Whole Foods Market, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF WHOLE FOODS MARKET, INC.

AND WILD OATS MARKETS, INC.

Docket No. 9324 Order, December 19, 2008 Order granting Whole Foods Market’s motion in part and denying in part. ORDER AMENDING SCHEDULING ORDER AND DENYING RESPONDENT’S MOTION TO STAY PROCEEDING Respondent Whole Foods Market, Inc. has filed a Motion to stay this administrative proceeding until the conclusion of the federal district court remand proceeding, and to amend the September 10, 2008 Scheduling Order to postpone the commencement of the administrative hearing until no earlier than September 14, 2009. The Commission has determined to deny Respondent’s Motion, but to amend the Scheduling Order in certain respects.

The Scheduling Order currently provides that the administrative trial will begin on February 16, 2009. Respondent argues that (1) a stay is warranted because the remand proceeding “will result in findings of fact regarding the actual effects of the Whole Foods Market/Wild Oats merger and other important issues that necessarily will affect the conduct of the administrative proceedings” (Motion at 1); and (2) without a seven-month extension, it “will be unable to complete adequate third party discovery in advance of expert reports and the administrative hearing.” Id. at 5. Although we find that Whole Foods has failed to adequately justify staying these proceedings or delaying trial for seven months, we nevertheless will delay the trial until April 6, 2009.

VOLUME 144 Interlocutory Orders, Etc.

First, although the current rules allow for a stay of administrative proceedings while a collateral federal court proceeding is ongoing (see Rule 3.51), such a decision is discretionary. The circumstances here do not justify a stay. The Court of Appeals in reversing the district court's denial of a preliminary injunction determined that the Commission had established a likelihood of success on the merits. Federal Trade Commission v. Whole Foods Market Inc., No. 07-5276, 2008 U.S. App. LEXIS 24092 at *32, *54 (Tatel, J.); id. at *10, *30 (Brown J.). As a result, the decision on remand will not determine whether the transaction is illegal.

In contrast, the district court's original decision denying a preliminary injunction effectively prevented any finding that the transaction was illegal. The district court found that the Commission had established no likelihood of success on the merits. If that finding– that there was no likelihood of success on the merits – was correct, it would have been virtually impossible for the Commission to find a violation, and the Commission, in all likelihood, would have dismissed this action. Therefore, for prudential reasons, the Commission did not lift the stay until the Court of Appeals reversed that district court's finding. The posture of the federal court action no longer supports staying this proceeding.

Three prudential reasons justify proceeding with this action. If the transaction is anticompetitive, there could be ongoing consumer harm. Moreover, should the Commission determine that the transaction is illegal, the longer it takes to make the decision, the more difficult it will be to fashion effective relief that would protect consumers. Although the Commission believes certain preliminary relief - such as a hold separate order - will help protect a potential remedy, the Commission should still attempt to resolve this matter as expeditiously as possible. Finally, should the district court grant some form of preliminary relief, resolving this matter quickly limits the intrusiveness of such a remedy.

WHOLE FOODS MARKET, INC. 947 Interlocutory Orders, Etc.

In addition, Whole Foods is speculating on how the federal court action will proceed on remand. It is not obvious that there will be significant overlap and repetition between the two actions. The district court action is not a determination on the merits. Further, the district court weighs equities related to preliminary relief that are different than the factors related to the need for permanent relief. Although Whole Foods claims that the findings in the federal court action will be conclusive (or nearly so) on this matter, that argument is premature.

Second, with regard to Respondent’s separate request for an extension of the administrative trial until September 14, 2009, the motion rests entirely on its unsupported assertion that, absent this extension, it will be unable to conduct necessary third-party discovery. Respondent claims that, in order to defend claims pertaining to the 29 separate geographic markets at issue in this case, it requires compliance with 96 third party subpoenas it has issued, but only 53 third parties have even partially complied with the subpoenas, and it cannot take the depositions of any third party until that compliance has occurred. Motion at 5-6. A party who encounters a problem in this respect is expected promptly to call the problem to the court’s attention. The court normally either orders prompt compliance with the subpoena, or, if the subpoena is overly broad or unduly burdensome, the court modifies it and sets a date for the deposition. Respondent’s motion makes no showing that any of this occurred. Among other things, Respondent has made no showing (by affidavit or otherwise) that it needed to issue 96 third party subpoenas to begin with, that a problem even exists with any of the 96 subpoenas, much less with all of them, or that it has taken any steps to attempt to resolve these problems. Although it appears that Respondent has not yet taken a single third party deposition to date, it has failed to show good cause for not having done so. As Commissioner Rosch explains in his dissent, it appears that Part 11(e) may be creating some problems with scheduling third party depositions. The Commission will delete Part 11(e) from the scheduling order. VOLUME 144 Interlocutory Orders, Etc.

It is certainly true that the current discovery schedule is a demanding one. Notwithstanding that, when we issued the scheduling order in September, we believed that this schedule would be a feasible one. The Commission has made it clear – in issuing the September scheduling order and in its recent actions to revise its Rules of Practice relating to Part 3 proceedings – that it is committed to resolving adjudicative proceedings expeditiously as is required by law. We also recognize that this case is in a unique procedural posture because at the time it was filed there was no foreshadowing that the Commission would revise its rules to expedite proceedings, the transaction has since been consummated, and this administrative litigation was stayed for a year. Under these unique circumstances, we believe that the reasons for expedited deadlines do not apply with quite the same force as they will in future cases. Thus, although we find that Respondent has failed to support its assertion that a lengthy seven-month delay in the hearing is warranted, we will extend the commencement of the administrative hearing to April 6, 2009, with the attendant deadlines to be adjusted accordingly.1 We wish to emphasize, however, that we will not lightly depart from this schedule, and if Respondent believes that any further extension is required it will need to make a particularized showing, with factual support rather than mere unsupported assertions. Accordingly, IT IS ORDERED THAT Respondent’s request to stay this administrative proceeding is DENIED;

IT IS FURTHER ORDERED THAT Respondent’s request to amend the Scheduling Order to postpone the commencement of the administrative hearing until no earlier than September 14, 2009 is DENIED;

1 With the new hearing date – which is approximately eight months from the date that the Commission lifted the stay in these proceedings, pretrial discovery and preparation will be longer than the roughly five months that the federal district courts allowed in the Oracle and Microsoft cases. See, U.S. v. Oracle Corp., 331 F. Supp.2d 1098 (N.D. Cal. 2004); U.S. v. Microsoft, 253 F.3d 34 (D.C. Cir. 2001).

WHOLE FOODS MARKET, INC. 949 Interlocutory Orders, Etc.

IT IS FURTHER ORDERED THAT Part 9 of the September 10, 2008 Scheduling Order is amended in the following respects:

1. The Commencement of Hearing will occur on Monday, April 6, 2009, at 10:00 a.m. in Room 532, Federal Trade Commission Building, 600 Pennsylvania Avenue, NW Washington, D.C.; and 2. The deadlines specified in Part 9, beginning with December 19, 2008, are changed as follows: a. December 19, 2008 is changed to February 4, 2009; b. January 5, 2009 is changed to February 19, 2009; c. January 15, 2009 is changed to March 2, 2009; d. January 22, 2009 is changed to March 9, 2009; e. January 27, 2009 is changed to March 16, 2009; f. January 30, 2009 is changed to March 19, 2009; g. February 4, 2009 is changed to March 24, 2009; and h. February 11, 2009 is changed to March 31, 2009; and IT IS FURTHER ORDERED THAT Part 11(e) of the September 10, 2008 Scheduling Order is deleted. By the Commission, Commissioner Rosch dissenting. VOLUME 144 Interlocutory Orders, Etc.

