President Biden’s July 9 executive order will impact data privacy issues. In particular, the order signals a new government focus on facial recognition, social media data collection, attention markets, and online tracking. Sean C. Griffin, member of the business litigation group, Dykema, discusses the data privacy implication of the order.
On July 9, President Biden signed an executive order that focused on antitrust enforcement but will directly affect the data privacy sector. Specifically, the order also aims “to enforce the antitrust laws to meet the challenges posed by new industries and technologies, including the rise of the dominant internet platforms, especially as they stem from the aggregation of data, unfair competition in attention markets, and the surveillance of users.†The order also urges the federal trade commission (FTC) to exercise its rulemaking authority to “address persistent and recurrent practices that inhibit competition, in areas such as: unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy.â€
The FTC shares antitrust enforcement responsibility with the department of justice, and it acts as the lead federal enforcement agency with respect to privacy and data security. Thus, the order places substantial responsibility for its implementation in the FTC’s hands.Â
In this light, Biden’s appointment of former Columbia law professor Lina Khan as FTC chair assumes new significance. Before her appointment, Khan gained prominence, calling for aggressive antitrust enforcement against big companies. Khan’s appointment as FTC chair may signal that the agency will view data privacy through the lens of antitrust law or use antitrust laws to regulate the data privacy arena or combine both approaches.
Either way, the FTC’s privacy regulation will become more aggressive. The day Biden signed the order, Khan and antitrust division acting assistant attorney general Richard A. Powers issued a joint statement announcing their plan “to jointly launch a review of our merger guidelines with the goal of updating them to reflect a rigorous analytical approach consistent with applicable law.†Observers of antitrust and privacy law have recently noticed a confluence of the two areas, but Biden’s order will likely hasten their convergence.
Before Khan’s arrival in June, the FTC’s efforts in the privacy sector focused on inadequate data security, sharing of customers’ information without consent, and, occasionally, the illegal collection of children’s data. Biden’s order urges the agency to expand its regulatory efforts to other data privacy areas, including:Â
- Facial recognition regulation
- Social media data collection
- Attention markets, and
- User surveillance or online trackingÂ
See More: Open Banking in LatAm: Navigating the Fine Line Between Data Privacy and Transparency
Facial Recognition Regulation
Facial recognition is attracting high-level attention. On July 13, the U.S. house of representatives held a hearing on law enforcement’s controversial use of facial recognition, which followed last month’s general accounting office report criticizing the federal government’s use of facial recognition and last year’s legislative proposal to ban it altogether. Aside from legislative pressure, facial recognition technology has also attracted expensive lawsuits, such as Facebook’s $650 million settlement for allegedly misusing the technology.Â
The FTC is no stranger to this battle, having involved itself in the facial recognition field nearly a decade ago. In May, the agency reached its first facial recognition settlement with Ever for allegedly enabling its online photo app to use facial recognition technology on its users without their permission.Â
Given this heightened legislative pressure regarding facial recognition and the FTC’s established involvement in the technology, the agency will almost certainly begin regulating facial recognition more actively. The FTC has only begun using its enforcement powers in this area, but with President Biden’s encouragement, the FTC could soon buttress its enforcement efforts with rulemaking.
Social Media Data Collection
Biden’s order will likely boost the FTC’s scrutiny of social media companies. The FTC already has Facebook in its sights. The agency has sued the company in a recently dismissed antitrust lawsuit. In December 2020, the agency ordered Facebook and other social companies to provide data on how they collect, use, and present personal information. Facebook and other social media companies also face congressional inquiries about their antitrust compliance. If that were not enough, Biden’s order explicitly calls out “dominant internet platforms†and their “aggregation of data,â€an unambiguous reference to Facebook, Twitter, and other large social media companies.Â
Together, these facts signal that the FTC will not only continue but intensify its investigation of social media and its data collection efforts. Moreover, given congress’s inability or unwillingness to pass federal privacy legislation, the FTC or another agency may consider using its rulemaking authority to fill the legislative gap.
See More: How to Fast-Track Insights Without Sacrificing Data Privacy or Security
Attention Markets
In the “attention market,†consumers pay attention to entertaining or informative content, and social media delivers that attention to advertisers for a price. Former Columbia law professor Tim Wu has written extensively about the attention market and a concept he called “attention theftâ€,when companies “seize our time and attention for absolutely nothing in exchange, and indeed, without consent at all.†Recently, courts and officials have concluded that antitrust law governs or should govern attention market activity,particularly where consumers have no protection against sophisticated psychological engineering techniques that subtly draw and retain their attention without their conscious awareness.Â
Wu is now Biden’s special assistant on technology and competition policy, and he was reportedly a “key architect†of Biden’s order. So the order’s mention of “attention markets†was more than just a passing note. The administration, including the FTC, will likely focus on attention markets and their anticompetitive effects going forward.
Besides antitrust implications, attention markets also implicate data security. In Wu’s definition of “attention merchants,†social media relies on users to share their information, but data security concerns make consumers hesitant to do so. Data security may offer “attention merchants†a business advantage, but as the recent Facebook data breach shows, this advantage is more aspirational than actual.Â
The FTC has long pursued enforcement actions against companies that have, in its view “violated consumers’ privacy rights, or misled them by failing to maintain security for sensitive consumer information.†The order signals that this pursuit will continue into the attention markets.
User Activity Monitoring
The order mentions “the surveillance of users,†a reference to user activity monitoring or online tracking. The FTC has issued guidance for consumers with respect to activity monitoring, but it only occasionally took action, with perhaps its highest-profile action coming in its 2012 administrative action against MySpace. The FTC’s January 2017 report on cross-device tracking urged the industry to regulate its own user surveillance but made no mention of government regulation.
The July 9 order could change that. The FTC may take a harder look at online tracking to determine whether that tracking is unfair within the meaning of the federal trade commission act. With the president’s encouragement, the FTC and other agencies may start using their statutory rulemaking powers to regulate online user surveillance. In the E.U., the e-privacy directive, also known as the “cookie law,†only allows online tracking if the user consents to it. Federal regulators may adopt or build upon this rule.
See More: Executive Order Inches Supply Chain Closer to Crypto-Agility and Strengthened Cybersecurity
Conclusion
The July 9 order focuses on antitrust, but its privacy implications also deserve attention. In the coming months, expect action from the federal government generally and the FTC specifically with regard to various hot-button privacy issues. Companies involved in any of these fields should prepare themselves for increased regulation through enforcement actions and rulemaking.
Did you find this article helpful? Tell us what you think on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We’d be thrilled to hear from you.