How the FTC can use ‘data minimization’ to immediately strengthen consumer privacy

Two prominent public interest groups are arguing that the Federal Trade Commission (FTC) can use its authority to establish rules that would immediately strengthen consumer data privacy.

Consumer Reports and the Electronic Privacy Information Center (EPIC) released a white paper on Wednesday outlining how the FTC can establish a “Data Minimization Rule” that would help push back against the “omnipresent” surveillance of internet users.

The paper argues that the FTC has the authority under the “unfairness” prong of Section 5 of the FTC Act to establish a “Data Minimization Rule” that would prohibit all secondary data uses with limited exceptions. A secondary use of collected data would be transferring and using the data for advertising, as the paper explains. The paper outlines three ways the rule could work: including outright prohibiting secondary data uses with limited exceptions, prohibiting specific secondary data uses like behavioral advertising or surveillance advertising, or mandating that people have a right to opt-out of secondary data uses.

“The FTC has over the last twenty years exercised regulatory authority under Section 5 of the FTC Act to limit unfair and deceptive privacy practices, but the Commission has not established comprehensive rules to prevent and limit privacy injuries,” the paper reads. “The FTC has ample authority to pursue such a rulemaking under Section 5. Courts have made clear that the FTC has broad authority to define unfair trade practices on a discretionary basis, and thus the power to address the substantial privacy harms caused by behavioral advertising and the related excessive collection, use, and disclosure of user data.”

The paper also urges the FTC to implement a number of other privacy protections under Section 5 of the FTC Act. The two groups argue that the FTC should require more transparency from companies about what the “primary use” of their data is, ensure that data processing isn’t discriminatory, and implement security obligations for companies handling people’s data.

Justin Brookman, the director of technology policy at Consumer Reports and a former FTC official, said the agency needed to act as Congress continues to struggle to come up with a federal data privacy bill.

“We have been waiting decades for Congress to provide baseline privacy protections over our data. Given the continued erosion of consumer privacy, the FTC should press forward in crafting rules that prohibit by default unnecessary data collection, use, and disclosure,” Brookman said in a statement.

Both Consumer Reports and EPIC were part of a swath of public interest organizations that urged the FTC last year to begin a privacy rulemaking process.