FTC Proposed "Commercial Surveillance and Data Security" Rulemaking Raises Significant Questions About Risks Arising From AI/Machine Learning

The Federal Trade Commission has formally launched a rulemaking proceeding that nominally is focused on consumer privacy issues, but actually raises significant questions about the impact of artificial intelligence/machine learning (AI/ML) systems and applications and whether the Commission should adopt rules regulating, limiting, or otherwise overseeing such systems and applications. Companies that develop and deploy AI systems that analyze or utilize consumer data should seriously consider submitting comments to the FTC.

The FTC's proposal was released as an Advance Notice of Proposed Rulemaking (ANPR) on "Commercial Surveillance and Data Security." The Commission voted along party lines, 3-2, to initiate the proceeding. The comment period for addressing the many questions raised in the ANPR closes October 21. In addition, the agency will host a virtual public forum on September 8, 2022, that will include panel discussions and opportunities for two-minute comments from members of the public.

The Commission invites comment on whether it should consider implementing new trade regulation rules or other regulatory alternatives "concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive." The Commission said that it is not proposing any new rules, but rather "generat[ing] a public record" about commercial surveillance and data security practices that may be unfair or deceptive in violation of Section 5 of the FTC Act.

The ANPR poses more than ninety questions on "commercial surveillance and data security" to create a record that it may consider for issuing regulations, including specific questions concerning the use of biometric information, commonly used AI/ML systems classified as "automated decision-making" tools, and concerns around so-called "algorithmic error" and "algorithmic discrimination."

The summary below focuses on those issues raised in the ANPR relevant to the potential regulation of AI/ML systems and applications. DWT's Privacy & Security team published a parallel blog post on the issues the ANPR raises for potential FTC regulation of the collection and use of consumer data and data security.

Automated Decision-making Systems

In the ANPR, the FTC seeks information about the use of automated decision-making (ADM) systems, the costs and benefits those systems confer, their reliability, and the extent to which they are susceptible to algorithmic errors and capable of causing discrimination. The Commission also raises a number of legal and policy questions focused on the scope of potential new rules, the agency's authority to promulgate new rules, and factors that could mitigate harm in the absence of new rules.

Factual Questions:

The ANPR:

• Raises questions about ADM systems' potential shortcomings, including their susceptibility to "algorithmic error" and "algorithmic discrimination," and the prevalence of such errors or discrimination; the extent to which errors or discrimination manifest in critical areas, such as housing, credit, and employment; and how to mitigate harm.
• Raises questions about the reliability of ADM systems, including how much weight organizations assign to automated decisions and whether organizations' reliance on these systems is proportionate to their reliability.
• Seeks information on ADM systems' benefits and the best way to weigh their benefits vs. costs; and asks whether harms or disadvantages arising from the use of these systems violate Section 5 of the FTC Act. The Commission also seeks specific comment on the impact of algorithmic systems on non-English speakers.
• Asks to what extent, if at all, new rules should require companies to take specific steps to prevent algorithmic errors and, if rules are adopted, which steps should be required. The ANPR also asks to what extent, if at all, the Commission should require firms to evaluate and certify that their reliance on automated decision-making meets clear standards concerning accuracy, validity, reliability, or error.

Legal/Policy Questions:

The ANPR:

• Asks to what extent, if at all, new rules should forbid or limit the development, design, and use of automated decision-making systems that generate or otherwise facilitate outcomes that violate Section 5 of the FTC Act.
• Seeks data reflecting how restrictions on ADM systems would affect product access, product features, product quality, or pricing. The ANPR also asks what alternative forms of pricing companies would utilize if ADM were restricted.
• Also asks for legal theories and arguments in favor of prohibiting the use of ADM systems in targeted advertising, including those addressing whether the First Amendment or Section 230 of the Communications Act bar the FTC from promulgating or enforcing prohibitions in this area.

Discrimination Based on Protected Categories

In addition to the broader ADM-focused questions referenced above, the ANPR also raises questions specific to "algorithmic discrimination" based on protected categories.

The ANPR:

• Begins by asking about the prevalence of what the FTC characterizes as so-called algorithmic discrimination based on protected categories (race, sex, age, etc.), and whether the harm arises more frequently in certain sectors than others. The ANPR also raises the idea that the Commission could look at unprotected classes. 
• Raises questions about the direct and indirect impact of alleged algorithmic discrimination on consumers, and the extent to which algorithmic discrimination might stifle innovation or competition.
• Seeks input on how to address discriminatory algorithms that currently exist and how to formulate guidance or rules for the use of algorithmic systems either in certain sectors or all sectors broadly.
• Asks how the Commission should address algorithmic discrimination and whether it should consider new trade regulation rules that bar or limit the deployment of any system that produces disparate outcomes, irrespective of the data or processes on which those outcomes are based. If such a regulation is implemented, the FTC asks, which standards should the Commission use to measure or evaluate disparate outcomes.
• Also asks whether such rules are necessary or appropriate in areas where Congress has already passed legislation, such as housing, employment, labor, and consumer finance. The Commission asks whether it alternatively should consider rules addressing potential discrimination in all sectors.
• Invites comment on how the Commission should analyze "proxies" for protected characteristics, which is a term and phrase that has started to emerge in conversations about algorithms, targeted advertising, etc. 

Biometric Information

In addition to several other areas of interest (including targeted advertising, health data, and children's privacy), the ANPR questions the use of biometric information.

The ANPR seeks information on the collection, use, and transfer of biometric data, including the types of biometric data collected by companies. For what purposes is such information being collected? Are consumers aware of such collection? What are the benefits and harms of these practices? 

The ANPR also asks whether and how the use of facial recognition, fingerprinting, or other biometric technologies should be limited. 

Conclusion

The questions posed by the FTC in its ANPR demonstrate an awareness of the recurring policy and legal questions that arise in conversations about AI and potential methods of regulating ADM systems. Many of the questions raised in the ANPR concern issues—such as transparency and discrimination—that federal, state, and local policymakers focus on in other proposed legislation or regulations.

The FTC indicated in a December 2021 announcement that algorithmic discrimination was going to be a primary focus of its ANPR, and the depth and breadth of the questions the ANPR raises demonstrate the seriousness with which the Commission has focused its efforts.

With that said, the Commission is at the information-gathering stage, and has not indicated that it supports one method of regulation over another, or even whether any new regulations in this space are warranted. Accordingly, companies that may be impacted by regulations on the development and deployment of AI systems should strongly consider submitting comments to the FTC.