A leadership change at the Federal Trade Commission (FTC) may spell relief for U.S. businesses grappling with the agency’s enforcement measures amidst an increasingly dangerous cybersecurity landscape. On January 25, 2017, President Donald Trump named Commissioner Maureen Ohlhausen acting Chairman of the FTC. Ohlhausen has served at the agency in various capacities for more than a decade, and is now the lone Republican remaining on what will soon be a two-member commission, after former-Chair Edith Ramirez’s announced resignation. When Ramirez leaves the agency on February 10th, only Ohlhausen and Commissioner Terrell McSweeney (Democrat) will remain at the helm with three vacant commissioner seats for President Trump to appoint. 

Ohlhausen’s appointment may signal a shift in the FTC’s enforcement philosophy and priorities, particularly as it pertains to privacy and data security regulations. "She will hit the ground running and begin right away to change the agency's priorities so that they align more closely with her own priorities," former FTC Commissioner Julie Brill said. "In the cybersecurity and privacy realm, I believe acting Chair Ohlhausen will be more exacting in her standards for enforcement actions, ensuring that any case that moves forward is founded on demonstrable and tangible harms."

In past presidential administrations including Clinton, Bush, and Obama, the FTC has widely been considered the nation’s leading privacy and data security regulator. However, Ohlhausen is expected to shift the commission’s focus from the allegedly deceptive trade practices that the FTC has historically enforced towards more identifiable, tangible harms suffered by consumers. 

The FTC primarily brings its enforcement actions in the privacy and data security sector under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), which provides the agency authority to police unfair and deceptive trade practices. Pursuant to this provision, the FTC has prosecuted entities that have made allegedly untrue or misleading statements about their privacy and data security practices. Ohlhausen, appointed by Barack Obama as a commissioner in April 2012, has been a consistent critic of government regulation, including the Federal Communications Commission’s net neutrality rules. According to Ohlhausen, the primary function of the FTC is to “preserve America’s true engine of prosperity: a free, honest, and competitive marketplace . . . .” She has repeatedly espoused the need to challenge abuses of government process and to promote economic liberty; believing that the FTC should use “a philosophy of regulatory humility . . . and be mindful of the private and social costs that government actions inflict.” 

Ohlhausen’s record on the commission suggests that she will require a showing of tangible harm in order to pursue entities under Section 5’s unfairness prong. This would be a substantial shift from her predecessors, who have used their authority to investigate companies that have harmed consumers through “unreasonable” data security practices. The “tangible harm” requirement Ohlhausen has long advocated for would establish a higher threshold of harm in order for the FTC to commence an investigation or initiate a lawsuit against an entity. This is a marked departure from the agency’s previous enforcement of data privacy and security practices, which has routinely investigated and prosecuted claims that present a potential threat to consumers, whether realized or not. 

During Ohlhausen’s tenure on the commission she has often dissented on suits involving alleged harms that she felt were intangible or insufficient. The most recent example is her dissent to the FTC’s complaint against computer network manufacturer D-Link Corporation, wherein the FTC alleged that the company put its consumers’ privacy at risk through its failure to properly secure its wireless routers and internet protocol cameras. Ohlhausen has also recently dissented on a $20 million settlement with Uber, accused of enticing drivers with false earning expectations, and dissented from the decision to file suit against Qualcomm for allegedly using its market power to maintain a monopoly on critical semiconductors. 

In a speech to the Heritage Foundation on the evening before her appointment as chairwoman, Ohlhausen outlined her vision of the FTC and opportunities for the agency under Trump’s administration. In a sign of how she may run the agency, Ohlhausen reaffirmed her “evidence-based solution to all issues” and spoke against the pervasive “tentacles” of regulation “impos[ing] unnecessary and disproportionate costs on business.” In practice, the FTC under Ohlhausen would likely revise its approach to intervention decisions and narrow the scope and expense of the compulsory process itself. 

It is unclear whether Ohlhausen will be offered the chairmanship permanently. Other news sources have reported that Peter Thiel, the billionaire venture capitalist and Facebook board member, is leading the Trump administration’s search for a permanent chair. Ohlhausen will not need to be re-nominated to serve on the FTC until September 2018.