A federal judge in the U.S. District Court for the District of Columbia agreed earlier this month to fast-track a lawsuit by a privacy group against the Federal Trade Commission, arguing that the FTC has failed to enforce the terms of a settlement agreement it reached with Google last year after the FTC accused Google of violating privacy regulations in the launch of Google Buzz.
Last year, Google and the FTC agreed on a settlement stemming from allegations that Google violated its own privacy promises to consumers when it launched its social network, Google Buzz. That investigation began with a complaint filed by the Electronic Privacy Information Center (EPIC), the same group that is the plaintiff in this current case. EPIC is not suing Google and was not a party to the settlement reached between Google and the FTC. At the time of the settlement, the FTC said it “bars the company from future privacy misrepresentations, requires it to implement a comprehensive privacy program and calls for regular, independent privacy audits for the next 20 years.”
On February 17, the FTC filed a memorandum in opposition to the EPIC suit and a motion to dismiss it. The agency asserted that EPIC has no legal ground for its attempt to compel it to enforce the settlement and that the lawsuit “seeks to deprive the Commission of the discretion to exercise its enforcement authority.”
Earlier this week, more than 30 state attorneys general wrote to Google CEO Larry Page saying that the new Google policy forces consumers to allow information to be shared across several forums without the ability to opt out or choose their preferences for how their personal information is used. The letter also points out that Google has become known as a company that put a premium on the offering users choice in the use of their information, but now that information is being “held hostage.”
EPIC alleged in its complaint that Google has misrepresented its intention to use combined data for behavioral advertising. EPIC also alleges that the agreement gives the FTC the power to stop Google from making the planned privacy changes and that Google’s new policy requires the users’ consent. A key issue in the protests against the new policy had been that account holders will not be able to opt out of it.
A key issue in this case will be whether EPIC, a non-party to the agreement, can force the FTC to take action against Google. EPIC did not bring this action under the Federal Trade Commission Act, which is the source of the vast majority of FTC enforcement actions. Instead, this suit was brought under a section of the Administrative Procedures Act allowing challenges to agency action that is “unlawfully withheld.”
There may be strong precedent against EPIC in this case. The Supreme Court stated in 1985 in Heckler v. Chaney that “an agency decision not to enforce often involves a complicated balancing of a number of factors which are peculiarly within its expertise . . . The agency is far better equipped that the courts to deal with the many variable involved in the proper ordering of its priorities.”
Although EPIC brings an interesting argument, it is not likely to prevail. However, with the ability of Google to unilaterally enforce its privacy changes against users and Congress and the FTC failing to take action to protect consumers, it becomes unclear who will stand up to protect privacy interests of consumers. We will continue to follow any new developments in this case.