An image of a Washington DC metro station in black and white
Credit: Yuvraj Singh for Unsplash

The rise of commercial surveillance means that new trade regulation rules are urgently needed.

Routinized commercial surveillance has become ubiquitous, which means that the Federal Trade Commission (FTC) should adopt new trade regulation rules reflecting this new reality

Our new report released today, authored by Dr Ann Kristin Glenster, Senior Advisor on Technology Governance and Law, explores the new regulatory dawn for online consumer privacy in the United States.

Our recommendations focus on the need to adopt mandatory data processing principles and consumer consent.

The implications of endemic commercial surveillance are far-reaching.

Not only has the hoarding and monetization of personal data undermined the belief that individuals can have privacy online, it has also had negative effects on consumer freedoms and their trust in the digital economy. The result is a worrying loss of personal autonomy and consumers’ ability to participate in the market.

The deleterious knock-on effect is diminishing consumer confidence in the digital economy, which is part of a larger picture of trust being eroded in civil society.

This report is the University of Cambridge Minderoo Centre for Technology and Democracy’s response to the Federal Trade Commission’s (‘FTC’) request for submissions ‘Regarding the Commercial Surveillance and Data Security Advance Notice of Proposed Rulemaking Commission File No. R111004’ (‘ANPR submissions’).

We situate our advice in the context of the historical role the FTC has played as a de facto privacy regulator, and how the rise of commercial surveillance means that new trade regulation rules are urgently needed. The implications of endemic commercial surveillance are far-reaching.

Our key recommendations are:

Mandatory Data Processing Principles

-The FTC should adopt new trade regulation rules which include a mandatory obligation placed on companies to adhere to the transparency, data minimization, purpose limitation, and duration limitation principles in relation to all processing of consumer data.

Consumer Consent

-The FTC should adopt new trade regulation rules governing the use of consumer consent by companies online.

-Consent should be mandatory in some instances, and whenever used, it should conform to standards similar to those in EU law, including the right to withdrawal consent and the stipulations that consent must be informed.

-Consent should not be used in situations where the consumer cannot reasonably consent, such as to profiling based on personal data harvested without the consumer’s knowledge or understanding.

-Receiving access to goods and services should not be contingent on consent to the processing of personal data unless strictly necessary for the performance of contract or the delivery of those goods or services.

Definition of Personal Data

-The FTC should adopt a definition of personal data that clarifies which data is covered by the data processing principles and consumer consent

-The definition of personal data should be wider than the definition of ‘private’ data or ‘sensitive’ data

-The definition of personal data should be technologically neutral

It is the tech industry that must be held accountable for its treatment of consumer data.

The FTC has a responsibility to ensure that this happens, and new trade regulation rules are crucial to that endeavor.

 

Read our full report on the links below.