November 21 — Today, the Electronic Privacy Information Center (EPIC) submitted comments in response to the Federal Trade Commission’s (FTC) Advanced Notice of Proposed Rulemaking regarding a Trade Regulation Rule on Commercial Surveillance and Data Security. As EPIC explains:
The unchecked spread of commercial surveillance over the last two decades has led to a data privacy crisis for consumers in the United States. The ability to monitor, profile, and target consumers at a mass scale has created a persistent power imbalance that robs individuals of their autonomy and privacy, stifles competition, and undermines democratic systems. It is far past time to disrupt this data abuse and set rules of the road for our online ecosystem to ensure that companies cannot extract private value from personal data in ways that undermine the public good.
“For twenty years, lawmakers and regulators have failed to protect us as whole industries have risen to power on the exploitation of our personal data, “ said EPIC Senior Counsel John Davisson. “Who we are, what we like, where we go, what we believe—the intimate details of lives have become commodified and used to extract profit. But it doesn’t have to be this way. The FTC has the power to set rules that will limit what companies know about us, rein in harmful algorithms, crack down on digital discrimination and harms to children, secure our data, and reverse the asymmetry of power between consumers and big tech. EPIC’s comments set out a comprehensive blueprint for the FTC to do that.”
EPIC told the Commission that it should address the widespread data abuses by data brokers, targeted advertising firms, and other entities facilitating commercial surveillance by issuing comprehensive privacy rules that address the unfair trade practices that are causing substantial privacy injuries to consumers every day. Specifically, EPIC said the Commission should issue a data minimization rule to ensure that companies only collect personal data that they need to provide consumers with the goods and services that they request; collection and uses of personal data that go beyond what consumers reasonably expect should be prohibited.
EPIC also detailed harm that consumers are suffering as the result of untested, unsubstantiated, opaque, and dangerous automated decision-making systems in commerce. The Commission should issue an algorithmic fairness and accountability rule to require companies to establish that their decisionmaking systems are effective, accurate, and free from impermissible bias before they are deployed, and ensure that companies give meaningful notice to consumers about the use of these systems. EPIC also called for a ban on algorithmic systems that have been shown to cause serious and systemic harms, such as one-to-many facial recognition and emotion recognition systems.
Commercial surveillance and algorithmic decision-making systems disproportionately harm marginalized communities, and EPIC calls on the Commission to prohibit discrimination as an unfair trade practice.
EPIC also highlighted that minors are uniquely vulnerable to profiling and the outputs of commercial surveillance systems, which are necessarily designed to suggest and shape preferences and beliefs. The Commission should issue a rule limiting the collection and processing of minors’ data unless strictly necessary to provide a product, service, or essential function. EPIC also echoed support for the comments of Fairplay and the Center for Digital Democracy calling for a ban on targeted advertising to minors.
EPIC’s comments also called for specific rules on dark patterns and manipulative design, data security, and notice and transparency.
This is the first round of comments in the Commission’s rulemaking process. The FTC released the ANPR for its commercial surveillance rulemaking on August 11, 2022, and formally published it in the Federal Register on August 22nd. After an extension, the deadline for public comments in response to the FTC’s ANPR was November 21st. The Commission will now review the comments received and determine whether to move ahead with a rulemaking, at which time it will issue a Notice of Proposed Rulemaking, which must include the proposed rule text, any alternatives, and the reasons for the rule. The public will have another opportunity to comment at that stage.