Regulations exist to protect citizens and businesses, correct market failures, and make many aspects of our lives easier. They can help give us lower prices due to increased competition, greater peace of mind in saving and borrowing, increased safety in our journey to work, and confidence in the lunch we buy from a local deli.
In recent years, the persistence and scale of technology-induced change have led many to doubt the value and practicality of government regulation. Although this discussion continues, regulators and the regulations they create and enforce still play a critical role—but one that may need to evolve to remain relevant and effective.
In this paper, we examine the challenges that regulators face in our rapidly changing world—from keeping up with technical and business model innovations and the growth in the number of suppliers of goods and services, to dealing with the increasingly digital nature of their constituents and the changing attitudes and behaviors of industries and consumers. We then identify opportunities for leaders of regulatory agencies to navigate today’s challenging landscape and prepare for the future—both in the way they make rules and the way they enforce them. In many ways, regulators can harness the very trends that have caused disruption and use them as a means to modernize regulatory practices and increase effectiveness.
Regulators are on the front lines of nearly every controversy resulting from a new technology—either being told to get out of the way or being called upon for solutions when incidents arise. Data breaches, 3D-printed guns, clashes between taxis and ridesharing services, and many other events that make news headlines also pose real challenges to regulators. In a fast-moving and increasingly complex world, regulators are finding it harder and harder to balance the need to protect citizens and fair markets with the need to avoid impeding innovation.
We see five general trends that are driving this tug-of-war between protection and innovation:
The exponential pace of technological change.1 New technologies that used to have two-year cycle times now can become obsolete in six months, and the pace of change is not slowing. Moore’s Law posits that computer processing power will double every two years, and this exponential rate of increase has also been shown to hold true in industries beyond computing.2 When combined with software that is “eating the world,”3 new technologies can be developed, deployed, and iterated faster than ever. This presents a unique timing challenge for regulatory agencies: Regulate too early and you risk stymieing innovators; wait too long and you risk losing the opportunity to regulate a technology or service before it becomes widespread, potentially harming consumers or markets in the interim. An example of how this trend plays out is the Internet of Things (IoT)—the network of sensor-enabled Internet-connected devices ranging from cars to sneakers to thermostats. A handful of years ago, the microchips needed to enable data collection and wireless communication were cost-prohibitive. Now, these microchips are more cost-effective and are commonly used in connected devices—which presents a privacy challenge for regulators.4 Protecting one’s privacy was previously fairly straightforward: Close the blinds at home, secure documents with personally identifiable information (PII), and be mindful of public conversations. Today, however, an individual might be generating and transmitting data from multiple devices to multiple companies. Each new device in the age of the IoT presents significant challenges to a regulator’s ability to keep citizens’ data secure.
The emergence of new business models.5 By now, most people have heard of the “sharing economy”—an economic system, enabled by communications technologies such as mobile and the Internet, that is built around the sharing of human and physical resources. From a regulator’s perspective, the sharing economy’s peer-to-peer marketplaces disrupt traditional economic transactions. Citizens are able to share cars (through services like Uber and Lyft), residences (through platforms like Airbnb), and even their own kitchens (through mechanisms like EatWith) with their peers. While this provides new job and income opportunities, it creates potential risks to public health and safety. For example, if someone chooses to rideshare to work, is the driver liable if his or her passenger is hurt in an accident? The sharing economy is just one recent example of technologies disrupting traditional business models, and there may be more disruptions ahead as entrepreneurs find new ways of meeting consumers’ needs.
Shrinking barriers to entry for suppliers and buyers.6 Technology has reduced barriers to entry for many aspiring entrepreneurs. Online retail portals let people sell goods without expensive physical retail spaces. 3D printers could further make it easier to sell goods and services by allowing people to create bespoke manufacturing companies. In parallel, many products and services that used to be accessible to only a few are now accessible to the mass market due to advances in technology that have radically reduced these products and services’ cost and democratized access. Take genomic mapping, for example. Sequencing the first ever human genome in 2001 cost $100 million. Now, there are services on the market that can sequence and analyze portions of an individual’s DNA for a small fraction of that amount. This changing landscape presents real challenges for regulators: Not only is the number of services and products they regulate growing, but so is the number of suppliers and consumers.
