Gibson Dunn held a webinar last week with firm partners from around the country giving their expectations for a Biden administration in the realm of cyber security and data privacy. And while the administration is likely to pursue enforcement through the Department of Justice, Securities and Exchange Commission and Consumer Financial Protection Bureau, some of the most significant moves for employers could come from the Federal Trade Commission.
The first move to keep an eye on will be in the makeup of the commission itself. The commission has five commissioners and no more than three may come from either political party. The commission currently has a 3-2 split favoring Republicans, though Gibson Dunn partners Ryan Bergsieker, from the Denver office, and Ashley Rogers, from the firm’s Dallas office, say the current commissioner Joseph Simons is expected to step down. Resignation from an appointed position is a common practice when a change in presidential administration occurs.
The commission has been active in recent years with respect to privacy and cybersecurity concerns, with the current Democratic commissioners taking a more vocal position on those issues. Those issues are expected to take a more prominent role within the commission if and when it tips toward Democratic control.
President-elect Joe Biden has already said he favors increasing privacy and cybersecurity regulations, and Vice President-elect Kamala Harris addressed consumer protection and privacy in the tech world while serving as attorney general of California. The state also passed its nation-leader consumer privacy law during her tenure. Should the Biden administration live up to expectations in the consumer protection sphere, the FTC would likely receive increased appropriations, Bergsieker said. That could make the commission more able to take an aggressive position in its caseload.
“The state of California now has more privacy and consumer protection resources than the FTC itself,” Bergsieker said. As such, the way the FTC uses its relationships with other federal and state agencies is as a “force multiplier on consumer protection.” That is likely to continue with coordination between the FTC and states in the tech space and between the FTC and CFPB in consumer protection, he said.
Consumer Protection
The U.S. Supreme Court is set to hear AMG Capital Management v. FTC, a case that questions whether the FTC, through its ability to authorize injunctions in its consumer protection role, can also demand monetary relief such as restitution.
“The importance of this can’t be overstated,” Bergsieker said, echoing the same sentiment from Rogers. “This affects the agency’s mission and the size of the stick that it has to bring companies into compliance.”
Outside of the high court’s coming impact on the commission, the change in presidential administration could also affect the commission’s actions toward individual leaders of companies — which will be “particularly significant for companies dominated by larger-than-life personalities,” Bergsieker said.
Both Democratic commissioners have insisted individual leaders should be held individually liable in cases involving alleged misconduct by companies so the agency can appropriately remediate harm and deter harm, Rogers said. In July 2019, commissioners Rohit Chopra and Rebecca Kelly Slaughter each delivered blunt dissents to two agency settlements, a “historic” $5 million settlement with Facebook for privacy violations and a $170 million fine for YouTube for its handling of children’s data. Slaughter wrote in her dissent to the Facebook settlement that she believed the agency should have instead pursued litigation against Facebook CEO Mark Zuckerberg.
Rogers continued, saying the Democratic commissioners have indicated they’re “ready and willing” to go after corporate leaders who are involved in the day-to-day functions of their companies when those companies are involved in wrongdoing, and the commission may begin going after larger entities than it has in the past, which would put significant “investigatory burdens” on those companies and individuals, she said.
Privacy
The FTC, charged with the mission of preventing deceptive and unfair business practices and enhancing consumer choice, among other tasks, is the primary privacy enforcement agency within the federal government. And although most U.S. privacy regulation has so far come the California Consumer Privacy Act, and to a lesser extend Colorado’s Data Security Law, there has been a push during recent years for the federal government to pursue its own privacy legislation. That likelihood has gone up after Democrats won runoff elections in Georgia for U.S. Senate seats. Now, questions regarding legislation have less to do with whether Congress will pursue such legislation but, as Bergsieker said, whether it would preempt those state laws.
Should federal privacy legislation come, it will likely focus on the health care industry —particularly regarding patient privacy and provider cybersecurity requirements in relation to the COVID-19 pandemic — and the technology industry, Rogers said.
The pandemic response involves tracking confirmed COVID-cases as well as monitoring the success of the vaccines being implemented, both of which necessitate the collection of personal information and carry with them privacy risks that have caught attention of Republicans and Democrats, Rogers said, with both parties driving legislation in the chambers they currently control. It is plausible, Rogers said, that the Democrat-led bill in the House will receive renewed attention.
That bill, the “Public Health Emergency Privacy Act,” would restrict the collection, usage and disclosure of certain data related to COVID-19 and also includes a private right of action for individuals.
In the technology realm, the FTC in December issued orders to nine video streaming companies requiring information about how they collect, use and present personal information, their advertising and user engagement practices, and how their practices affect children and teens. That information could be used for recommendations to Congress for legislation, Rogers said.
— Tony Flesor