2Buzz service when it was launched. Twitter and Google Buzz are the SMIIS servicessubject to the two recent orders, and a substantial cause for this rulemaking petition.Development of an Administrative Record, Leading to Issuance of Rules is Proper.Rulemaking should be commenced before the FTC continues to mandatestandards, protocols, and audits for SMIIS operators, which are co-extensive with thedata protection standards that the agency legally may impose on financial institutions andthose companies handling financial transactions and payment card transactions. Therequested rulemaking would address the appropriateness of the mandates, and do so inthe broader context of SMIIS privacy concerns, and too, rulemaking would air out thedoubts as to the agency imposing such stringent mandates on an ad hoc basis.The mandates ordered in the Twitter matter, as well as the Google Buzz matter,are the same as, or are coequal to those in FTC decrees with companies that plainly aresubject to the Gramm-Leach-Bliley requirements,
e.g
., 16 C.F.R. Part 313. FTC clearlyhas authority, for example, over the “acts or practices by banks, savings and loaninstitutions,” per 15 U.S.C. §57a(f). However, whether the FTC should impose theequivalent mandates on SMIIS and
non
-financial operations is not free from doubts.For FTC to engraft these administrative, technical, and physical safeguardrequirements, appropriate to highly-regulated financial services companies, onto theoperators of SMIIS may amount to
de facto
rulemaking done outside the bounds of theAPA. An agency cannot “create
de facto
a new regulation.”
Christensen v. HarrisCounty,
529 U.S. 576, 588 (2000). Before the same data protection mandates can beimposed on SMIIS and their operators, the FTC should institute rulemaking and “giveinterested persons an opportunity to participate in the rule making through submission of written data, views, or arguments.” 5 U.S.C. § 553(c).The announcement of the mandates in the Google Buzz order noted that it was the“first time” that the FTC “has required a company to implement a comprehensive privacyprogram to protect the privacy of consumers’ information.” That may or may not givedue regard to the similarities between the Twitter decree and the Google Buzz decrees
3
and too, the Google Buzz order may takes steps beyond what the Twitter order required.
4
Certainly the remarks about both orders underscore the appropriateness of rulemaking toestablish, on a full administrative record, rules and agency guidances, which may beappropriate to published privacy policies and to advertised measures respecting thetechnical safeguards and business practices for privacy in the SMIIS industry sector.The FTC Improvements Act authorizes the Commission to issue trade regulationrules which define unfair or deceptive acts or practices in or affecting commerce, butwithin statutory constraints. 15 U.S.C. § 57a(1)(B). The statutory mission of the FTCand its general jurisdiction has limits, and the agency “is constrained by its congressionalmandate.”
F.C.C. v. Fox Television Stations, Inc
. 556 U.S. ___ , 129 S.Ct. 1800, 1826(2009) J. Stevens, dissenting.
3
As stated in the FTC’s summary, “Part II of the proposed order requires Twitter to establish andmaintain a comprehensive information security program in writing that is reasonably designed to protectthe security, privacy, confidentiality, and integrity of nonpublic consumer information.”
4
The agency denominated the Twitter order as a “milestone” of the FTC, calling it the “First datasecurity case involving social media.”
Leave a Comment