DISSENTING STATEMENT OF COMMISSIONER J. THOMAS ROSCH I respectfully dissent from this ruling. Respondent’s motion is based on three premises that are unsupported and unsound. The first premise of the motion is that the remand proceeding “will result in findings of fact regarding the actual effects of the . . . merger and other important issues that necessarily will affect the conduct of the administrative proceeding.” Memorandum in Support of Motion at 1, 4. That is incorrect. The first prong of this premise – that the remand proceeding “will result in findings of fact regarding the actual effects of the merger”– is apparently based on the assertion that “there was no opinion of the court” in the D.C. Circuit Court of Appeals proceeding because there were multiple panel opinions. Memorandum in Support of Motion at p.3. That assertion is in turn apparently based on the concurring opinions of two of the nine judges who participated in denying Respondent’s motion for en banc review of the panel decision. See attached rehearing en banc order. However, the other seven participating judges did not adopt that view of the law. Id. To the contrary, as Judge Kavanaugh pointed out in footnote 8 of his dissent to the panel decision, the Marks principle, which is operative in both the jurisprudence of the Supreme Court and the Circuit Court, treats as binding precedent all explicit and implicit agreements between the authors of the multiple opinions. Federal Trade Commission v. Whole Foods Market, Inc., 2008 U.S. App. LEXIS 24092 at *91, n.8 (Kavanaugh, J.). Judge Kavanaugh’s dissenting opinion further pointed out that a majority of the panel (Judge Brown and Judge Tatel) agreed that the remand court is not to “make findings of fact regarding the actual effects of the merger.” Id. at *85 (Kavanaugh, J.). That is confirmed by the opinions of Judge Brown and Judge Tatel themselves. Id. at *29 (Brown, J.), *54 (Tatel, J.) Thus, as was pointed out in our denial of Respondent’s motion to recuse the Commission (p.2), insofar as the remand court considers the merits at all, it cannot make “findings of fact regarding the actual effects of the merger” that will affect the conduct of the plenary trial. WHOLE FOODS MARKET, INC. 951 Interlocutory Orders, Etc.

The motion also fails to support the second prong of the premise – that the remand proceeding will result in “findings of fact regarding . . . other important issues that necessarily will affect the conduct of the administrative proceeding.” Apparently, those “other important issues” have to do with the “balancing of equities mandated by the D.C. Circuit.” Memorandum in Support of Motion at p.4. Again, however, that is a function to be performed by the remand court in the preliminary injunction proceeding; whatever “findings of fact” the remand court may make on that score will not necessarily affect the conduct of the plenary trial.

The second premise of the motion is that “staying the Commission’s challenge to this transaction, which was consummated over 15 months ago, will have no adverse effect on the public interest.” Memorandum in Support of Motion at pp. 1, 2, 4-5. That premise is based on the same contentions Respondent made in claiming in the Circuit Court of Appeals proceeding that the matter was moot. Specifically, there, as here, Respondent argued that the fact that it had closed the transaction and that the Commission had stayed the plenary trial made it impossible for the Commission to order any meaningful relief after a plenary trial. Mootness Motion at pp. 2-4; Reply at pp. 1-3, 9. In this instance too, the majority of the panel (Judge Brown and Judge Tatel) agreed that the mootness motion and its premises were without merit. The motion does not demonstrate otherwise. Indeed, the threat that Respondent may take steps to moot the matter underscores the public interest in moving this matter to a conclusion expeditiously.

Finally, the third premise of Respondent’s motion is that it needs until September 14, 2009 to prepare adequately for the plenary trial. Memorandum in Support of Motion at pp. 1, 2. This premise is supported by Respondent’s assertions that in order to defend claims pertaining to the 29 separate geographic markets at issue in this case, it needs compliance with 96 third party subpoenas it has issued, and it cannot take the depositions of any VOLUME 144 Interlocutory Orders, Etc.

third party until that compliance has occurred. Memorandum in Support of Motion at pp.2, 5-6.

Respondent’s motion does correctly assert that the scheduling order requires compliance with third party subpoenas before third party depositions are taken. More specifically, paragraph 11e. of the order provides that:

[n]o deposition of a non-party shall be scheduled between the time of production in response to a subpoena duces tecum and three (3) days after copies of the production are provided to the nonissuing party, unless a shorter time is required by unforeseen logistical issues in scheduling the deposition, the documents are produced at the time of the deposition, or as agreed to by all parties involved.

This is a standard provision in federal district court scheduling orders. It is designed to make third party depositions more useful by providing that the third party’s documents will be produced first. A party who encounters a problem in this respect is expected promptly to call the problem to the court’s attention, and the court normally either orders prompt compliance with the subpoena, or, if the subpoena is overly broad or unduly burdensome, modifies it and sets a date for the deposition. Respondent’s motion makes no showing that any of this occurred. Specifically there is no showing that Respondent needed to issue 96 third party subpoenas to begin with, or if it did, that Respondent promptly called any problem created by paragraph 11e. in those circumstances to the attention of the administrative law judge or the Commission. Indeed, there is no showing that a problem even exists with any of the 96 subpoenas, much less with all of them. There is no showing with respect to the status of compliance respecting any of the 96 subpoenas. To the contrary, it appears Respondent has not yet taken a single third WHOLE FOODS MARKET, INC. 953 Interlocutory Orders, Etc.

party deposition to date, and it has failed to show good cause for not having done so.

Under these circumstances, most, if not all, federal judges would simply deny the motion. Certainly they would not grant a 45 day extension of time to complete discovery or continue the hearing date for 49 days, as this ruling does. At most, the ruling should be limited to deleting paragraph 11e (as the majority has done), extending the discovery deadline for 15 days and continuing the hearing date for the same amount of time. Moreover, the ruling should make it clear that no further extensions or continuances will be granted. For these reasons, I respectfully dissent. RESPONSES TO PETITIONS TO QUASH OR LIMIT COMPULSORY PROCESS _______________________________ WEST ASSET MANAGEMENT, INC.

FTC File No. 072 3006 Decision, July 2, 2008 RESPONSE TO WEST ASSET MANAGEMENT, INC.’S (“WAM”) REQUEST FOR REVIEW OF DENIAL OF PETITION TO LIMIT CIVIL INVESTIGATIVE DEMAND Dear Mr. Berg:

This letter advises you of the Commission’s disposition of West Asset Management, Inc.’s (“WAM”) Request for Review of Denial of Petition to Limit Civil Investigative Demand (“Request for Review”) issued in conjunction with an investigation of WAM by the Federal Trade Commission (hereinafter “FTC” or “Commission”). For the reasons stated below, the Letter Ruling Denying WAM’s Petition to Limit (Apr. 18, 2008) (“Letter Ruling”) is affirmed.

