FTC ISP Study Could Lead to Rules, Enforcement, Say ex-Officials

The FTC study of ISP data collection practices could lead to enforcement or rulemaking proceedings, former agency officials said in interviews before Thursday’s meeting (see 2110140070). Chair Lina Khan and the majority of the commission clearly believe “they have something significant to say” about ISP data privacy practices, said former Consumer Protection Bureau Director Jessica Rich, now at Kelley Drye. “This is an area she said she’s very interested in focusing on.”

The FTC issued Section 6(b) orders in 2019 to AT&T, Comcast, Google Fiber, T-Mobile, Verizon and advertising affiliates. Staff will present findings at the virtual meeting, and publishing of the report is subject to a vote. The agency prepared the study partly in response to a query (see 1903200073) from former Senate Commerce Committee Chairman John Thune, R-S.D. The Republican-controlled commission had voted 5-0 to issue orders to the companies.

“There’s always an interest because of the size of these companies and concerns about knowing whether the companies have violated privacy obligations they’ve publicly stated or contractually stated,” said former FTC General Counsel Alden Abbott, now a researcher at George Mason University. Abbott noted Section 6(b) studies often don’t lead to enforcement or rules, but he said Khan “clearly” wants to take an “aggressive” approach to enforcement and rulemaking. The agency didn’t comment Monday.

Releasing the findings should be less controversial than prior items that passed with partisan votes, said Abbott. But it's possible Khan could signal the agency is planning a rulemaking or enforcement action, said Abbott: That would make sense only if Khan has a Democratic majority in place. Commissioner Rohit Chopra was sworn in as Consumer Financial Protection Bureau director (see 2109300078) last week, and the nominee to replace him, Alvaro Bedoya, is awaiting confirmation (see 2109130060).

It’s unclear whether the commission will vote at the meeting. It’s possible the commission could have recorded a vote while Chopra was still in office, experts said. Khan could also wait for Bedoya to join the commission, they said. An industry official said industry anticipates a vote at Thursday’s meeting. A former official said that, based on the agenda, the commission appears to be in a “holding pattern,” and this might be a nonvoting item because it’s technically just a staff update.

Another open question is whether the agency will individually identify the companies in the study’s findings or whether the data will be aggregated to protect their identities, said Rich. Confidentiality rules govern trade secrets. “It’s likely to be aggregated,” said Rich: Otherwise, there’s a lot more process the agency has to go through. Rich helped lead a study on data brokers. The companies were identified in the report, but the information was generally aggregated to maintain confidentiality. “That’s a policy call,” said Abbott.

It’s important the agency identifies the business models and business practices in the report so the risks can be properly understood, said World Privacy Forum Executive Director Pam Dixon, who spoke at two prior FTC meetings. The companies don’t need to be named in relation to the models or practices unless there’s an egregious violation of law, she said.

Some of the precedent behind the study stems from litigation with AT&T. The 9th U.S. Circuit Court of Appeals said in February 2018 that even though AT&T is a common carrier, its non-common carrier activities, including broadband activities, are fully subject to FTC jurisdiction under Section 5 of the FTC Act.