EPIC Sues FTC to Compel Enforcement of Google Privacy Order

February 8, 2012. The Electronic Privacy Information Center (EPIC) filed a complaint [9 pages in PDF] in the U.S. District Court (DC) against the Federal Trade Commission (FTC) alleging that the FTC has failed to enforce its Decision and Order [7 pages in PDF] dated October 13, 2011, which relates to Google's privacy related practices.

The EPIC seeks "injunctive relief compelling the FTC to enforce the consent order". The EPIC wants the FTC to block Google from implementing parts of its new privacy policy, scheduled to take effect on March 1.

The complaint does not name Google as a defendant.

The EPIC alleges that Google's pending changes to its privacy policies violate the October 13 order, that the FTC has failed to take action to prevent such violation, and that the District Court should compel the FTC to take action against Google, before March 1.

The EPIC states in its complaint that "Rather than keeping personal information about a user of a given Google service separate from information gathered from other Google services, Google will consolidate user data from across its services and create a single merged profile for each user."

Consequently, the EPIC alleges, "Users will no longer be able to keep the personal information they provided to use the Google email service for simply that service; Google will be able to combine the user information provided for email with other Google services, including the Google social network service."

The complaint alleges that this violates the order by "misrepresenting the extent to which it maintains and protects the privacy and confidentiality of covered information", by "misrepresenting the extent to which it complies with the U.S.-EU Safe Harbor Framework", by "failing to obtain affirmative consent from users prior to sharing their information with third parties", and by "failing to comply with the requirements of a comprehensive privacy program".

Whether Google has violated the order constitutes one set of issues. However, the EPIC faces a range of other obstacles, such as whether it has standing to bring this action, whether there is a justiciable final agency action, whether there is a case or controversy within the meaning of Article III of the Constitution, whether this is a matter committed to agency discretion, and whether the FTC can be compelled to enforce this order.

The EPIC also filed a Motion for Temporary Restraining Order and Preliminary Injunction [30 pages in PDF] with the District Court on February 8. The District Court set accelerated pleading deadlines. The FTC's opposition is due by February 17. The EPIC's reply is due February 21.

The EPIC asserts as authority for the proposition that the District Court can compel enforcement of the order the Administrative Procedure Act (APA), which, at 5 U.S.C. § 706, provides that "The reviewing court shall ... compel agency action unlawfully withheld or unreasonably delayed".

The EPIC does not cite other relevant APA provisions, such as 5 U.S.C. § 704, which provides that judicial review is limited to an "Agency action made reviewable by statute and final agency action".

This case is Electronic Privacy Information Center v. the Federal Trade Commission, D.C. No. 12-00206-JAB, U.S. District Court for the District of Columbia.