FTC nominees urge Congress to pass federal data privacy law

Members of Congress also asked nominees for their thoughts on how the FTC should tackle AI.

A trio of nominees to the Federal Trade Commission said on Wednesday it is crucial that Congress pass a federal privacy bill, even as the agency they are nominated to lead is looking to take stronger action on privacy issues.

Speaking at their confirmation hearing before the Senate Commerce Committee Wednesday, the two Republican nominees and one re-nominated Democrat all said that it is up to Congress, not the agency, to pass new regulations on growing concerns about privacy, data brokers, and artificial intelligence.

“This issue is new, it’s complicated, and it’s going to affect people in a way that the commission simply can’t grapple with the way Congress can,” said Andrew Ferguson, one of the Republican nominees and the current solicitor general for Virginia,

Virginia is one of many U.S. states that has passed a privacy law in the absence of federal action on the issue, and Ferguson called on Congress to provide a solution to the current patchwork of state efforts. He described the FTC as fitting to enforce the measures. “The FTC is a good candidate, but I think the most important thing here is for Congress to take the lead,” Ferguson said.

The other Republican nominee, Melissa Holyoak, agreed the agency was “well positioned to take on that type of role.” Holyoak currently serves as the Utah Solicitor General within the Utah Attorney General’s Office, overseeing cases that include an antitrust lawsuit against Google for its conduct related to the Google Play Store.

In the absence of federal legislation on the issue, the FTC has recently embarked on a rulemaking effort to more closely regulate the collection of consumer data. On Wednesday, Rebecca Slaughter, the Democratic FTC commissioner who has been renominated for a second term, acknowledged concerns in Congress that the agency has overstepped its authority in launching its inquiry but noted that the agency “can’t do in regulation” what it “could not do in individual enforcement action.”

Slaughter said that any privacy action from the FTC will pale in comparison to congressional action and said it is urgent that Congress, given its greater authority, take up privacy legislation. “You can look at these issues much more broadly,” Slaughter said, addressing lawmakers.

As it explores privacy regulations, the FTC faces a similar conflict with Congress over AI, where the legislature is exploring but has not advanced any major legislation. As with privacy, some members of Congress are concerned the FTC is overstepping its powers.

At Wednesday’s hearing, Sen. John Thune, R-S.D., expressed reservations about any attempts by the agency to regulate AI, stating that “heavy-handed regulations” could “stifle innovation in an emerging space.”

Slaughter argued that the FTC’s ongoing exploration of how to regulate AI is based on its existing authorities, especially around prohibiting deceptive acts and practices and unfair competition. “Some of those may be triggered by some deployments or uses of AI, and we should be thoughtful about applying them,” Slaughter said.

As it considers potential legislation on AI, Slaughter encouraged Congress to think about how the FTC might be used to regulate harms that don’t fall under its current authorities. “That is up to you to decide — whether additional rules are required,” she said.

Wednesday’s hearing highlighted the political pressures faced by the agency, which Republicans have slammed as being overly aggressive in taking on technology companies.

Sen. Ted Cruz, R-Texas., slammed the agency for its recent “alarming decisions,” pointing to its allegedly “weaponized” enforcement actions against Twitter and its decision to explore a privacy rulemaking process that, in his view, is being carried out beyond the powers allocated to it by Congress.

Cruz also highlighted the resignation of former Republican FTC Commissioner Christine Wilson, who had expressed concerns about the agency’s direction under the leadership of Chairwoman Lina Khan.

Industry groups have urged Congress to move quickly to restore the FTC’s full majority, which the agency has been without since October.

“It is good to see the Senate taking steps to restore a full slate of bipartisan commissioners at the FTC,” said Josh Rogin, vice president of federal affairs at the Computer & Communications Industry Association. “We would encourage senators to move swiftly to bring balance to the FTC and to examine how the agency may have steered off course from a key component of the job Congress assigned it to do – protect consumers, particularly in industries where they have fewer choices.”

Senate set to debate package of bills on privacy, AI and kids safety 

Headlined by the Kids Online Safety Act, a key committee will look to clear major legislation governing how minors interact with the internet.

Dems press DNI nominee Jay Clayton on election security questions, but leave dismayed

Here’s how the FTC plans to enforce the Take It Down Act

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure