Explainer: Privacy Bill Draft May Violate “Major Questions Doctrine”
Background: In West Virginia v. EPA, the Supreme Court held that the EPA did not have the statutory authorization from Congress to concoct its own plan to combat climate change. As the Court explained, because Congress hadn’t directly (or even indirectly) delegated that power to the agency, the agency’s proposed rule capping carbon emissions triggered the “major questions doctrine.”
Under the major questions doctrine, the Court scrutinizes statutes closely to avoid a “recurring problem: agencies asserting highly consequential power beyond what Congress could reasonably be understood to have granted.”
In plain English, the Court’s major questions doctrine instructs that Congress—not agencies—must make policy decisions on major issues affecting the economy. So unless Congress gives clear statutory authorization and clear statutory commands, agencies risk regulating with authorization—in other words, they risk acting unlawfully.
A major question is one of “political significance” or one that’s likely to ignite or weigh in on “earnest and profound debate across the country.” Federal privacy legislation, as even Congress acknowledges, is a matter of political significance. And as disagreements already show, any privacy law will ignite earnest and profound debate—some Americans want total privacy and no online data collection; others are comfortable with far less; and still others want different policies depending on the data collector’s identity and the data’s use.
Why It Matters:
● Under the major questions doctrine, anyone may challenge an agency rule on the grounds that it’s a major issue and that Congress did not explicitly authorize the agency’s actions to address that issue.
● Not all challenges will succeed. But the proposed Three Corners Privacy bill risks violating the doctrine.
Impact on Three Corners Privacy Bill:
● The bill gives the FTC rulemaking authority on privacy matters under its “unfair or deceptive act or practice” (known as Section 5) power. That language is itself incredibly broad and unclear—what’s “unfair” or “deceptive”? And under Chairwoman Khan, the FTC voted 3-2 to rescind its own historically rooted, bipartisan interpretation of those terms, meaning the agency is now acting entirely on its own—without clear commands from Congress. Should this bill pass, the privacy rulemaking provision risks invalidating not just the privacy law but also the FTC’s Section 5 power.
● The bill also includes unclear terms—meaning, any attempt to regulate based on those unclear terms risks violating the major questions doctrine. For example, the bill grants the FTC broad, unbounded policymaking discretion to regulate “privacy by design” (Section 103). That section imposes countless mandates—few clear. What, for example, counts as “reasonable training and safeguards”?
● Section 103 also requires the FTC to issue “guidance” explaining what “reasonable policies, practices, and procedures” include. But it fails to actually explain what policies the FTC is actually authorized to advance. Instead, it leaves it to the agency to define reasonable, which means the FTC could pursue any privacy policy so long as it labels it “reasonable.” Given the stakes—data is a major driver of economic growth and innovation; privacy is highly personalized and of significant importances to the public—this language is likely too vague to pass muster under the major questions doctrine