Given the inability of the U.S. Congress to pass a comprehensive privacy law (such as the proposed and likely dead-on-arrival APRA), the United States continues to be left with a patchwork of sector-specific laws and a handful of state comprehensive privacy laws. The implementation details of federal sector-specific privacy laws are often left to various agencies. But the Supreme Court's decision on June 28, 2024 to curtail the power of federal agencies to interpret such laws and issue regulations puts the privacy rules under these laws in question. While the effects of the decision on privacy are still unclear, here are a few potential impacts:
FTC: The Federal Trade Commission (FTC) has long been tasked with enforcing and developing regulations around various privacy laws, such as the Children's Online Privacy Protection Act (COPPA), the Fair Credit Reporting Act (FCRA), The Telemarketing Sales Rule (TSR), the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM Act), and (together with the Department of Transportation) the newly-adopted EU-U.S. Data Protection Framework. Together with various other banking agencies, the FTC is also responsible for enforcing and drafting regulations around the Gramm-Leach-Bliley Act (GLBA).
FCC: The Federal Communications Commission (FCC) enforces various laws and develops regulations related to telecommunications, such as the Telecommunications Privacy Act (TCPA) and the Communications Act (which, among other things, protects sensitive data related to the use of telecommunications systems by consumers, such as customer proprietary network information data).
OCR: The Office of Civil Rights under the Department of Health and Human Services enforces and creates regulations around the Health Insurance Portability and Accountability Act (HIPPA).
SEC: The Securities and Exchange Commission develops regulations regarding the use of securities and other investments, including its new cybersecurity regulations.
On the other hand, the decision probably does NOT affect the ability of state agencies to draft and enforce regulations, such as the California Privacy Protection Agency (CPPA).
It's possible, and maybe even likely, that regulations adopted by federal agencies related to the privacy of consumer information could be subject to challenge and/or inconsistent application in the courts without the Chevron deference. While some businesses may cheer this potential reduction in regulations, for many it is likely to lead to uncertainty, and potentially an inefficient allocation of resources trying to adhere to regulations that may or may not be interpreted the way a business thinks it will be.
In a major ruling, the Supreme Court on [June 28, 2024] cut back sharply on the power of federal agencies to interpret the laws they administer and ruled that courts should rely on their own interpretion of ambiguous laws. The decision will likely have far-reaching effects across the country, from environmental regulation to healthcare costs.
By a vote of 6-3, the justices overruled their landmark 1984 decision in Chevron v. Natural Resources Defense Council, which gave rise to the doctrine known as the Chevron doctrine. Under that doctrine, if Congress has not directly addressed the question at the center of a dispute, a court was required to uphold the agency's interpretation of the statute as long as it was reasonable. But in a 35-page ruling by Chief Justice John Roberts, the justices rejected that doctrine, calling it "fundamentally misguided."
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.