Governing Information Privacy: Understanding How the Federal Trade Commission Regulates Privacy

Abstract

The rapid growth of digital transformation calls for a rethinking of how to regulate privacy-related issues, which challenges the wisdom of policymakers around the world. Relying on textual analysis of existing legislation, regulations, judicial opinions, and agency decisions, this dissertation examines the “Enforcement-as-Regulation” (EAR) model, the regulatory approach that the Federal Trade Commission has adopted in regulating information privacy. Drawing on the history of the administrative state in general, and that of the FTC in particular, this dissertation finds that the FTC has invented the EAR model as a workaround to overcome the limits on its rulemaking power. These limits, mostly imposed by Congress in response to the FTC’s aggressive efforts to regulate industry in 1960s and 70s, require the Commission to comply with additional procedural obligations when prescribing rules, making it nearly impossible to issue any privacy rules. Then this dissertation argues that the EAR model is a proper exercise of the FTC’s authority within the existing legal framework. Not only does the FTC have the discretion to utilize a case-by-case approach for announcing its policies, but also when doing so, the Commission has satisfied the constitutional standards of due process. Finally, this dissertation concludes that the FTC’s EAR model is compatible with the emerging framework of information governance. Through the lens of information governance, if private companies have incentives to maintain the level of privacy, then regulators can develop innovative strategies to encourage self-organization of companies in protecting consumer privacy. Such a framework could inform future research on administrative law and information privacy law.