The “ignore until large” phenomenon. The arguments between startup companies and the established industries they are competing with are ultimately landing at the doors of regulators. The fact that disagreements often escalate illustrates what can be called the “ignore until large” phenomenon, which is an issue for both regulatory organizations and startups. Some startups make a conscious choice to avoid engaging with regulators until they are large enough to have clout, derived either from their growing consumer base and loyalty or from their business success. On the regulators’ side, given how hard it is to monitor the vast number of new startups and market entrants, it is tempting to wait to engage with startups until they are shown to be viable in the market. The problem is that “large” can happen very quickly, and a regulator may not have the luxury of waiting and seeing what happens. Consider Airbnb: In 2008, when Airbnb first started, it seemed like a niche community of people willing to rent a room or to strangers. Fast-forward to today: To date, Airbnb has booked over 30 million nights and is valued at $20 billion.7
The rise of business ecosystems.8 Business ecosystems have been described as “dynamic and co-evolving communities of diverse actors who create and capture new value through both collaboration and competition.”9 These tightly integrated networks of organizations are a shift from the siloed and self-contained corporations of the past. A central aspect of this transition to dynamic and collaborative networks is that firms can begin to “deploy and activate assets they neither own nor control” and engage larger numbers of ecosystem participants.10 Apple® provides an example of how ecosystems can be created. With the announcement of its App StoreSM, Apple provided a platform and user base to app developers while simultaneously benefiting from those same developers’ innovative ideas, investments, and feedback to help make Apple’s own products and services more compelling for consumers.*
Disruptive trends are making it difficult for regulators to achieve their missions. But what if this changing business landscape presented opportunities to help regulators overcome the challenges they face? In the balance of this report, we explore the potential for regulators to embrace the opportunities presented by technical and business model innovation, the increasingly digital nature of their constituents, and industries’ and consumers’ changing attitudes and behaviors to help them meet key challenges across their two main functions: rulemaking (part one) and oversight and enforcement (part two).
* Apple and the App Store are trademarks of Apple Inc., registered in the United States and other countries. The current publication is an independent publication and has not been authorized, sponsored, or otherwise approved by Apple Inc.
Regulators are often the agencies responsible for implementing policy mandates. These mandates can vary from being highly prescriptive to giving regulators great freedom to determine how to implement a policy. In some cases, regulatory agencies have been granted authority by Congress to monitor entire industries, with discretion as to determining how to protect citizens and fair markets.
The business of rulemaking is governed by its own laws and regulations, from the Administrative Procedures Act to approvals of proposed rules by the Office of Management and Budget. All of these processes are designed as a safeguard to protect our citizens while not unduly burdening the regulated businesses or entities.
The process of formal and informal rulemaking is well defined,11 incorporates input from citizens and industry, and can take time. Given the challenges previously described, it becomes essential for regulators to think creatively about their rulemaking activities to meet their policy objectives. In this section, we explore several rulemaking opportunities for the regulator of tomorrow:
“I know no safe depository of the ultimate powers of the society but the people themselves; and if we think them not enlightened enough to exercise their control with a wholesome discretion, the remedy is not to take it from them, but to inform their discretion by education. This is the true corrective of abuses of constitutional power.” —Thomas Jefferson12
In an era of rapid change, trying to identify every possible risk to citizens and markets and then create rules to mitigate them is a tough and probably impossible task. However, regulators can work directly with citizens to cut the time lag between when a new service or product causes harm to a consumer and when a regulator finds out about that harm so that it can inform the evolution of rules and guidance if appropriate. Educational materials, discussions, and question-and-answer sessions can help increase citizen awareness and help them make more educated decisions.
