Why Is the FCC Rushing through Privacy Rules?
Normal 90-Day Comment Window Wouldn’t Leave Consumers Unprotected
Finally, after over a year of inaction, the FCC is suddenly rushing ahead with the privacy rulemaking it promised it would do in the 2015 Open Internet Order. Instead of the usual comment window of 90 days (60 for comments plus 30 for replies), Chairman Wheeler will allow just 57 days for comments.
The FCC’s been asked for a sixty-day extension for comments. Self-appointed “consumer advocates” have opposed the request, because the outcome is all but predetermined under this FCC. There’s approximately zero chance Wheeler will grant it, given his consistent disregard for external input from outside his echo chamber of advisors and activist groups. But he should.
TechFreedom has filed an ex parte urging the FCC to grant the extension. The filing concludes:
We urge the Commission to grant ANA’s request for a deadline extension. If the FCC loses on reclassification, even in part we ask the Chairman to issue a Further NPRM to clarify its proposal, with the standard 90 days for comment. In the alternative, if the FCC refuses to issue an FNPRM, we request that, at a minimum, the Commission should allow for the normal 60 days for comment, and a further 30 days for reply comment, after such a decision — which may mean granting an additional extension longer than that requested by ANA. The “duty” invoked by Commissioner Rosenworcel demands nothing less.
Our FCC Filing — In Full
The Association of National Advertisers (ANA) has asked for a sixty-day extension for comments. We write to support this request, and to make an additional request (in our conclusion) as to what the FCC should do in the event that the D.C. Circuit blocks reclassification, at least in part.
Both sides focus on the policy side of the rulemaking: ANA notes that the NPRM runs
147 pages… contains numerous proposed requirements with potentially complex impacts regarding the privacy of collected and user data. Commissioner Rosenworcel mentioned in her oral remarks during the Commission’s consideration of this matter that there are more than 500 questions raised in the NPRM. Yet the timetable for the filing of initial comments is limited to a mere 57 days from the release of the Notice. For groups like the ANA with an extremely broad and diverse membership, being able to receive full and thoughtful input and then to respond to the NPRM’s questions will take time and careful consideration.
A coalition of activist groups — including Public Knowledge, the organization founded by Gigi Sohn, Counselor to FCC Chairman Wheeler — predictably opposes the request:
[T]he questions in the NPRM are not unanticipated. The Open Internet Order gave a clear indication that the FCC would engage in this rulemaking and therefore interested parties should begin thinking about the issue. In addition, the public has long had notice of many of the questions the FCC would attempt to address in this proceeding because of the extensive interactions between the FCC, regulated entities, and the public.
The activists’ arguments are irrelevant to the practical challenge a group like ANA faces in getting feedback from its members about the specific rules proposed by the FCC — which were not made public until the NPRM was published — and then formulating a policy position that represents the inputs and perspectives of all its members.
But the even better reason to provide a normal amount of time for comment is the thorniness and importance of the underlying questions raised by the NPRM about the FCC’s legal authority. And, however those questions are resolved, the most important legal point here is that there is no regulatory vacuum: either the FCC or the FTC can protect consumers case-by-case, without a rulemaking (or until one’s completed). Indeed, the FCC has already waited a year. Why rush now?
There is no regulatory vacuum: either the FCC or the FTC can protect consumers case-by-case, without a rulemaking.
There are three broad legal reasons for extending the comment deadline.
Reason #1: Reclassification May Fail in Court
It was a mistake for Chairman Wheeler to insist on issuing the NPRM before the D.C. Circuit rules on the legality of the FCC’s Title II reclassification. If, as seems likely, the court blocks at least the reclassification of mobile wireless, that will moot the FCC’s argument that it has to regulate mobile broadband privacy: the FTC’s jurisdiction will be entirely restored by the court’s decision.
In such a scenario, if the FCC were simply trying to fill a regulatory vacuum, it would focus its privacy regulations on wireline broadband (cable, FiOS, etc.) and fixed wireless. But it has been years since the FCC has passed up a major opportunity to extend its authority. So there is every reason to think the FCC may switch justifications for privacy regulation and extend the same rules proposed by the NPRM to mobile wireless broadband based on the other sources of authority it claims: Section 706 and Title III.
It is not enough that the NPRM at least implies this possibility, by citing these alternative bases for authority. Shoving a 147-page NPRM out the door knowing that the court decision may fundamentally change the legal landscape puts commenters in the impossible position of having to imagine all potential ways the D.C. Circuit might decide the case and how that might affect this rulemaking, then comment on each of these potential scenarios. The NPRM’s timing may not directly violate the APA, but only because Congress simply did not imagine that an agency Chairman would be so Machiavellian as to issue an NPRM just weeks before a court decision that might make the NPRM completely unnecessary (if reclassification fails entirely).
Ideally, the FCC ought to at least commit to issuing a Further NPRM if the FCC loses on all or part of Title II reclassification. Of course, there’s almost zero chance Wheeler would do that — just as he refused to issue a Further NPRM after he completely changed course on the Open Internet Order to meet the White House’s demands. Indeed, the OIO may well fall apart in court because of that decision, which merely illustrates the intensity of the Chairman’s hostility to the way the notice-and-comment process is supposed to work — and his contempt for the rule of law.
