New rules needed to govern consumer privacy, says expert

Consumers give large amounts of personal information to companies, including their purchase and web histories, travel plans and even names of friends, often without realizing they are doing it. A big reason is that consumers often either don’t read or don’t understand the permissions they grant companies to use their personal data.

The Federal Trade Commission (FTC) is considering a proposed rule to regulate commercial surveillance of consumers’ data as part of its statutory authority to regulate and prevent unfair and deceptive trade practices.

The rule would be an important and overdue change in U.S. consumer protection, said Neil Richards, the Koch Distinguished Professor in Law and co-director of the Cordell Institute for Policy in Medicine and Law at Washington University in St. Louis.

“The FTC’s job is to prevent, prosecute and prohibit unfair and deceptive trade practices, and for far too long, the digital marketplace has been beholden to business models based on secretive commercial surveillance that harms consumers and treats them unfairly,” Richards said. “The commission has an important opportunity to pass substantive rules that benefit both consumers and companies.”

Richards, along with Cordell Institute Fellow Woodrow Hartzog, a professor of law at Boston University, and Jordan Francis, a research fellow at the Cordell Institute, submitted official comments to the FTC regarding the proposed new rule.

The comment period has ended. A decision on the proposed rule is expected in the spring.

“We applaud the commission for its thoughtful approach to these questions of critical importance for the future of our economy, our society and our democracy,” they wrote.

“The existing ‘notice and choice’ model for American privacy has failed to protect consumers, because consumer choice and consent to companies’ data practices is illusory,” Richards said. “As we explain in our comments, a new model built around data loyalty offers the best way to protect consumers against the prevalent harms of commercial surveillance. Our model, which would require companies to act in the best interests of the people whose data they hold, offers the hope for a sustainable and fair marketplace in which everyone but the unscrupulous can benefit.”

The researchers’ comments urge the commission to “promulgate substantive data privacy and data security regulations which will foster trust and enable human flourishing.”

“Recognizing the importance of trust in digital markets, our comments are organized around three arguments: commercial surveillance is the correct label for the data practices observed in the market; notice and choice, centered around the fiction of consumer consent, has failed as a regulatory regime; and the commission should ground its future data privacy rules under concepts of trust, loyalty and relational vulnerability,” Richards said.