Experts See Path Forward on Privacy Legislation After Facebook-Cambridge Analytica

Commissioner Brendan Carr earlier said FCC process for deciding to rescind 2015 net neutrality rules, which took effect earlier this month (see 1806110054), was a net positive despite widespread partisan rancor. Debate on a range of issues under FCC jurisdiction “has gotten very nasty,” said Phoenix Center President Lawrence Spiwak. “In a lot of ways” the rescission proceeding “was a great thing,” Carr said. “You had [more than 20 million] submissions" and “it reflects the passion” people feel about the issue. “It's OK that we get” submissions with a wide range of viewpoints and analysis quality because “we can take all that information in” and use it to render the best decision possible, Carr said.

Carr praised the FCC for having “a low barrier" for people "to participate in our proceedings.” It doesn't use CAPTCHA authentication and other technologies in its Electronic Comment Filing System “that might create a barrier to someone saying whatever it is that we want to say,” he said. Lawmakers and industry officials urged the FCC to adopt CAPTCHA or another authentication technology on ECFS in the wake of the 2017 incident the agency has claimed was a possible distributed denial of service attack (see 1806050046, 1705170067, 1805210063 and 1806060032).

“There's a well-established framework” of FTC-developed core privacy principles that should be included in any final bill -- like transparency, respect for choice and basing controls around consumer harm -- “that have really withstood the test of time pretty well,” said AT&T Vice President-Global Public Policy Jeff Brueggeman. “We can do this.” The EU's controversial general data protection regulation could also be a model for a U.S. privacy law despite being widely “mischaracterized” by U.S. stakeholders, he said. “It gets short-handed as if it is a completely rigid opt-in privacy regime” but the EU is going to take years to make it a fully settled law.

Major companies want a “global baseline standard” on privacy for operational reasons, said Reed Smith's Gerry Stegmaier: Such a law would likely need to be reminiscent of GDPR since top companies are already adhering to that regulation because of business connections in EU-member countries. Uniformity would result in “simplicity” for major companies and an argument the U.S. has returned to being adequate on privacy in comparison to the EU, he said. The range of state-level privacy laws that have been enacted in the absence of a national statute has bred a global belief that U.S. protections “are not adequate,” the lawyer said.

Changes to FTC rulemaking authority must “be a part of the equation,” said Center for Democracy & Technology Privacy and Data Project Director Michelle DeMooy. She noted the FTC doesn't have rulemaking authority on privacy issues, which has “been a huge hindrance to an agency that has been tasked with an enormous amount of jurisdiction and changing technologies and all kinds of challenges.” Work on a broad bill must also include discussions about discrimination and ad-targeting, she said: “The people who are having these discussions tend to not be diverse,” which is problematic because “the country is such a melting pot.”