Digital technologies help make outreach at the national level more feasible. Citizens are becoming increasingly digital, with mobile broadband subscriptions expected to grow from nearly 1 billion in 2011 to over 5 billion globally in 2016.13 Online platforms can give regulators a mechanism for capturing citizen and market concerns and points of view at scale.
“I don’t pretend we have all the answers. But the questions are certainly worth thinking about.” —Arthur C. Clarke22
Innovative technologies and new business models can catch regulators off guard, especially when those technologies and business models scale quickly. Without a means to sense the next big thing, regulators risk being perpetually behind, missing opportunities for early engagement with service and product providers as well as early consultation with consumers.
This is why it may make sense for regulators to invest time and resources in monitoring the emerging trends around them. Understanding the disruptions that might be around the corner gives regulators an opportunity to gauge the potential impacts of these trends on their mission. One way to do this is to establish a sensing capability. Sensing is the process of identifying potential developments that could impact a business, either as an opportunity or as a threat. For regulatory agencies, a sensing capability could help identify the next innovation or development in a regulator’s industry or field. Understanding what the horizon looks like can help agencies figure out where to allocate resources.
Trying to come up with rules that keep consumers safe while keeping pace with new technologies can feel like playing regulatory whack-a-mole. Health apps are a good example. A 2013 IMSHealth report found “tens of thousands of health, wellness, and medical apps” available for download from major app stores.27
These apps run the gamut from managing weight loss to tracking glucose levels for diabetes patients. Some apps are seemingly innocuous, allowing users to track their exercise or calorie intake. Others have the potential to cause harm, particularly if users replace doctor supervision with feedback from the app. The Food and Drug Administration (FDA), recognizing this possibility, released guidance documents in 2013 and 2015 outlining its approach to identifying the types of mobile medical apps it intends to regulate and to provide “clarity and predictability” for health app makers.28
Some forward-thinking regulators have navigated similar challenges by providing industry innovators with a clear set of guidelines for developing new offerings. In other cases, industry entities have come up with their own set of standards and principles, which could be adopted by a regulator as the base standard.
Attracting and retaining young talent has long been a challenge for federal agencies. The year 2013 marked a low point, with only 7 percent of federal employees under the age of 3033 while the private-sector workforce had nearly 25 percent under 30.34 Looming Baby Boomer retirements, coupled with chronically low numbers of young workers, put federal agencies at risk of becoming digitally deficient.35
Regulators should consider how they can attract younger talent—or potentially risk being deficient in the skills they need to interpret new challenges and create effective solutions. This is a big question for the Internal Revenue Service (IRS), for example, with over half of its employees over 50 years and only 3 percent of its workforce under 30.36 Research shows that Millennials are motivated by organizations with missions that provide public good,37 creating an opportunity for the IRS and other agencies to rethink their marketing. The IRS website features the slogan “Count on me” and markets directly to recent graduates.38
Some agencies have had better luck attracting young talent into public service. With the establishment of CFPB came resumes from young lawyers inspired by the new agency’s mission. Elizabeth Warren, CFPB’s architect, also influenced her connections from Harvard Law School to take up the cause.39 Perhaps the opportunity to shape a new organization with a mission to prevent financial crises like the one that crippled the job market for many, attracted talent that might have otherwise dismissed a federal job.
Beyond diversifying the average age makeup of regulatory agencies, it is important for regulators to identify which skills will be critical to their mission’s success and recruit to these skills, which are arguably different than their workforce today.
“A variety of studies since the years of public opinion research have demonstrated that people are quite willing express opinions on fictitious objects and events.” —George Bishop, et al.50
Consultation can help the process of rulemaking and lead to better outcomes. It can be used to solicit expert perspectives from both neutral and interested parties to improve regulations, policies, and guidelines so that they are clearer and most likely to lead to the intended results. In cases where there is a real choice to be made between one policy and another, it can also help regulators gain an accurate and balanced appreciation of the citizens’ views.
