—including the monetary restitution no longer available under § 13—so long as it alleges the defendant violated a Trade Regulation Rule promulgated under § 18. Section 18 rules, in other words, allow the Commission to seek monetary penalties in the first instance rather after a consent decree is violated. The Commission’s decision to assert new control over a streamlined § 18 process should be seen as the first step in a pivot, post-AMG Capital Management, away from § 13 and towards § 19 as the core of its monetary enforcement powers. Indeed, that is the Commission’s stated intent: to cut away “self-imposed red tape” that prevented it from “issu[ing] timely rules” under § 18, and then to “seek damages [and] penalties” primarily by “pursuing violations” of those rules.

Because businesses that handle personal data will likely be impacted by future Section 18 rulemakings (which may be the basis for future Section 19 enforcement actions), they should be prepared to participate in those rulemakings under the Commission’s new procedures. Key points include:

• The New Procedures Significantly Streamline the Section 18 Rulemaking Process. Under the Commission’s prior procedures, Section 18 rulemaking always required an informal hearing; gave the presiding officer substantial discretion to rule during the hearing on who was permitted to make presentations or conduct cross-examination, and on which subjects; and could not be completed without a post-hearing staff report followed by an additional public comment period. Under the new procedures, the Commission has discretion whether or not to hold an informal hearing (unless a member of the public requests one), is empowered to set the scope and terms of the hearing in advance, and may promulgate a final rule without either a staff report or additional comment. The new procedures also omit the presiding officer’s former power to compel attendance at the hearing, document production, or responses to written questions. The new procedures do not, however, modify the statutory requirement that Section 18 rules be accompanied by both a statement of basis and purpose and a final regulatory analysis.
• The New Procedures Expand Political Control Over Section 18 Rulemaking. Previously, the Commission’s rules designated the nominally independent Chief Administrative Law Judge as Chief Presiding Officer for Section 18 rulemakings, a role that included the important power to designate the material disputes of fact at issue in the proceeding. Under the new procedures, the Chair of the Commission will either serve as or designate the Chief Presiding Officer, and the Commission itself has sole power to designate the material disputes to be resolved. The new procedures will increase the power of political appointees, and de-emphasize the role of independent Commission staff, in the Section 18 process.
• The New Procedures Require Earlier Participation By Regulated Parties That Wish To Make Their Voices Heard. The Commission has established early deadlines for requesting and fully participating in an informal hearing under Section 18. Notably, the new procedures require that requests for an informal hearing, requests to make an oral presentation, and proposals to add disputed issues of material fact all be submitted during the comment period announced in the Commission’s Notice of Proposed Rulemaking—before an actual notice of hearing has been published.

Armed with these newly-streamlined Section 18 procedures, the Commission may prioritize action on privacy and cybersecurity issues.  Although the new procedures will apply to rulemakings across a wide range of issues and industries, in adopting them the Commission spoke repeatedly of their intended impact on regulation of privacy and data security. As Commissioner Rebecca Slaughter explained when the Commission adopted them, the Commission intends its new Section 18 procedures to “signal a change in commission practice and ambition,” applying its “century-old statute” to “contemporary economic realities” and “tackl[ing] cutting edge issues like data abuses.” Commissioner Christine Wilson has likewise indicated a belief that “the asymmetries of information between businesses and consumers can’t be resolved through the market alone,” and explained that she is “consider[ing] whether [the Commission] should begin a privacy rulemaking proceeding” under Section 18.  She cautioned, however, that regulation would also “impose costs that stifle innovation, raise the cost of doing business, limit consumer choice and increase [prices] . . . and ultimately undercut America’s global competitiveness.” Based on those costs of over-regulation, she argued that that the Commission’s prior procedures should have been left in place to “cabin the agency’s broad rulemaking discretion.”

In the past, the Commission has largely engaged in privacy rulemaking only when it could do so under other sources of statutory authority, subject to less cumbersome procedural requirements. Its rules implementing the Children’s Online Privacy Protection Act, for example, took advantage of explicit Congressional authorization to proceed via ordinary notice and comment under the Administrative Procedure Act. But with the advent of new Section 18 procedures, and continued Congressional inaction in the cybersecurity space, the Commission apparently intends to act more aggressively moving forward.

*The authors are pleased to acknowledge the input of numerous Sidley colleagues who previously served as FTC Chairman (Tim Muris), FTC General Counsel (Jon Nuechterlein and William Blumenthal), and OMB General Counsel (Alan Raul). Their knowledge of relevant FTC and federal regulatory processes is reflected here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.