Conclusion

In this report, we have endeavored to use six metrics—authority, independence, resistance to regulatory capture, effectiveness of enforcement, budget, and feasibility—to assess proposals for an expanded FTC or a new DPA to enforce a new federal privacy law. As these proposals are refined and new ones are introduced, we should continue to use these criteria to measure the strengths and weaknesses of each option. Neither the FTC nor a new DPA is inherently a better option across all of the metrics we have identified. Moreover, members of Congress can take steps to design solutions to optimize a proposal’s performance on each of these standards.

Given the importance of digital privacy to civil rights,¹ commerce,² and self-determination,³ the question of which agency will enforce a national privacy regime cannot and should not be taken lightly. As Congress considers the various comprehensive privacy bills, members should consider the different factors that affect optimal agency design for the enforcement of a federal privacy law.