But extending the deadline would at least increase the chances that both sides will be able to comment on the legal issues raised by the decision, which is highly likely to come out between now and the end of the D.C. Circuit’s term on June 14.
If so, ANA’s proposed extension of the comment deadline, to July 26, would assure that commenters of all perspectives will have at least some legal certainty as to which services have and have not been reclassified — and, thus, where there is, and is not, a vacuum of authority that the the FCC needs to fill. Of course, appeals are inevitable, probably from whichever side does not achieve complete victory (to the full D.C. Circuit and/or to the Supreme Court). But at least the three-judge panel’s decision will provide some clarity if the FCC wins — and could create utter confusion if the FCC loses across the board on reclassification.
Reason #2: The NPRM Raises Complex Legal Questions
Assuming the FCC can reclassify at least some broadband (fixed being the easier of the two kinds), the NPRM rests on a series of assertions about how the FCC can use Title II authority. Most notably, the FCC claims that, in using Title II authority, it is not limited by the traditional statutory bases for CPNI privacy regulation of telephone companies: Section 222(b) and (c). Back in October 2014, in the Terracom settlement, the FCC claimed that Section 222(a) creates a separate, broader “duty to protect the confidentiality of proprietary information.” The Terracom NAL points back to a footnote from the FCC’s 2007 CPNI order, claiming that was the reinterpretation.
Furthermore, the FCC also based that order, and bases its new proposed rules, on Section 201(b)’s requirement that Title II common carrier practices be “just and reasonable.”
Together, 222(a) and 201(b) would allow the FCC to invent a completely new privacy regime that looks nothing like the old CPNI rules for telephony (as the NPRM acknowledges, in seeking comment on “harmonizing” those “up” to match the new rules for broadband).
Oh, and even though the FCC’s proposal is (mostly) limited to broadband providers, its third statutory basis of authority for the proposed rules, Section 706, isn’t limited to broadband — which means that every Internet and non-broadband communications company in America may be affected by this NPRM, either because it lays the groundwork for a future rulemaking or because it will help the FCC justify its use of Section 706 for direct case-by-case enforcement of non-broadband companies’ data practices.
Section 706, isn’t limited to broadband — which means that every Internet and non-broadband communications company in America may be affected by this NPRM.
When the D.C. Circuit in Verizon accepted the FCC’s 2010 reinterpretation of Section 706(a) as an independent grant of substantive authority, it brushed aside concerns that this authority “would have no limiting principle,” assuring us that it “is not so boundless as to compel the conclusion that Congress could never have intended the provision to set forth anything other than a general statement of policy.” The court cited two limits:
First, the section must be read in conjunction with other provisions of the Communications Act, including, most importantly, those limiting the Commission’s subject matter jurisdiction to “interstate and foreign communication by wire and radio.” 47 U.S.C. § 152(a). Any regulatory action authorized by section 706(a) would thus have to fall within the Commission’s subject matter jurisdiction over such communications — a limitation whose importance this court has recognized in delineating the reach of the Commission’s ancillary jurisdiction. See American Library Ass’n, 406 F.3d at 703–04. Second, any regulations must be designed to achieve a particular purpose: to “encourage the deployment on a reasonable and timely basis of advanced telecommunications capability to all Americans.”
In other words: “Don’t worry, the FCC can only regulate communications and only if it invents a cockamamie, Rube Goldberg-esque theory as to how regulating something will promote investment in it.” The court went on to say, in the biggest laugh line of the decision, that the FCC’s “burden” in proving that connection “is far from ‘meaningless’ … as we trust our searching analysis below will demonstrate.” If that decision’s “analysis” of the FCC’s breathless assertions about the “virtuous cycle” qualifies as “searching,” there is nothing to stop the FCC from using Section 706 to regulate edge providers’ privacy and data security practices — or any other practices — except the political will to do so.
On top of all this, the FCC points to two sections of Title III, governing wireless licensees, as a final basis for regulating mobile broadband privacy — probably anticipating that the FCC is likely to lose on mobile broadband reclassification:
Section 303(b) of the Act directs the Commission to, “as public convenience, interest, or necessity requires,” “[p]rescribe the nature of the service to be rendered by each class of licensed stations and each station within any class.” Section 303(r), furthermore, directs the Commission to make rules and regulations, and prescribe restrictions and conditions, to carry out the Act. In addition, Section 316 authorizes the Commission to adopt new conditions on existing licenses if it determines that such action “will promote the public interest, convenience, and necessity.” To the extent that BIAS is provided by licensed entities providing mobile BIAS, these provisions would appear to support adoption of rules such as those we consider in this proceeding.
If the FCC can use these sections to regulate mobile broadband data practices, what limit is there to its power to regulate wireless services — beyond the inherently political assertion by three Commissioners of what they believe the “public interest” to require at any particular point in time.
These are all tremendously complicated legal questions — to add on top of the hard policy questions ANA’s members need time to grapple with. They provide ample reason for giving all parties the normal 90-day window for filing comments.
