In a keynote address at the International Association of Privacy Professionals' Global Privacy Summit in Washington, D.C., the Republican commissioner laid out three of her top data privacy priorities: the regulation of AI technology, boosting protections for children and teens online, and strengthening enforcement against companies that sell, transfer or disclose Americans' geolocation information and other sensitive data to foreign adversaries.
"The commission is committed to protecting consumers' privacy and security interests while promoting competition and innovation," Holyoak said in her remarks, which she stressed expressed her own views. "We'll do that by enforcing the laws we have and not by stretching our legal authorities, and we'll continue to do it by taking a flexible, risk-based approach to privacy enforcement that balances potential privacy harms, consumer expectations, legal obligations, business needs and competition."
When it comes to the rapid development of AI and other digital technologies that are fueled by vast quantities of consumer data, Holyoak said that the commission — which is currently being steered by three Republicans, following the abrupt firings of the agency's two Democrats last month — would continue to "aggressively root out AI-powered frauds and scams and stop companies from making false or unsubstantiated representations that harm consumers."
However, Holyoak also urged caution, saying that she saw the fast pace of these new technological developments as presenting "opportunities" rather than challenges for policymakers, enforcers and compliance professionals to forge a path forward that protects consumers while still allowing for "innovation to flourish."
"With artificial intelligence, the commission should create a predictable regulatory and enforcement environment that promotes innovation and development of new technologies," Holyoak said in her speech, which marked the first on data privacy issues since Republican Chairman Andrew Ferguson took over three months ago. "Under the leadership of Chairman Ferguson, the commission will promote AI growth and innovation, not hammer it with misguided enforcement actions or excessive regulation."
In order to strike an appropriate balance, Holyoak repeatedly stressed the importance of the FTC studying "this nascent industry and how privacy enforcement and regulations may impact its development."
The commissioner noted that she supported the use of the agency's Section 6(b) authority to issue a report on AI partnerships and investments in the waning days of the prior Democratic administration "because it advanced our knowledge of some of the commercial dynamics shaping AI's evolution" and that she saw additional opportunities moving forward to further strengthen the agency's understanding of AI, including taking a closer look at "how regulatory and enforcement efforts in privacy may impact a firm's ability to access and train data, and importantly, how they impact the firm's ability to compete."
As an example, Holyoak explained that while requiring consent for using certain types of data in some instances may "level the competitive playing field by requiring the same level of privacy protections across the board," establishing a mandate for affirmative consent from users for data collection or use "may actually favor dominant players, because users are more familiar with big firms, and thus may have more trust in how those firms will collect or use their data."
The commissioner also encouraged privacy professionals to respond to recent requests for information issued by the FTC and U.S. Department of Justice to help the agencies identify potentially anticompetitive regulations at the state and federal level, noting that there have been more than 500 AI-related bills introduced in the states and that this public input "will help us understand the different regulatory burdens for firms and whether those burdens create barriers to new entrants and competition."
Holyoak, a mother of four and former solicitor general of Utah, also drew from her personal experience in stressing the ongoing importance of ensuring that children are protected online and that Americans' sensitive information isn't ending up in the hands of foreign adversaries.
She urged the commission to continue to use "every tool that Congress has given" it to protect underage internet users, including its authorities under the Children's Online Privacy Protection Act and its power to police both deception and unfair practices that are "grounded in sound economic theories of harm and reliable empirical research" under Section 5 of the FTC Act.
Additionally, the commission should be careful to not overlook the practice of foreign adversaries buying Americans' sensitive information in bulk from data brokers, according to Holyoak, who suggested that "there may be opportunities" in the future for the commission to partner with the DOJ as it enforces its recently enacted rules to prevent China, Russia, Iran and other foreign entities from exploiting Americans' sensitive personal data through commercial transactions.
"Precise geolocation data is particularly sensitive and can reveal our religious beliefs, our political affiliations and even medical conditions and treatment," Holyoak said. "This information can be exploited and poses significant, and frankly unacceptable, risks to our national and economic security."
--Editing by Jay Jackson Jr.
For a reprint of this article, please contact reprints@law360.com.