I. Background and Summary The present investigation seeks to determine whether there is any reason to believe that WAM, a debt collection firm, may have violated either the Fair Debt Collection Practices Act (“FDCPA”), 15 U.S.C. § 1692 et seq., or the Federal Trade Commission Act, 15 U.S.C. § 41 et seq. The Commission issued a Civil Investigative Demand (“CID”) to WAM on August 13, 2007. On November 5, 2007, WAM filed a Petition to Limit Civil Investigative Demand (“Petition to Limit”). WAM requested that the CID be limited “because: (1) the requests are unduly burdensome and can be reasonably limited without adversely impacting the FTC’s investigation; and (2) the requests require the disclosure of confidential and personally identifiable consumer and client information that is not relevant in any manner to the FTC’s investigation.” Petition to Limit at 1. WEST ASSET MANAGEMENT, INC. 955 Responses to Petitions to Quash After Commissioner Harbour issued the Letter Ruling denying the Petition to Limit, WAM filed its Request for Review on April 25, 2008. WAM’s Request for Review questions the denial of its Petition to Limit, and supplements and clarifies some of the facts supporting its burdensomeness claim by submitting a second declaration from its Associate Counsel for Compliance, Nancy Van Hoven, and a declaration from its Senior Vice President for Systems and Technology, Michael Regalia. As Commissioner Harbour noted in the Letter Ruling, WAM’s argument that it must be permitted to redact non-privileged, confidential third-party information from its CID responses bears directly on the extent of the burden WAM claims will be imposed on it by CID compliance. Letter Ruling at 3. We therefore address redaction of non-privileged information first. II. WAM Is Not Entitled to Redact Non-Privileged Information In its Request for Review, WAM renews its objection to Interrogatories 8, 22, and 26 and Document Requests 21-25 and 27. WAM argues that it should be entitled to review and redact “confidential and personal identifying information” from its CID responses. Petition to Limit at 22.1 In support of this argument, WAM submits that this information is not relevant to the staffs 1 The Request for Review also stated that the Letter Ruling compels WAM to produce privileged attorney-client and work product information. Request for Review at 2-3. WAM specifically faults the Letter Ruling for failing to distinguish between privileged information and confidential information. WAM’s claim is wide of the mark for two reasons. First, the CID does not require WAM to produce any privileged information. CID ¶ II.B. (“Claims of Privilege) (permitting redaction of such materials and requiring the service of a specified form of privilege log). Second, the Petition to Limit did not seek leave to delete privileged information, only several varieties of third-party confidential information. Accordingly, the fact that the Letter Ruling failed to make an unrequested redaction distinction, see Request for Review at 2, is hardly surprising. Further, WAM’s unsupported speculation that the Letter Ruling “intended to accomplish a punitive purpose” is beyond the limits of legitimate advocacy. Request for Review at 3. VOLUME 146 Responses to Petitions to Quash investigation, and that the lack of need for the information should be weighed against the harm of disclosure. See, e.g., Request for Review at 11.2 WAM’s objections fail on several grounds. The Commission is entitled to information if it is “reasonably relevant” to the investigation. See, e.g., Fed. Trade Commu v. Invention Submission Corp., 965 F.2d 1086, 1089 (D.C. Cir. 1992) (“It is well established that a district court must enforce a federal agency’s investigative subpoena if the information is reasonably relevant. . . or, put differently, not plainly incompetent or irrelevant to any lawful purpose. . . and not unduly burdensome to produce.”) (citations and internal quotation marks omitted). Like Commissioner Harbour, we find that the information sought by these specifications, including any non-privileged confidential information, is reasonably relevant to the investigation of WAM’s debt collection practices. Letter Ruling at 2 n.4. In many cases the “confidential and personal identifying information” WAM seeks to redact is not only relevant, it is often the most relevant evidence sought by the CID specification. For example, Interrogatory 26 asks WAM to “identify the name, address, and telephone number of each consumer from whom WAM has received a complaint, directly either from the consumer or from a third party on behalf of the consumer.”3 If the contact information for the individuals who complained were redacted as confidential, staff would not be able to contact those individuals and the investigation would be hampered materially. The complementary Document Request, Document Request 23, required WAM to provide the complete consumer file for each 2 In addition to consumer and creditor information, WAM proposes to redact “other confidential information of little conceivable value to the investigation”. Id.

3 WAM objected to this demand for consumers’ names, addresses, and telephone numbers on the basis of an unspecified privilege and on the basis that the interrogatory called for confidential personal information. Petition to Limit, Exhibit F, WAM Non-Public Response to August 13, 2007 CID (undated) at 23-24. WAM does not specify the legal grounds for either objection. WEST ASSET MANAGEMENT, INC. 957 Responses to Petitions to Quash person who complained – information that, again, is highly relevant to determining whether the company’s practices violated the FDCPA and would be significantly less useful if it could not be matched to the actual consumer who complained. Similarly, Interrogatory 22 asks that WAM “identify all client-creditors who have instructed WAM not to file suit or commence litigation to collect a debt.” A “threat to take any action that cannot legally be taken or that is not intended to be taken” violates Section 807(5) of the FDCPA,4 so this information – combined with complaint information that a threat to take legal action was made on behalf of a particular creditor – would enable staff to determine when any threat to take legal action to collect a debt on behalf of a particular client creditor would constitute a violation.5 If the creditor’s identity were redacted and replaced with a coded identifier, staff would not be able to verify whether complaints obtained from sources other than WAM (such as the Better Business Bureau or the Commission’s own complaint database) about threats by WAM to take legal action on behalf of that creditor were empty threats, thus violating the FDCPA. WAM’s belief that it is entitled to withhold production of responsive documents and material so that it can redact nonprivileged information is misplaced. First, WAM objects that disclosure of information that identifies its clients would cause “substantial economic harm to [its] competitive position.” Petition at 28 (citing Diamond State Ins. v. Rebel Oil Co., Inc., 157 F.R.D. 691, 697 (D. Nev. 1994)). The court in Diamond State did note that under Fed. R. Civ. P. 45 a federal court may limit or quash a subpoena requesting confidential commercial information which, if disclosed, would cause substantial economic harm to the competitive position of the entity from whom the information was obtained. The court went on to hold, however, that the subpoenaed party’s claim was “unsubstantiated” and that a “generalized, self-serving, conclusory assertion of protection or 4 15 U.S.C. § 1692e(5).

5 See also Letter Ruling at 3 n.5.

VOLUME 146 Responses to Petitions to Quash privilege is without merit.” ld. at 698. Further, WAM cites no authority that extends this discovery rule to the investigatory process of the FTC.

WAM’s claim of substantial harm is inadequate for the same reasons. Neither WAM’s Petition nor its Request for Review demonstrate how disclosure of its clients’ names to the Commission – which is required to afford it substantial confidentiality protections6 – would cause “substantial economic and competitive harm” to WAM. At most, WAM indicates that it entered a non-disclosure agreement with at least one client that places certain restrictions on WAM’s disclosure of that clients relationship with WAM. WAM, however, does not cite any case law suggesting that a company can shield information from a federal inquiry by entering a non-disclosure agreement with a private party, even if its contract, properly construed, so provided.7 The district court in Fed. Trade Commu v. Invention Submission Corp., 1991-1 Trade Cas. (CCH) ¶ 69,338 at 65,353- 54 (D.D.C. 1991), rejected precisely this argument, holding that Invention Submission Corp. must produce documents demanded by the Commission even if so doing would breach its confidentiality agreements with third parties. The court recognized that “any other state of affairs would undermine the Commission’s mandate to investigate unfair business practices and allow any organization under investigation to escape scrutiny simply by protecting all information under confidentiality agreements.” Id. at 65,353; Letter Ruling at 5. Moreover, the Petition does not demonstrate how producing information in 6 See, e.g., 15 U.S.C. §§ 46(f) (protecting trade secrets and confidential financial or commercial information), 57b-2(b) (protecting documents obtained under compulsory process in a law enforcement investigation). See also 16 C.F.R. § 4.10; 5 U.S.C. § 552(b)(7)(C) (provision of the Freedom of Information Act exempting from mandatory disclosure records or information compiled for law enforcement purposes, to the extent that production could reasonably be expected to constitute an unwarranted invasion of personal privacy).

7 See Letter Ruling at 6 n.l3.

WEST ASSET MANAGEMENT, INC. 959 Responses to Petitions to Quash response to a lawful demand of a federal agency – which is expressly contemplated in the agreement excerpted by WAM, Petition to Limit, Exhibit Y, ¶ IV.C. – would lead to substantial economic and competitive harm for WAM.8 Second, WAM objects to producing unredacted documents and material on the basis that various statutes relating to particular types of data place restrictions on disclosure of that data, suggesting that if WAM were to provide the information responsive to the CID it would be violating some other law. WAM’s primary argument relates to protected health information that it may have received from health care clients that would be protected under the Health Information Portability and Accountability Act of 1996.9 As a preliminary matter, any health care client, as a covered entity under HIPAA, would be required to ensure that disclosures made to a business associate, such as WAM, for purposes of obtaining payment involved the minimum necessary disclosure. See 45 C.F.R. §§ 164.502(b), 164.5l4(d). Just as WAM apparently needed protected health information for its collection purposes, the context for the debt is relevant to the Commission’s investigation of WAM’s debt collection practices and is an integral part of the consumer’s file.10 WAM implicitly 8 WAM argues that WAM would be prejudiced in that it would have to disclose the FTC’s investigation to its clients. Petition at 28; Van Hoven Declaration (Nov. 5, 2007) at ¶¶ 33-35 (substantial and irreparable commercial and competitive harm would result to WAM because WAM would have “to provide notification. . . to everyone of WAM’s clients of the FTC’s preliminary nonpublic investigation”). However, the non-disclosure agreement WAM cites required WAM to have notified its client of the CID “promptly upon [its] receipt” in August 2007. Petition to Limit, Exhibit Y, ¶ IV.C. In any event, as pointed out in the Letter Ruling, the existence of the investigation is now a matter of public record. Letter Ruling at 6 (citing 16 C.F.R. § 2.7(g)). 9 Pub. L. 105-34 (Aug. 21, 1996, as amended by Pub. L. 105-33 (Aug. 5, 1997) and Pub. L. 105-34 (Aug. 5, 1997)) (“HIPAA”). 10 Under 45 C.F.R. § 160.103, protected health information includes individually identifiable health information that is created by a health care provider, health plan, employer, or health care clearinghouse and that relates to the past, present, or future payment for the provision of health care to an individual.

VOLUME 146 Responses to Petitions to Quash concedes as much by offering to turn over this information if Commission staff shows a “specifically identified and justifiable need for the information – an analysis that should be performed on case-by-case basis.” Request for Review at 7. Like the Letter Ruling, the Commission finds that HIPAA regulations allow protected health information to be disclosed to Commission staff in response to a CID where, as here, any protected health information is relevant and material to a legitimate law enforcement inquiry, the Commission’s requests are specific and limited in scope to the extent practicable, and de-identified information – as noted above – would not suffice. 45 C.F.R. § 164.512(f); Letter Ruling at 5. See also 45 C.F.R. § 164.512(e)(1) (exceptions for production of information responsive to administrative order or subpoena, including information responsive to an order of a court or administrative tribunal).11 WAM argues that other statutes or regulations may somehow be implicated in addition to HIPAA, but does not identify which statutory provisions apply or how they would apply to WAM. Most of the statutes, however, do not on their face apply to debt collectors such as WAM. Petition to Limit at 21 (citing 18 U.S.C. § 2702(a)(3) – disclosure of information by communications providers, 20 U.S.C. § 1232g – disclosure of information by educational institutions, 42 U.S.C. § 1320d-2 – disclosure of information by health care plans, providers and clearinghouses). 11 The Commission fully understands that preserving the confidentiality of consumers’ protected health information is important, and the Commission does not take the protection of that information lightly. Commission staff routinely handles highly sensitive information. Documents and material produced to the Commission that are marked confidential are accorded substantial protections against public disclosure equivalent to those in a protective order. See, e.g., 15 U.S.C. 46(f) (governing trade secrets and confidential financial or commercial information); 15 U.S.C. § 57b-2 (protecting confidentiality of information obtained by compulsory process or otherwise in an investigation, including requiring 10 days notice prior to disclosure and providing for return of material produced); 16 C.F.R. § 4.10 (applying to nonpublic material, including material obtained in an investigation).

WEST ASSET MANAGEMENT, INC. 961 Responses to Petitions to Quash WAM also cites the Gramm-Leach-Bliley Privacy of Consumer Financial Information Rule, 16 C.F.R. § 313, which does apply to debt collectors in some respects, but specifically allows disclosure to the Federal Trade Commission. 16 CFR § 313.15(a)(4). Moreover, WAM does not cite a single case either in the Petition to Limit or its Request for Review where the Commission or any federal court limited a discovery request to allow a party to redact such non-privileged information, even in litigation between private parties.12 For the reasons stated above, we reject WAM’s contention that HIPAA, other federal statutes or rules, or WAM’s client contracts justify redacting the non-privileged confidential information that WAM seeks to exclude from its CID responses. This holding eliminates most of the burden claimed by WAM for producing material responsive to the Cld. See, e.g., Request for Review, Van Hoven Decl. (Apr. 25, 2008) at ¶ 3 (estimating it would take one week to gather documents responsive to a specification, and three to five weeks to review and redact them)13 12 WAM does not cite any case law supporting its redaction arguments in its Request for Review. The case law cited in its Petition to Limit involved challenges to production of confidential commercial information, Petition to Limit at 21, and the courts in those cases invariably ordered the parties to produce, subject to confidentiality protections, the requested information. See, e.g., Graber Mfg. Co. v. Dixon, 223 F. Supp. 1020 (D.D.C. 1963) (plaintiff had shown a clearly defined and serious injury to his business from public disclosure of confidential business information in a public Commission hearing, but plaintiff must produce the documents provided that they would not be made public unless necessary for proper enforcement of the law); Fed. Trade Commu v. Bowman, 149 F. Supp. 624 (N.D. Ill.), aff’d, 248 F.2d 456 (7th Cir. 1957).

13 WAM suggests that its demand to redact responsive documents before producing them is somehow “part of its effort to narrow the scope of the CID,” Request for Review at 7, but clearly the process of review and redaction would take a considerable amount of time to redact a single document. WAM made a significant number of redactions to Exhibit W of the Petition to Limit. We assume WAM took particular care when it redacted confidential information from that exhibit; even then, one Social Security number was overlooked on page 2.

VOLUME 146 Responses to Petitions to Quash III. WAM Has Not Established that Compliance with the CID Would Be Unduly Burdensome.

