854 JEFF FLAKE ARIZONA SR-4 13 Rus!;tU StNA n Ot fl< Ei B~·llOINO (202) 224 4521 COMMITTEE ON FOREIGN RELATIONS COMMITIEEON ENERGY AND NATURAL RESOURCES COMM TTEE ON THE:: JUDICIARY COMMITTEE ON AGING Chairman Tom Wheeler ~nitcd ~tatcs ~cnatc WASHINGTON. DC 2051Q-0305 October 13,2016 Federal Communications Commission 445 121h Street, SW Washington, DC 20554 Dear Chairman Wheeler: stArl OH ltl< 2200 EAST CAMElflACK ROAD SUITE 120 PHOENIX. AZ S&Qib I602184G-1891 6840 NORTH ORACLE ROAD SUITE 150 TUCSON. Al. S!f/04 15201575-8633 I write regarding the FCC's proposed final privacy rules and the agenda for the agency's planned Open Meeting on October 27, 2016. On October 6, you issued a "fact sheet" on the proposed privacy rules. According to the fact sheet, the privacy rules will be substantially changed in their next iteration. Most relevant to my purposes, the fact sheet appears to describe final rules that will broadly resemble the FTC privacy framework. Rather than requiring a near-blanket opt-in requirement for the marketing use ofiSP data, it seems the proposed rules will be based on the sensitivity of the information in question. This is a step in the right direction. I am pleased to see that you have decided to align the FCC's privacy proposal with the established framework ofthe FTC. As I said during the hearing I chaired on this proposed rule last May, "the FTC ha[s] successfully enforced privacy against broadband providers. Except for the [FCC's] net neutrality order, the FTC would still be doing that. ... many wonder what justifies the new proposed rules, which are a significant deviation from the FTC's approach and more burdensome as well." At that same hearing I asked FTC Chairwoman Ramirez if ''the FTC's privacy protection regime over the years has been sufficient to effectively protect consumers' rights as it relates to ISPs?" Her response was, "I think the Federal Trade Commission has done a very effective job in addressing consumer primacy and ensuring that consumer information is appropriately safeguarded." Indeed, as I identified to the Commission in comments submitted in June, the NPRM's proposed rules had serious constitutional deficiencies in significant part due to the effective and less-restrictive privacy regime currently in place at the FTC. It is good to see the FCC seem to move in the FTC's direction. Nevertheless, the devil is always in the details. While the proposed changes presented in the fact sheet look like a substantial improvement over the original NPRM, it's not clear yet what the actual Order will entail. These new proposed rules will need to be fully vetted from both a policy and a constitutional perspective. Due to FCC rules, I'm told that no one outside the Commission has seen the proposed Order. Given the significant and material differences between the current proposal and the NPRM, it is essential that all stakeholders be given an opportunity to review and comment on the current proposal before the Commission votes on it. http://www.scnato.gov/Fiakc PRINTED ON RECYCLED PAPER When the NPRM was under consideration you told me at our subcommittee hearing that there would be "a filling-up record ... a voluminous record on this." Given the changes indicated between the NPRM and the contemplated Order, I think it only best that a similar "voluminous" record be established before we dive into this new regulatory regime. The continued vibrancy of the Internet is too important for the FCC to rush into this rulemaking in a slapdash manner. I therefore ask that you postpone any final vote on the privacy Order and notice this new proposed rule for comment. Sincerely, U.S. Senate Committee on the Judiciary Subcommittee on Privacy, Technology & the Law JEFF FLAKE A RIZONA SR-413 RUSSELL SENATE OFFICE BUILDING (202) 224-4521 COMMITIEE ON FOREIGN RELATIONS COMMITIEEON ENERGY AND NATURAL RESOURCES COMMITIEE ON THE JUDICIARY COMMITIEE ON AGING Chairman Tom Wheeler tinitro ~tatrs ~rnetr WASHINGTON, DC 20510-0305 October 24, 2016 Federal Communications Commission 445 121h Street, SW Washington, DC 20554 Dear Chairman Wheeler: STATE OFFICES: 2200 EAST CAMELBACK ROAD SUITE 120 PHOENIX. AZ. 85016 (602) 84Q-1891 6840 NORTH ORACLE ROAD SUITE 150 TUCSON, AZ. 85704 (520) 575-8633 I write regarding the FCC's proposed final privacy rules. As you recall, I wrote to you on October 13 requesting that these proposed final rules be published for further notice and comment. While I am waiting for a formal reply to my letter, it is my