FTC Firings Create Uncertainties for EU-US Data Flows, Agency Rules

The FTC firings mean that states must lead on privacy, according to Connecticut AG William Tong (D). “There’s nothing partisan about privacy enforcement,” he said in a statement emailed to us Wednesday. "Just look at every one of our data breach settlements stretching back for the past decade. All bipartisan, with every state and territory actively engaged to protect consumer privacy and the security of our personal information. This is just one more area where states are going to have to keep leading regardless of whatever is happening in Washington.”

The "illegal firing of the two Commissioners is extremely concerning," California AG Rob Bonta (D) said in a statement. In an email to Privacy Daily, a spokesperson added that Bonta "is committed to using the full force of our office to enforce state and federal privacy laws. California was the first state to pass a comprehensive consumer privacy law ... and will continue to lead the nation in privacy enforcement."

“The attack on the independence of the FTC is an attack on consumers and will undermine the work of this important agency," Colorado AG Phil Weiser (D) said in an emailed statement Wednesday. "We will be supporting the lawsuit challenging these illegal firings and will always stand up for consumers.”

Steven Robinson, former chief privacy officer of Ricoh USA, said in an email, "The Trump Administration's firing of the Democratic members of the FTC, following soon after its termination of Democratic members of the [Privacy and Civil Liberties Oversight Board], may raise fresh concerns among privacy regulators in the EU, the U.K., and other countries that rely on the EU-U.S. Data Privacy Framework (DPF) to protect the personal data of their citizens transferred to the United States." Ex-PCLOB members sued Trump over their firings (see 2502250052).

The EC's adequacy decision concerning the DPF expressly states that to be eligible for self-certification, organizations must be "subject to the investigatory and enforcement powers of the Federal Trade Commission," among other federal agencies, Robinson noted. The removal of Democrats from the FTC, the primary federal privacy regulator for U.S. businesses, "particularly on grounds that are subject to legal challenge and may appear partisan, may undermine Europeans' confidence in U.S. oversight mechanisms critical to the DPF," he said.

Also, the removal of independent federal regulators may lead European authorities to question the U.S. commitment to maintaining the necessary oversight for adequate protection of Europeans' personal data transferred in reliance on the DPF, Robinson said. "These developments could trigger earlier judicial challenges to the DPF in Europe, accelerate the EC's reassessment, or both: It will be interesting to see how [Austrian privacy activist and EU lawyer] Max Schrems, European privacy regulators, and the U.S. business community react to this development."

The firings could sound "the death knell" for trans-Atlantic personal data transfers, privacy lawyer and professor Daniel Solove posted on Bluesky Tuesday. "If the EU sticks to its principles," data transfers might not even be permitted under standard contractual clauses, "creating a massive impact on commerce."

Privacy advocates will be watching to see if the Republican majority now acts on two privacy items. The FTC under Democratic now-former Chair Lina Khan launched a potential comprehensive privacy rulemaking in August 2022. Khan’s commission also finalized rules for the Children’s Online Privacy Protection Act (COPPA), but those are in limbo after the Trump administration halted all pending rulemaking under a regulatory freeze (see 2501230053). Some are questioning whether any 2-0 FTC decisions from the new majority will hold up in court.

The quorum issue hasn’t been litigated, but there’s relevant precedent, said John Villafranco, an attorney who handles FTC compliance issues at Kelley Drye. He noted that during the last weeks of the Obama administration in 2017, the commission voted out its Quincy Bioscience complaint with Chair Edith Ramirez (D) and Commissioner Terrell McSweeney (D) voting aye and Commissioner Maureen Ohlhausen (R) recused.

An FTC official said Wednesday that the commission “can function with two commissioners,” citing that 2017 vote. Chairman Andrew Ferguson said in a statement Wednesday: “Trump is the head of the executive branch and is vested with all of the executive power in our government. I have no doubts about his constitutional authority to remove Commissioners, which is necessary to ensure democratic accountability for our government. The Federal Trade Commission will continue its tireless work to protect consumers, lower prices, and police anticompetitive behavior.”

The Trump administration is seeking U.S. Supreme Court reversal of Humphrey's Executor v. U.S., a unanimous 1935 high court decision that set a precedent preventing the president from firing members of the FTC. If the Trump administration must “fight it all the way to the Supreme Court, we certainty will," said White House Press Secretary Karoline Leavitt on Wednesday.

Bedoya and Slaughter have vowed to fight their firings. Slaughter, in a statement, said that her dismissal violated “the plain language of a statute and clear Supreme Court precedent.”

Assuming Bedoya and Slaughter “refuse to leave,” it’s “highly unlikely” the commission will recognize their votes, said Villafranco. Every decision after that will be subject to legal challenge, especially with FTC nominee Mark Meador awaiting Senate confirmation. Even after Meador is confirmed, all potential votes “will be clouded” until the Supreme Court rules, he said.

Establishing a quorum at FTC isn’t an issue, said Stephen Calkins, a former FTC general counsel now teaching at Wayne State University Law School. The question will be how quickly a court can enjoin any 2-0 decisions and if the agency wants the added risk of legal challenges, he said.

Trump’s goal seems to be seizing greater control over “what he perceives to be the president’s domain” within the executive branch, said D. Reed Freeman, partner and co-chair of ArentFox Schiff’s privacy and data security group. In light of the Supreme Court’s decisions in AMG Capital Management and Loper Bright, the court is trending in the direction of further “reining in agencies,” he said: A reversal of Humphrey’s Executor wouldn’t be too surprising (see 2502200060). There’s now a broader issue concerning how much of a “chilling effect” it might have on agency independence, said Freeman.