WAM challenges Document Requests 23-25 and 27 as unduly burdensome.14 WAM contends that “several of the requests are so broad and burdensome that compliance with them would cause significant hardship for WAM,” Petition at 14, and “would severely disrupt WAM’s business operations.” Request for Review at 8. WAM objects that production of computerized voice recordings would cost “approximately $262,000 (hardware and labor cost total)” and that “even with a sufficient increase in WAM’s computing capacity, WAM lacks the personnel to carry out the necessary task of reviewing the consumer and regulatory inquiries as well as employee files” for responsiveness and privilege. Request for Review at 8. WAM states that only two individuals could be made available to produce responsive material and that it would take “nearly 4 months of full-time work by those employees to review and make necessary redactions to all of the computer and hardcopy records responsive to the CID.” Request for Review at 8-9, Request for Review, Exhibit B.15 14 WAM notes that Document Request 23 includes all of the material that would be responsive to Requests 24 and 27. Petition to Limit at 18 n.5. Document Request 23 seeks, “for every consumer who complained about WAM, whether directly to the company or through a third party, the complete consumer file, including, but not limited to, each complaint, each recording made of any telephone contacts with the complaining consumer, and WAM’s response to each complaint.” The other request at issue, Document Request 25, seeks “all recordings of telephone calls, in whatever format stored, between any WAM debt collector and any other person made in the process of attempting to collect a debt.”

15 We note that WAM’s estimates include substantial costs (and additional time) to redact documents to remove non-privileged information. Request for Review, Exhibit B; see also Petition to Limit at 17 (“efforts would need to be undertaken to listen to each call in order to determine whether they contain any confidential or personally identifiable information of consumers, which would require audio redaction”). As noted above, WAM will not have to incur those costs.

WEST ASSET MANAGEMENT, INC. 963 Responses to Petitions to Quash WAM bears the burden of demonstrating that a CID request is unduly burdensome. As noted in Fed. Trade Commu v. Texaco, Inc., 555 F.2d 862, 882 (D.C. Cir. 1977): Some burden on subpoenaed parties is to be expected and is necessary in furtherance of the agency’s legitimate inquiry and the public interest. The burden of showing that the request is unreasonable is on the subpoenaed party. . . . Further, that burden is not easily met where. . . the agency inquiry is pursuant to a lawful purpose and the requested documents are relevant to that purpose. . . . Broadness alone is not sufficient justification to refuse enforcement of a subpoena. . . . Thus, courts have refused to modify investigative subpoenas unless compliance threatens to unduly disrupt or seriously hinder normal operations of a business.

Texaco, 555 F.2d at 882 (footnotes and citations omitted).16 WAM’s allegations of burden relate in substantial part to the production of digital recordings of “telephone calls. . . between any WAM debt collector and any other person made in the process of attempting to collect a debt.” Document Request 25 16 WAM’s reliance on discovery cases involving disputes between private litigants for the claim that an undue burden arises whenever it can be shown that the burden of production outweighs the probative value of the information is misplaced. See Request for Review at 7 (citing N.C. Right to Life, Inc. v. Leake, 231 F.R.D. 49, 51 (D.D.C. 2005) and Travelers lndem. Co. v. Metro. Life Ins. Co., 228 F.R.D. 111, 113 (D. Conn. 2005)). Both cases, moreover, involved discovery demands directed to non-parties. WAM also cited Fed. Trade Comn v. Jim Walter Corp., 651 F.2d 251 (1981), which involved a challenge to an FTC subpoena. That court discussed weighing the “hardships and benefits” of production “when a subpoena threatens to be unreasonable,” but applied the “unduly disrupt or seriously hinder normal operations” standard from Texaco in rejecting the allegation of burden. Id. at 258. VOLUME 146 Responses to Petitions to Quash (Petition to Limit Exhibit F at 38).17 WAM notes that it is unlikely that staff will listen to all of these recordings. WAM, therefore, proposes that the Commission should alleviate its burden of producing all of the recordings by accepting only a sample of them. Sampling can sometimes obviate a complete production; however, this is normally done when the issue is genuinely one of whether the requested evidence is actually relevant or useful. See Texaco, 555 F.2d at 883 (“The Commission notes that other studies have utilized random sampling techniques and that, in its opinion, such studies are inadequate for its purposes. . . . We therefore enforce the subpoena as originally conceived, without production on a random sample basis.”). Here there is no legitimate question about the relevance or utility of these recordings.

Staff needs access to all of the recordings so it can correlate particular (and as yet unidentified) calls to particular (and as yet unidentified) consumer complaints. Further, staff may devise its own samples of these calls to determine whether particular WAM employees might have engaged in suspect, but not subject of complaint, conduct. If only a sample of calls were initially produced, Commission staff following up on a complaint or targeted employee would likely find that many of the calls required for further investigation were not included in the sample received. Staff would then have to ask WAM to provide those particular calls, thereby enabling WAM, were it so inclined, to impede the investigation based on its ability to monitor and anticipate the investigation’s progress and focus. WAM’s financial burden to produce the recordings, relative to its annual gross revenue of nearly $300 million, Letter Ruling at 8, does not demonstrate undue burden. See, e.g., Fed. Trade 17 Like its redaction arguments, WAM claims these recordings are of little or no relevance. WAM seemingly ignores the fact that these recordings, by themselves, might substantially confirm or refute consumers’ complaints about misrepresentations, harassment, empty threats, or other violations of FDCPA or the FTC Act. The records are, therefore, especially relevant to the investigation. WEST ASSET MANAGEMENT, INC. 965 Responses to Petitions to Quash Commu v. Rockefeller, 591 F.2d 182, 190 (DC Cir. 1979) (“The compliance cost. . . estimates. . . simply do not appear to pose a threat to the normal operations of appellants’ businesses considering their size.”). WAM has not satisfied its burden of demonstrating compliance with the Cld would be unduly burdensome.

Further, we reject WAM’s assumption that tasking two employees to perform production review is adequate. The record is unclear regarding WAM’s size. Cf. Petition to Limit at 16 (1198 employees) versus Petition to Limit, Exhibit F at 2-3 (1856 employees). WAM’s website claims it has over 2600 employees.18 Regardless of which number is correct, more than two employees need to be dedicated to CID production review. Further, WAM’s burden claims appear to be based on the assumption that compliance should be organized “in a manner that will minimize as much as possible the disruption to WAM’s business operations.” Request for Review at 4 (noting that “the time and cost burden analysis set forth in the Petition to Limit and supplemental affidavit reflects tasking in a manner that will minimize as much as possible the disruption to WAM’s business operations that would arise from the production of such material to the Commission in compliance with the CID”). WAM has not cited, and the Commission is unaware of, any cases to support WAM’s minimize-disruption standard. See Texaco, 555 F.2d at 882 (“Thus courts have refused to modify investigative subpoenas unless compliance threatens to unduly disrupt or seriously hinder normal operations of a business.”). As in Texaco the breadth of the CID is a reflection of the comprehensiveness of the inquiry being undertaken and the magnitude of WAM’s business operations. Id.

18 West Asset Management, About Us, http://www.westassetmanagement. comlwho_about.cfm?g=1 (last visited Jun. 16, 2008). VOLUME 146 Responses to Petitions to Quash We hold that WAM need not review and redact the production to delete nonprivileged confidential information. We also cannot rely on WAM’s estimates based on the work of only two of its employees. In short, we cannot rely on WAM’s estimates of time for its production; those estimates included substantial time for such redactions to be performed by only two employees. Accordingly, we direct that WAM comply with the CID immediately, subject to any discreet extensions pursuant to 16 C.F.R. § 2.7(c) to which the Staff agrees with respect to particular specifications.19 IV. Order For the reasons set forth herein, the Letter Ruling should be, and it hereby is, AFFIRMED.