Reason #3: The FCC Can Regulate without a Rulemaking
But here’s the most important point: there’s no need to rush the rulemaking because the FCC can protect consumers without doing a rulemaking. If reclassification stands, the FCC can use Sections 222 and 201(b) to police broadband privacy on a case-by-case basis. In fact, the FCC settled its first privacy enforcement action just last month, against Verizon over mobile device tracking, for $1.35 million — based both on the Open Internet Order’s transparency rule and Section 222. That’s how the FTC operates anyway. So if the FCC is simply filling the vacuum created by reclassification (which deprived the FTC of jurisdiction), this should be the end of the matter.
And if reclassification fails, jurisdiction will simply revert back to the FTC (whose jurisdiction covers essentially all companies except common carriers). Either way, there won’t be a regulatory vacuum.
There’s really only one thing the FCC can do after a rulemaking that — at least theoretically — it can’t do without one: issue monetary penalties. Footnote 1394 (of 1777 total!) of the Open Internet Order explains that, “the Commission cannot impose a penalty in the absence of ‘fair notice of what is prohibited.”
But even this theoretical limit won’t do much to constrain the FCC, as last month’s $7.4 million Verizon privacy settlement should make clear. The FCC is essentially rebuilding the FTC’s Unfair and Deceptive Acts and Practices (UDAP) authority. Every Deception case it brings will be premised, in part, on the OIO’s Transparency Rule. So the FCC can impose potentially staggering fines under that rule — even if, technically, it cannot do so for direct case-by-case application of Sections 222(a), 201(b), 706 or the provisions of Title III cited above.
And even where the FCC might bring a pure unfairness case, absent any deception — say, governing what constitutes “reasonable data security” (in the absence of a company’s claim to consumers about their security practices) — the fact that the FCC can’t technically impose a penalty will not stop the agency from coercing a company into making a “voluntary” payment as part of a settlement. And there’s every reason to think the FCC will claim that its first settlement about a practice provides sufficient notice to impose a monetary penalty the next time it brings an enforcement action around that topic. This won’t change much, since the FCC is likely to proceed, as the FTC has, without actually litigating, instead building what the FTC calls a “common law of consent decrees.” But it would at least give the FCC even more leverage in such “negotiations.”
The point is: the FCC has already claimed all the powers it needs to replicate the FTC’s case-by-case approach to privacy regulation — without a rulemaking. Reclassification very much changed what the FCC can do (hence, our concern about this rulemaking and the reason TechFreedom joined the lawsuit to stop reclassification) but it didn’t change the day-to-day policing of broadband privacy (ex post case-by-case enforcement). It just changed the cop on the beat. There is simply no reason for the new cop to suddenly rush ahead with a dramatically different approach (ex ante rulemaking).
The FCC has already claimed all the powers it needs to replicate the FTC’s case-by-case approach to privacy regulation — without a rulemaking.
There is one important thing the FCC can’t do that the FTC could: get injunctive relief for consumers. The FTC Act allows the FTC to seek disgorgement of ill-gotten gains, payable as refunds to consumers, while the Communications Act only allows for penalties. That’s a huge upside of the FTC over the FCC, but… that ship has sailed, and the issue won’t be fixed by rulemaking, whether rushed or not.
This Proceeding Is too Important to Rush
We’ve been here before. The 2015 Open Internet Order was, itself, rushed out the door — over loud, bipartisan objections. Democratic Commissioner Jessica Rosenworcel put it best in her separate statement accompanying the NPRM:
I support an open Internet. But I would have done this differently. Before proceeding, I would have taken time to understand the future. Because the future of the Internet is the future of everything. There is nothing in our commercial and civic lives that will be untouched by its influence or unmoved by its power. I would have taken time for more input. Because I think as public servants we have a duty to acknowledge and respond to the great tide of public commentary that followed in the wake of the Chairman’s proposal. …
I support network neutrality. But I believe the process that got us to this rulemaking today is flawed. I would have preferred a delay. I think we moved too fast to be fair. …
If past is prologue, the future of this proceeding, the future of network neutrality, and the future of the Internet is still being written. I am hopeful that we can write it together — and I am mindful that we must get it right.
The exact same can, and must, be said for privacy regulation. Indeed, for all the reasons laid out above, the case for delay — to allow for normal, considered public input — is far, far stronger.
We urge the Commission to grant ANA’s request for a deadline extension. In addition, if the FCC should lose on reclassification, even in part, we ask the Chairman to issue a Further NPRM to clarify its proposal, with the standard 90 days for comment. In the alternative, if the FCC declines to issue an FNPRM, we request that, at a minimum, the Commission should allow for the normal 60 days for comment, and a further 30 days for reply comment, after such a decision. Depending on the timing of the court’s decision, that may well mean granting an additional extension longer than that requested by ANA — something the FCC should not hesitate to do. The “duty” invoked by Commissioner Rosenworcel requires that the FCC give commenters adequate opportunity to comment on the FCC’s proposals in light of what the D.C. Circuit actually decides.