understanding that you will not be accommodating my request to provide for a deliberative process and that the Commission will instead forge ahead with the vote on a final rule on October 27, 2016. This is unfortunate. Nevertheless, since the Commission will be voting soon on a final rule, I wanted to more fully express my serious concerns with the bare-boned sketch of the order that has been presented to the public so far in your October 6 "fact sheet" and blog post. As I noted in my prior letter, there are aspects of your new proposal that are encouraging. The FTC's approach to data privacy has worked, so it's good to see the FCC acknowledge that and take steps in that direction. The problem is that the FCC-from what the fact sheet says; again, we won't know for sure until the rules are actually in place- seems to be going significantly beyond the actual FTC approach. I believe this departure from the FTC's privacy regime will create significant legal and policy problems for the Commission. However, most importantly, these final rules are a threat to the continued dynamic development of the Internet. As I explained at length in comments to the Commission last May, the proposal in the NPRM was riddled with constitutional problems. I believe the Commission's planned position fail s all three elements of the Central Hudson test, thereby making it an unconstitutional restriction on commercial speech. Under Central Hudson, the final question in testing a commercial-speech restriction is whether the action " is no more extensive than necessary to further the State's interest. ... " There must be "a fit" between the end and the means. Given the differences between the FCC and the FTC' s approach to the sensitivity of data- in particular, the FCC' s inclusion of web browsing history as well as app usage history in the category of sensitive data- the FCC's regulations are undoubtedly more restrictive than the FTC's approach. There is insufficient evidence that ISP use of these two additional categories of sensitive data is, or will be, different than those regulated under the FTC's privacy regime. Given the FTC's longstanding, successful, and less restrictive protection of consumer privacy, it' s not clear that this new proposed FCC regime passes constitutional muster. http://www.Fiake.senate.gov PRINTED ON RECYCLED PAPER Leaving aside the legal concerns with treating ISP data differently from the data protected by the FTC, it' s also bad policy. The inclusion of web browsing and app usage in the FCC's category of sensitive information will result in arbitrary competitive advantages and disadvantages within the space of online advertisement. This only favors established market actors and is bad for both competition and consumers. It' s also confusing. Internet users will have different expectations of privacy; when they share information on the edge, it will be FTC rules, while that same information will be under different FCC rules as it travels across their wire or data plans. In the end, I am concerned that this confusion will result in greater government control of the Internet and the data economy. As a stakeholder noted in a recent letter to the Commission, "a categorical distinction between web browsing information and other information" is "a novel and untested approach [and) would unnecessarily increase regulatory burdens on the Internet." Indeed, I agree with Commissioner Pai in his dissent from the NPRM, when he noted that the "disparate privacy regime" between ISPs and other participants in the Internet ecosystem " is simply a political choice." The contemplated order by the FCC lays the groundwork for future political choices- by it and the FTC- to synchronize privacy regulations across platforms, but to do so according to the more stringent opt-in regime currently contemplated by the FCC. The FCC seems all too ready to impress upon the Internet a "novel and untested approach" regardless of the consequences it will have on the future of the Internet. It 's unfortunate that others and I are left making these arguments in the dark. We can guess what these final rules are going to do by parsing the NPRM in light of a blog post and fact sheet. But reading what we have in the way of tea leaves, the omens are bad. I urge you, at a minimum, not to deviate from the FTC's effective and established approach to consumer privacy as you enact your final order. - U.S. Senate Committee on the Judiciary Subcommittee on Privacy, Technology & the Law