By direction of the Commission.

19 This decision moots WAM’s motion to stay or extend the May 8, 2008 return date. Request for Review at 2.

NUTRACEUTICALS INTERNATIONAL, LLC 967 Responses to Petitions to Quash NUTRACEUTICALS INTERNATIONAL, LLC FTC File No. 082 3130 Decision, July 30, 2008 RESPONSE TO NUTRACEUTICALS INTERNATIONAL’S APPEAL OF THE DENIAL BY COMMISSIONER HARBOUR OF THE PETITION BY NUTRACEUTICALS INTERNATIONAL, LLC TO QUASH OR LIMIT CIVIL INVESTIGATIVE DEMAND Dear Mr. Klivinyi:

This letter advises you of the Commission’s disposition of Nutraceuticals International, L.L.C.’s (“NI”) Appeal from the Letter Ruling denying the Petition to Quash or Limit Civil Investigative Demand1 (“Appeal”) issued in conjunction with an investigation of NI by the Federal Trade Commission (hereinafter “FTC” or “Commission”). As set forth below, the Appeal is dismissed as moot.2 NI’s Petition claimed that the Civil Investigative Demand (“CID”) seeks information that is “clearly beyond the scope of the investigation as defined by the Commission[,]” and also sought to quash the CID because Commission Staff had allegedly acted inappropriately toward an NI clerical employee on one occasion. Petition at 1.3 The Letter Ruling denied the Petition on the grounds that it failed to comply with the requirements of Commission Rules 2.7(d)(2) and 4.1(a)(2)(i), 16 C.F.R. §§ 2.7(d)(2) and 4.1(a)(2)(i), which respectively address the 1 Letter Ruling Denying Petition of Nutraceuticals International, LLC to Quash or Limit Civil Investigative Demand, File No. 082-3130 (Jun. 25, 2008) (“Letter Ruling”).

2 Had we reached the merits of NI’ s appeal, we would have affirmed the denial of NI’s Petition to Quash or Limit CID for substantially the same reasons set forth in the Letter Ruling, 3 Like the Letter Ruling, we find no evidence that any alleged misconduct on the part of Commission staff provided any grounds for quashing or limiting the CID.

VOLUME 146 Responses to Petitions to Quash requirement that a Petitioner must have conferred with Commission staff regarding its objections in advance of filing a petition to quash or limit a CID and the qualification of an NI officer to represent it before the Commission on its Petition. Letter Ruling at 3. The Letter Ruling also denied the Petition on the grounds that NI had failed to satisfy its burden of showing that the information sought was either outside the scope of the investigation or tainted by the alleged misconduct of Commission staff. Letter Ruling at 4-5. The Letter Ruling directed NI to comply with the CID by July 7, 2008. 16 C.F.R., § 2.7(f). NI’s appeal was timely filed on July 1, 2008. In its appeal, NI claims that the Letter Ruling erroneously found that NI’s Petition was “procedurally deficient (and) without substantive merit.” Appeal at 1. NI also requested a stay of the July 7 return date until after the Commission had ruled on the appeal as well as for an additional period sufficient for NI “to access the Federal District Court to protect the Company’s legal rights and interests.”4 Id. NI further advised the Commission that if its request for a stay was not granted prior to July 7, then NI intended to “submit its responses to the second CID directly to the Commissioners to hold in strict confidence and not release to Commission staff investigators” pending the Commission’s decision and resolution of any actions initiated by NI in the federal courts.5 Id. 4 Contrary to Petitioner’s apparent belief that such judicial review would be available to it immediately following the Commission’s decision of this appeal, it is well established that FTC investigatory process is not self-executing; accordingly, this CID can only be enforced (or denied enforcement) by the district court in a CID enforcement action brought by the Commission – preenforcement challenges to Commission CIDs brought by the party being subpoenaed are premature and not ripe for judicial review. See, e.g., Atlantic Richfield Co. v. Fed. Trade Commu, 546 F.2d 646, 648-50 (5th Cir. 1977) (affirming district court’s dismissal of action for declaratory and injunctive relief challenging FTC subpoena); Anheuser-Busch Inc. v. Fed. Trade Commu, 359 F.2d 487, 490 (8th Cir 1966) (same).

5 NI cites no legal authority to support its request that its CID responses be NUTRACEUTICALS INTERNATIONAL, LLC 969 Responses to Petitions to Quash On July 8, 2008, the Secretary received NI’s Response to the Second Civil Investigative Demand, dated July 3, 2008, The Commission has reason to believe that NI has substantially complied with the CID, Thus, the relief requested by the Petition – that NI be excused from complying with the CID, or that the CID be substantially modified prior to such compliance – was rendered moot by NI’s substantial compliance with the commandments of the CID.

For the reasons set forth above, IT IS ORDERED that NI’s Appeal should be, and it hereby is, DISMISSED. By Direction of the Commission.

withheld from the “Commission staff investigators” during the pendency of this appeal. The Commission’s Rules have no provision for such relief, and the Commission is unaware of any other legal authority which would support that relief.

VOLUME 146 Responses to Petitions to Quash CVS CAREMARK CORPORATION FTC File No. 072 3119 Decision, August 6, 2008 RESPONSE TO CVS CAREMARK CORPORATION’S PETITION TO LIMIT OR QUASH CIVIL INVESTIGATIVE DEMAND Dear Mr. DiResta:

This letter advises you of the disposition of CVS Caremark Corp.’s (“Petitioner” or “CVS”) Petition to Limit or Quash Civil Investigative Demand (“Petition”) served on it in conjunction with the Federal Trade Commission’s (“FTC” or “Commission”) investigation of CVS’s consumer privacy and data security practices. The Petition is denied for the reasons hereinafter stated. The new date for Petitioner to comply with the Civil Investigative Demand (“CID”) is August 18, 2008.

This ruling was made by Commissioner Pamela Jones Harbour, acting as the Commission’s delegate. See 16 C.F.R. § 2.7(d)(4). Petitioner has the right to request review of this matter by the full Commission. Such a request must be filed with the Secretary of the Commission within three days after service of this letter.1 I. Background and Summary The Commission and the Office of Civil Rights of the Department of Health and Human Services (“HHS”) are conducting coordinated investigations of CVS’s consumer privacy and data security practices. Petition at 2. Television reports detailed CVS’s failure to properly dispose of sensitive consumer information that was discovered in publicly-accessible garbage 1 This letter decision is being delivered by facsimile and express mail. The facsimile copy is being provided as a courtesy. Computation of the time for appeal should be calculated from the date you received the original by express mail.

CVS CAREMARK CORPORATION 971 Responses to Petitions to Quash containers located behind CVS pharmacies in Indianapolis, IN between June and September 2006. Id. at 5. Additionally, between September 2006 and May 2007, additional media reports indicated that sensitive consumer information was found in the trash containers behind CVS pharmacies in Indiana, Ohio, Kentucky, Arizona, and Texas.2 Id. at 8.3 By letter dated September 27, 2007, FTC staff advised CVS that the Commission was conducting an inquiry “to determine whether CVS’s handling of sensitive information from or about its consumers in connection with the preparation and sale of prescription medicines and supplies raises any issues under Section 5.” Id. at 5 (quoting from Exhibit C to the Petition at 1-2 [Letter from Alain Sheer, FTC Div. of Privacy and Identity Protection, to Christine L. Egan, Esquire, Asst. Gen. Counsel, for CVS]). That letter further asked CVS to voluntarily provide information identified in the letter to the FTC and/or HHS for their use in their coordinated investigations. Petition, Exh. C at 2-8. Paragraph 9 of the specification in the letter included “documents sufficient to identify all policies and statements made by CVS regarding its collection, disclosure, use, and protection of personal information. . . .” Id. at 4. CVS claims that it cooperated with the FTC’s investigation, and voluntarily “provided information and voluminous documents relevant to the inquiry. . . .”4 Petition at 2. 2 CVS has over 6,000 retail pharmacies, compare Petition at 5 (“over 6,200”) with Petition at 7 (“now more than 6300”), in forty (40) states and the District of Columbia, and has more than 190,000 employees in its retail pharmacy operations. Petition at 5.

