�鶹������ý

There is general consensus among members of the U.S. Congress, industry, civil society, and the public that the United States needs federal privacy legislation, but there is no consensus on how such legislation would be enforced and by whom.¹ While the seemingly constant barrage of consumer data breaches and pervasive tracking across the internet have numbed the public and led to a sense of “privacy nihilism,” two major scandals in 2017 and 2018 managed to grab the public’s attention and cause Congress to consider policy solutions. Credit bureau Equifax announced in September 2017 that it exposed the personal information of 143 million (later revealed to be 147 million) people.² Then, in March 2018, journalists broke the story that Facebook’s data practices enabled the harvesting of 50 million (later revealed to be 87 million) users’ personal data, which was sold to political analytics firm Cambridge Analytica.³ Congress held a series of hearings on both incidents and introduced various privacy and data security bills, but ultimately did not pass legislation. The Federal Trade Commission (FTC), however, brought enforcement actions in response to both events and reached settlements with the companies.

The FTC worked with the Consumer Financial Protection Bureau (CFPB) and state attorneys general to reach a settlement with Equifax that created a fund to offer affected consumers a cash payment of $125 or free credit monitoring.⁴ However, the fund was capped at $300 million,⁵ and high demand for cash payments led the FTC to encourage consumers to accept the free credit monitoring option.⁶ If every affected person filed a claim, the payout would only be 21 cents. So Equifax added an additional hurdle requiring that people had credit monitoring services before the breach to obtain the cash award.⁷ The demand for cash payments should have come as no surprise, given that the breach affected half the U.S. population and consumers were unlikely to trust the company that breached their personal information to protect them from identity theft.

The FTC also reached consent orders with both Facebook and Cambridge Analytica, levying a record-breaking $5 billion fine against Facebook.⁸ However, senators called the fine a “far cry from the type of monetary figure that would alter the incentives and behavior of Facebook and its peers.”⁹ �鶹������ý’s Open Technology Institute (OTI) commented that Facebook “was rewarded on the stock market for the settlement, the settlement imposed no meaningful restrictions on Facebook’s data collection and sharing practices, and structural changes require a tenacious overseer to ensure compliance or they may lead to nothing.”¹⁰ Facebook was already under a consent order with the FTC when the Cambridge Analytica event occurred, and yet the third-party assessors responsible for monitoring compliance did not report it. The new consent order contained several changes to Facebook’s privacy practices, but the past failures of the FTC’s compliance system call its efficacy into question.

These two incidents helped Congress recognize that the privacy status quo is not working for consumers—but is it just because the United States lacks adequate privacy laws, or is the FTC also to blame? If Congress passes comprehensive privacy legislation, should the FTC be tasked with enforcing it? Or should Congress create a new agency?

OTI hosted an event and wrote a report in 2019 that explored different mechanisms of enforcement: federal agency (whether FTC or a new agency), state attorneys general and state legislation, and a private right of action empowering individuals to sue.¹¹ This report builds on that work to compare the relative merits of FTC enforcement versus enforcement by a new agency. Data privacy has become an issue of national economic, political, and social significance over the past few decades. The implementation of the European General Data Protection Regulation (GDPR) in 2018,¹² the California Consumer Privacy Act (CCPA) in 2020,¹³ and the passage of the Virginia Consumer Data Protection Act in 2021¹⁴ have heightened political impetus to implement a comprehensive federal privacy law. Moreover, the California Privacy Rights Act,¹⁵ an extensive amendment to CCPA, established a new agency—the California Privacy Protection Agency—to enforce the CCPA/CPRA rather than relying on attorney general enforcement.¹⁶

Discussions regarding enforcement of proposed federal privacy laws prior to late 2019 tended to focus on the question of whether or not enforcement should be shared between the FTC and state attorneys general. A lengthy Congressional Research Service (CRS) report on data privacy laws from March 2019 only addresses the possibility of creating a new agency to enforce federal privacy laws in one footnote.¹⁷ However, growing recognition of the weak enforcement of the GDPR in the first three years of its existence has heightened the importance of enforcement mechanisms in U.S. privacy legislation.¹⁸

This report explores the question of whether comprehensive federal data privacy legislation should be enforced by the FTC or a new agency created by Congress. This report will use the acronym “DPA” to refer to the general concept of a new agency to enforce federal privacy law in the United States. In Europe, this acronym refers to Data Protection Authorities that enforce the GDPR—in this report, those will be referred to as European DPAs.¹⁹ In the U.S. context, the acronym DPA covers the different agency titles—Data Privacy Agency, Digital Privacy Agency, Data Protection Agency, and Data Protection Authority—that appear in various bills and proposals. To avoid confusion, this report will discuss particular DPA proposals in reference to their authorizing legislation.

A number of lawmakers, members of civil society, and privacy experts have called for the creation of a dedicated regulatory body to enforce federal privacy law. In 2019, Representatives Anna Eshoo (D-CA) and Zoe Lofgren (D-CA) introduced the Online Privacy Act of 2019, which would create a DPA.²⁰ In 2020, senators also introduced two additional federal privacy bills that would establish DPAs: Senator Sherrod Brown’s (D-OH) Data Accountability and Transparency Act,²¹ and Senator Kirsten Gillibrand’s (D-NY) Data Protection Act.²² This report will compare these three bills to one another and to FTC enforcement. We will also draw comparisons between the DPA proposals and two relatively new federal agencies: the CFPB and the Privacy and Civil Liberties Oversight Board (PCLOB). This report will not cover proposals like the Digital Platform Agency proposed by former FCC Chairman Tom Wheeler²³ and Public Knowledge’s Harold Feld,²⁴ which are sector-specific agencies that would have jurisdiction much broader than privacy.

Comprehensive privacy legislation will only have a substantive effect on business practices if there is a federal agency with the will, ability, and resources to enforce the law rigorously. We do not conclude that a new agency or an enhanced FTC is inherently a better enforcement agency. Rather, we argue that Congress should assess the effectiveness of proposals for either type of enforcement model using key metrics: authority, independence, resistance to regulatory capture, effectiveness of enforcement, budget, and feasibility.

This report first explains the differences between proposals that empower the FTC and proposals that create a DPA to enforce privacy legislation. It then explains the similarities and differences between the DPAs proposed by the Eshoo-Lofgren, Gillibrand, and Brown bills. The final section of the report defines each metric, explains why it is important for Congress to consider, and evaluates how an empowered FTC and DPA would compare along the metrics.

Editorial disclosure: This report discusses policies by Facebook and Google, both of which are funders of work at �鶹������ý but did not contribute funds directly to the research or writing of this piece. �鶹������ý is guided by the principles of full transparency, independence, and accessibility in all its activities and partnerships. �鶹������ý does not engage in research or educational activities directed or influenced in any way by financial supporters. View our full list of donors at www.newamerica.org/our-funding.