Does Data Privacy Need its Own Agency?

If Congress passes comprehensive privacy legislation, it will need to delegate a federal agency to enforce the law and conduct rulemaking. The Federal Trade Commission (FTC) has used its general consumer protection authority to bring enforcement actions against companies violating user privacy, and has therefore been considered the de facto privacy agency. However, three bills have challenged this assumption and would create a new agency to enforce privacy law rather than relying on the FTC. This report compares the new agencies in three legislative proposals to one another and to the FTC. The two models—FTC or new agency—are compared on six metrics: statutory authority, budget and personnel, independence, resistance to regulatory capture, effectiveness of enforcement, and feasibility. This report seeks to evaluate the strengths and weaknesses of different enforcement agency approaches.