3 CVS refers to these reports collectively as the “Dumpster Incidents.” Petition at 7. For the sake of convenience, the FTC will use this same phrase to refer to these events. In addition, a June, 2005 Computerworld article reported a potential security vulnerability in the CVS ExtraCare FSA program. Id. at 9- 10. ExtraCare is the name CVS uses for its loyalty card program. See id. at 9. CVS indicates that its own investigation revealed no disclosure of personally identifiable information as a result of this vulnerability. Id. at 10. 4 Exhibit E to the Petition (letter of December 14, 2007, from FTC Attorney Loretta Garrison to Anthony DiResta) indicates that Commission staff did not believe CVS had fully responded to its information requests. VOLUME 146 Responses to Petitions to Quash On May 22, 2008, CVS received the CID, issued on May 20, 2008, that is the subject of the Petition. According to CVS, the specifications of the CID seek “a massive volume of documents and information regarding the security and confidentiality of CVS’s electronically stored, transmitted or accessible information that is not limited, or related at all, to: (1) the dumpster incidents or (2) the protection of the ExtraCare program information.” Petition at 3-4. CVS timely fied its Petition on June 20, 2008. The Petition seeks relief from the CID on the following grounds: (1) CID Specifications for Documents Nos. 5, 6, and 7 and for Interrogatories Nos. 1, 6 and 7 broadly demand disclosure of vast amounts of CVS’s electronically stored, transmitted or accessible information, dating back three to five years, that is not relevant to the purpose of the inquiry and is therefore unreasonable;

(2) based on the overly broad definition of “Company” included in the CID, the Staff unreasonably demands documents and information, not only from CVS’s retail pharmacy operations, but also from its Caremark segment, a Pharmacy Benefit Management company (“PBM”) that merged with CVS in March of 2007, that remains a separate business distinct from CVS’s retail pharmacy, and that had no role in the incidents that form the basis of the inquiry, all of which occurred nearly two years before the 2007 merger; (3) the challenged Specifications unreasonably demand documents and information from CVS (and its Caremark segment) which is primarily regulated by other federal agencies with exclusive administration and enforcement authority over patient privacy and security issues; (4) the CID is defective and unenforceable because the challenged Specifications demand documents and information outside the scope and purpose of the inquiry in violation of the FTC’s own rules; and CVS CAREMARK CORPORATION 973 Responses to Petitions to Quash (5) compliance with the overly-broad CID Specifications in question would be unduly burdensome to CVS, not only as a result of the sheer volume of the electronically-stored, transmitted or accessible information demanded, but also because the CID further requires that CVS first redact all “Personal Information” from all such information and documents.

Petition at 4 (footnote omitted).

The gravamen of CVS’s claims stems from CVS’s misimpression as to the actual scope of the Commission’s inquiry. CVS correctly notes that the Commission initiated its investigation because media reports indicated that CVS store personnel in several different states had disposed of sensitive consumer information by placing it in publicly-accessible trash containers – the dumpster incidents. Id. at 5. CVS also concedes that the Commission’s investigation was directed toward a reported security vulnerability in its ExtraCare program. CVS relies on these two identified data security problems to support its claims that the FTC can only investigate issues related to the physical disposal of records at its pharmacies (the dumpster incidents) or to its ExtraCare program. Id. at 10-11. In particular, CVS complains that the CID seeks information beyond the scope of the investigation, that is, “documents and information regarding the security and confidentiality of CVS’[s] electronically-stored, transmitted or electronically-accessible information that is not relevant, or related at all, to the inquiry concerning: (1) CVS’[s] practices in handling consumers’ personal information with the dumpster incidents and (2) the ExtraCare program.” Id. The security vulnerability identified in the media reports relating to the ExtraCare program involved electronically-stored, -transmitted or -accessible information. Petition at 9-10. Accordingly, CVS cannot complain that such information is, in and of itself, beyond the scope of the investigation. It must, therefore, be claiming that the investigation cannot be any broader than the precise episodes that provided the VOLUME 146 Responses to Petitions to Quash lead information for the investigation. Put another way, the scope of the FTC’s investigatory powers is, according to CVS, limited to those things the FTC knows about and excludes those things about which the FTC might be suspicious, based on the things it knows. CVS cites no authority for this position; indeed, the Morton Salt case that it does cite, Petition at 14, flatly contradicts CVS’s position. United States v. Morton Salt Co., 338 U.S. 632, 642-43 (1950) (“[The FTC’s power of inquiry] is more analogous to the Grand Jury, which does not depend on a case or controversy for power to get evidence but can investigate merely on suspicion that the law is being violated, or even just because it wants assurance that it is not.”).

CVS concedes that the dumpster incidents were the result of store personnel at a number of its stores around the country failing to properly adhere to CVS’s own data security policies – the “Blue Bag Policy” – regarding the proper disposal of sensitive customer information.5 Petition at 7. In sum, the dumpster incidents suggest that some areas of CVS’s business operations might be affected by a degree of laxity with respect to adequate data security practices. Accordingly, the scope of the FTC’s investigation is directed toward the possibility that portions of the nation’s “largest provider of prescriptions and related health care services,” Id. at 5, may have data security practices that place its customers’ data in jeopardy. The Commission believes that determining the nature, scope, and, if appropriate, remediation of such risks is in the public interest.

Before turning to the issues raised by CVS in its Petition, however, it is appropriate to emphasize the fact that the party who 5 Exhibit O [Memorandum of Apr. 7, 2008, from CVS Counsel to FTC Counsel] to the Petition describes the Blue Bag Program as a protocol for the segregation and secure disposal of sensitive waste by pharmacy personnel. In essence, sensitive customer information was to be segregated in blue bags and retained in the stores for later pick-up and disposal; in contrast, nonsensitive waste could be disposed of in the trash receptacle located outside of each store. Exhibit O at 2-5.

CVS CAREMARK CORPORATION 975 Responses to Petitions to Quash moves to limit the enforcement of a CID bears the burden of demonstrating that a particular CID specification is unreasonable. “[T]he burden of showing that an agency subpoena is unreasonable remains with the respondent, . . . and where, as here, the agency inquiry is authorized by law and the materials sought are relevant to the inquiry, that burden is not easily met. [citations omitted].” Fed. Trade Commu v. Rockefeller, 591 F.2d 182, 190 (2nd Cir. 1979), quoting Sec. and Exchange Commu v. Brigadoon Scotch Distributing Co., 480 F.2d 1047, 1056 (2nd Cir. 1973), cert. denied, 415 U.S. 915 (1974). II. CVS Has Not Shown that the CID Seeks Information that Is Irrelevant to the Investigation.

