VIEWPOINT Congress, not regulators, should set privacy rules

The following is from a Washington Post editorial:

A stalemated Congress is looking toward a depressingly familiar solution for its failure to pass comprehensive privacy legislation: Get someone else to do its job for it.

The Senate Commerce Committee led by Sen. Maria Cantwell, D-wash., is undertaking at least two hearings to reanimate languishing efforts to develop a law protecting consumer data — but many, understandably after years of unfulfilled promises, have ceased to hold their breath. This explains a letter this month from Sen. Richard Blumenthal, D -Conn., and a handful of colleagues urging Federal Trade Commission Chair Lina Khan to begin a regulatory process that would take matters into the agency's hands. The commission laid the groundwork for this kind of action this summer, when it voted to streamline the cumbersome series of steps known as Magnuson-moss rulemaking. This next-best option is certainly better than nothing, yet the best option remains bipartisan compromise. Lawmakers shouldn't give up.

The FTC has used its socalled Mag-moss authority only seven times in more than 40 years. The process was designed to constrain the commission after what lawmakers viewed as a flurry of capricious regulation by requiring rigor and thoroughness. As a result, the rulemaking tends to take a long time: on average 2,035 days, or about six years, according to research. The FTC'S new procedures should compress that timeline, but only somewhat.

There's also the matter of what behavior the FTC has the power under the process to address. Any new rules must be grounded in the agency's ability to prohibit “unfair or deceptive” practices, and the contours of unfairness the commission sets are sure to be challenged in court.

The FTC could go small and merely codify existing privacy cases, or it could go big by spelling out limitations on the collection and sale of information as well as barring some behavior altogether. The latter approach is precisely what’s called

for, and what Congress has been contemplating. Yet from the FTC, sweeping changes could run into trouble meeting judicial muster — and all the long, hard work of rulemaking would be for naught.

It would be, that is, unless it prompts Congress to act after all. The FTC is right to test its ability to craft regulations after years of sitting back, especially in the expectation of funding to stand up a bureau dedicated to privacy, but if the test fails and legislators meanwhile stand idly by, consumers will be the ones to lose. Lawmakers are far less limited in the obligations they can impose on data-hungry businesses. They don't lack for ideas of how to do it. All they lack, it appears, is the will.

They should view any upcoming action by the FTC not as an excuse to continue abdicating responsibility, but as an imperative to take it.