Commissioner Ohlhausen voted to approve issuance of the staff report, but objected to the report’s call for new baseline privacy legislation:
I do not support the recommendation for baseline privacy legislation because I do not see the current need for such legislation. The FTC’s Section 5 deception and unfairness authority already requires notice and opt-in consent for collecting consumers’ sensitive, personally identifiable information. It also protects against uses of personal information that cause substantial, unavoidable consumer harm not outweighed by benefits to consumers or competition. Furthermore, sector-specific laws, such as FCRA, provide additional protections for consumers. Thus, I question what current harms baseline privacy legislation would reach that the FTC’s existing authority cannot.
And to the staff report’s embrace of data minimization, one of the core Fair Information Practice Principles developed in the mid-70s:
I am concerned that the report’s support for data minimization embodies what scholar Adam Thierer has called the “precautionary principle,” and I cannot embrace such an approach. The report, without examining costs or benefits, encourages companies to delete valuable data – primarily to avoid hypothetical future harms. Even though the report recognizes the need for flexibility for companies weighing whether and what data to retain, the recommendation remains overly prescriptive.