A formal “notice and comment” process can take up to a year. It commonly involves the preparation of a document and publication in the Federal Register (a daily publication for rules, proposed rules, and notices of the Federal Government) for, say, a 90-day comment period followed by careful analysis of comments. This process can be invaluable in securing insightful perspectives from expert and interested parties to improve the drafting of a proposed rule. However, while the process can be effective for technical input, it is not always the best way to understand the views of citizens. Studies have shown that people express a view even on things they don’t know anything about. For example, in 1986, political scientist Dr. George Bishop and his team asked a sample of Americans for their views on a fictional “Public Affairs Act of 1975” and other similarly fictitious or unknown legislation. They found that 20–40 percent of Americans offered opinions on laws they have never heard of.51
While comment periods can be effective at eliciting input from technical experts and lobby groups, they can also fall prey to highly mobilized campaigns or interest groups dominating the consultation process to further self-interests, promote personal agendas, or to gain notoriety. In spring 2014, the FCC solicited comments on proposed changes to rules impacting net neutrality and received a steady trickle of valuable and expert views from industry organizations, consumer bodies, and academics over its first month. This all changed in early June when John Oliver, a TV comedian, aired a 13-minute sketch on the issue on his late-night news comedy show and encouraged Internet commenters to “Seize your moments, my lovely trolls, turn on caps lock and fly, my pretties, fly.”52 The resulting barrage of comments overwhelmed FCC systems. On the one hand, Oliver’s segment brought national attention to a choice that the FCC needed to make but had hitherto been seen as a highly technical, potentially dry issue that many citizens might typically pass over. On the other, it failed to provide the FCC with a true appreciation of the balanced views of an informed citizenry.
Fortunately, there are other ways that regulators can collect and interpret comments to gain an appreciation of citizens’ views, which can be deployed alongside the notice and comment process.
Innovations that cut across regulatory areas of responsibility are yet another challenge facing regulators. Even if the legally responsible agency is the most logical choice to regulate a new innovation or technology, it may not have all the expertise or perspectives needed to develop the most effective rules.
Regulators can consider two potential models to address complex technologies. One option is to use a “lead agency” model. This approach has one regulatory agency running point for the entire process with supporting agencies functioning as advisors. The lead agency would be responsible for synthesizing all the input to develop its rules. Alternatively, agencies could adopt a “partnership” model. This approach has multiple agencies collaborating to develop rules amenable to them and their constituents. Regardless of which approach an agency chooses, collaboration is a key component of regulating innovations that cut across agency areas of responsibility.
In addition to rulemaking, regulators oversee compliance with the published rules, taking enforcement action when violations occur. Today’s regulators have access to significant amounts of data. Larger data sets combined with increasingly sophisticated analytical tools and the power of the crowd can help regulators better utilize limited resources and reduce the burden of compliance on citizens and business.
This section will explore several oversight and enforcement opportunities for the regulator of tomorrow:
Regulatory inspection is a time-consuming and costly process, and it is prohibitively expensive to monitor everyone. Regulators conduct random inspections, which risks allocating resources disproportionately to non-violators and potentially lets violators make a calculated cost-benefit analysis of the chance of being inspected and determine that any burden of compliance outweighs the potential risks of not complying.
The application of data analytics, however, could improve the return on investment on regulators’ limited investigation resources. Increasing amounts of computing power and cheap storage make it easier than ever to combine and analyze large data sets to identify correlations that indicate potential violations and violators. Regulators may also be able to use data from other government agencies to augment the data they collect from the industry they regulate. Tapping additional data sources can provide new data correlations to identify the warning signs of potential violators. Once potential violators are identified, inspection and enforcement resources can be targeted toward them.
In an era of budgetary constraints and limited resources, regulators may find it difficult to collect all the data they need. However, regulators have a valuable new data source to tap into—data from citizens.
Crowdsourcing data from citizens can occur in two different ways:
For either approach, consider ways to gain access to the data. Gaining access may require negotiation and transparency with the appropriate stakeholders—such as companies that possess the data and citizen interest groups—around how the data will be used. Tapping into these data can provide a more granular level of insight into what citizens and consumers on the ground are experiencing, to better focus limited monitoring and enforcement resources.
“Information wants to be free.” —Steward Brand80
Sometimes the expertise and insights that can help you glean the most important findings from your data exist outside your organization. One potential solution to this problem is to open-source the data, making them available to interested citizens, companies, and non-profits.
There are a number of potential benefits to sharing data publicly. It makes the data available to people who do not work for your agency—experts, interested laypeople, and industry analysts. These groups bring different viewpoints, perspectives, and skillsets to bear, potentially resulting in analysis and conclusions that may otherwise have been missed. Publicizing data also helps educate the public on a regulator’s mission and focus.
However, before opening up all your data, certain factors need to be considered. The data to be published should be as accurate as possible, to help stakeholders draw valid conclusions. Additionally, the format of the data should be well defined and clearly communicated through documentation and examples. Also, consider potential second- and third-level impacts of the data being published. One specific data set may not be enough to identify an otherwise anonymous entity, but combining those data with other data sets might.
In a number of cases, due either to industry or circumstance, companies and individuals may have to deal with multiple regulatory agencies. For example, they may need Occupational Safety and Health Administration for workplace-related matters, the Department of Labor for human capital-related matters, and local or state regulators focused on their industry. In complicated markets like finance, these different regulatory agencies may be requesting similar, or even the same, data sets to carry out their duties.
This duplication burdens both the regulated entity and the regulator. The regulated entity has to respond to multiple requests for similar sets of data, and regulators generally have to use limited resources and wait to receive the data, even though a peer agency may already have a data set they could use. One potential solution is to find ways for industry and regulators to collaborate, both to rationalize the requests being made and to better share data between regulators. For example, a given agency may only visit or investigate a fraction of the companies it is responsible for, and those it is unable to cover may be accessed by other regulators who could bring back useful data.
“If you make ten thousand regulations you destroy all respect for the law.” —Winston Churchill96
Every day new regulations are proposed, draft regulations commented on, and final rules published in the Federal Register. These rules add to the existing set of regulations and expand the oversight and enforcement scope of regulators. From the perspective of the regulated entity, these new rules may represent an investment—of time, effort, and money—to understand whether the new rules apply and, if they do apply, are they impacted by any additional regulations as a result.
Executive Order 13563 (Improving Regulation and Regulatory Review) contains one solution to this problem. It requires federal regulatory agencies to develop and submit plans to review their significant regulations “to determine whether any such regulations should be modified, streamlined, expanded, or repealed so as to make the agency’s regulatory program more effective or less burdensome.”97 From an oversight and enforcement perspective, regular review of published regulations can help regulators identify whether there are areas they no longer need to focus resources on or if there is an area they are not overseeing as aggressively as they should be.
While it is a challenge to review the entire set of regulations an agency has issued, this exercise is a way to build trust with industry and show the agency’s commitment to continuous improvement. The advent of new technologies like machine learning and artificial intelligence may make this task easier, enabling more frequent regulatory reviews.
"Our regulatory system must protect public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation . . . It must identify and use the best, most innovative, and least burdensome tools for achieving regulatory ends."
Regulations can play an essential role in protecting citizens and businesses, but if not done strategically, they risk being costly and burdensome for both agencies and businesses. A key task for regulators is to find effective and efficient strategies to overcome the challenges they face and achieve their agency’s mission.
Regulators are facing significant challenges—keeping up with technical and business model innovations, growth in the number of suppliers of goods and services, increasingly digital constituents, and the changing attitudes and behaviors of industries and consumers. The challenges are complex, but provide regulators the opportunity to examine “business as usual” in an effort to remain relevant and effective in our rapidly changing environment.
Exciting opportunities exist for regulatory leaders to navigate today’s challenging landscape and prepare for the future—both in how they approach rulemaking and in the way they enforce rules. By aligning technology, strategies and processes, and talent, regulators have the opportunity to become the regulator of tomorrow.