The scope of this investigation is determined by the terms of the resolution authorizing the use of CIDs and other compulsory process to conduct the investigation. Fed. Trade Commu v. Invention Submission Corp., 965 F.2d 1086,1091-92 (1992) (“The Commission’s compulsory process resolution did not restrict the investigation to possible oral misrepresentations, however, and we have previously made clear that ‘the validity of Commission subpoenas is to be measured against the purposes stated in the resolution, and not by reference to extraneous evidence.’”) (quoting Fed. Trade Commu v. Carter, 636 F.2d 781, 789 (D.C. Cir. 1980)). As the Invention Submission court also noted: It is well established that a district court must enforce a federal agency’s investigative subpoena if the information sought is “‘reasonably relevant,’” FTC v. Texaco, Inc., 555 F.2d 862, 872, 873 n. 23 (D.C. Cir.) (en banc) (quoting United States v. Morton Salt Co., 338 U.S. 632, 652. . . (1950)), cert. denied, 431 U.S. 974. . . (1977) – or, put differently, “‘not plainly incompetent or irrelevant to any lawful purpose’ of the [agency],” id. at 872 (quoting Endicott Johnson Corp. v. Perkins, 317 U.S. 501, 509 . . . (1943)); accord VOLUME 146 Responses to Petitions to Quash United States v. Aero Mayflower Transit Co., 83l F.2d 1142, 1145 (D.C. Cir. 1987) – and not “unduly burdensome” to produce, Texaco, 555 F.2d at 881. We have said that the agency’s own appraisal of relevancy must be accepted so long as it is not “‘obviously wrong.’” FTC v. Carter, 636 F.2d 781,787-88 (D.C. Cir. 1980) (quoting Texaco, 555 F.2d at 877 n. 32).

Invention Submission Corp., 965 F.2d at 1089. This is the framework within which CVS’s relevance claims must be assessed.

A copy of the resolution authorizing the use of compulsory process for this investigation was attached to the CID. Petition, Exhibit A at 3. In pertinent part it reads, Nature and Scope of Investigation: To determine whether persons, partnerships, corporations or others are engaged in, or may have engaged in, deceptive or unfair acts or practices related to consumer privacy and/or data security, in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended. Such investigation shall, in addition, determine whether Commission action to obtain redress of injury to consumers or others would be in the public interest.

Id. The documents and information sought in the challenged CID specifications appear to fall well within the purpose of this investigation; that is, a determination of whether CVS’s business operations might constitute “deceptive acts or unfair practices related to consumer privacy and/or data security in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act.” Petition, Exhibit A at 3. CVS CAREMARK CORPORATION 977 Responses to Petitions to Quash Indeed, CVS does not claim that the documents and information sought by Document Specifications 5, 6, or 7 and Interrogatories 1, 6, and 7 are unrelated to deceptive acts or unfair practices related to consumer privacy and/or data security.6 It complains, rather, that these specifications seek documents and materials, relating to the electronically stored and retrievable personal information regarding its customers, that are unrelated to the events that triggered the Commission’s interest in investigating CVS’s data security practices in the first place: the dumpster incidents and ExtraCare Program data security vulnerability. Even in this regard, CVS’s argument fails as to the data vulnerability with the ExtraCare Program because CVS’s own description of this problem shows that it involved electronically stored and retrievable personal information about consumers. Petition at 9 (“Prior to June 20, 2005, the ExtraCare loyalty card program allowed ExtraCare members to obtain their recent purchase histories via a website request.”). As previously noted, CVS has offered no legal support for its argument that the FTC may not conduct investigations about possible violations of law unless it already possesses some knowledge about each incident it wishes to investigate. Legal authority it does cite, the Morton Salt case in particular, flatly rejects CVS’s argument. We find, therefore, both that the information sought by the challenged specifications is relevant to the purpose of this investigation, and that the investigation is in the public interest. III. CVS Has Not Demonstrated that the FTC Lacks the Jurisdiction to Investigate CVS’s Electronic Data Privacy and Security Acts and Practices.

6 The challenged specifications deal with CVS’s electronic security policies, practices and procedures, its policies, practices and procedures for evaluating the compliance and effectiveness of its electronic security policies, practices and procedures, and the identification of each instance in the last five years when unauthorized electronic access to a consumer’s personal information has occurred. There is no legitimate basis for concluding that these specifications seek documents or information beyond the scope of the resolution authorizing the use of compulsory process in this investigation. VOLUME 146 Responses to Petitions to Quash CVS claims that the FTC lacks jurisdiction to enforce privacy and data security standards related to protected health information (“PHI”) within the meaning of the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191 (Aug. 21, 1996) as amended by Pub. L. 105-33 (Aug. 5, 1997) and Pub. L. 105-34 (Aug. 5, 1997) (“HIPAA”) because “Congress gave HHS exclusive administration and enforcement authority regarding data privacy and security issues under HIPAA.” Petition at 20. CVS cites no authority for its claim that HHS has exclusive jurisdiction with respect to CVS’s privacy and data security practices. Further, CVS cites no authority to support its claim that HIPAA somehow precludes the FTC from bringing an action against CVS for violations of Section 5 of the FTC Act relating to privacy and data security practices.7 Even if CVS’s claim were correct, it would not provide sufficient grounds for quashing or limiting this investigatory CID. First, this is a coordinated investigation by HHS and the FTC. CVS cites no authority holding that the two agencies cannot conduct a coordinated investigation, eschewing redundant investigatory process service on CVS, which would be followed by post-investigation decisions regarding whether one agency or both agencies were better situated to deal with particular enforcement actions that might be uncovered during the course of these investigations. Second, “[a]n agency’s investigations should not be bogged down by premature challenges to its regulatory jurisdiction.” Fed. Trade Commu v. Swanson, 560 F.2d 1, 2 (1st Cir. 1977). “With rare exceptions (none of which applies here), a subpoena enforcement action is not the proper forum in which to litigate disagreements over an agency’s authority to pursue an investigation.” Fed. Trade Commu v. Ken Roberts Co., 276 F.3d 583, 584 (D.C. Cir. 2001). Third, this is especially true where it 7 CVS’s Petition cites to public statements by current and former senior FTC officials to the effect that the Commission, as a matter of prosecutorial discretion, does not enforce HHS’s privacy regulations under HIPAA. See Petition at 22 n. 38-39. Even so, the FTC has jurisdiction to remedy any violations of the FTC Act by CVS.

CVS CAREMARK CORPORATION 979 Responses to Petitions to Quash may not be possible to determine the scope of the jurisdictional claim until the investigation is substantially complete. Fed. Trade Commu v. Ernsttthal, 607 F.2d 488, 490 (D.C. Cir. 1979) (“But where, as here, the FTC does not plainly lack jurisdiction, and the jurisdictional question turns on issues of fact, the agency is not obliged to prove its jurisdiction in a subpoena enforcement proceeding prior to the conclusion of the agency’s adjudication.”); Fed. Trade Commu v. Monahan, 832 F.2d 688, 689 (1st Cir. 1987) (Judge, now Justice, Breyer) (“We, like the FTC, must wait to see the results of the investigation before we know whether, or the extent to which, the activity falls within the scope of a[n] ‘immunity’.”).

IV. CVS Has Not Demonstrated that Caremark’s Consumer Privacy and Data Security Practices Are Beyond the Scope of the Investigation.

CVS correctly notes that its Caremark subsidiary was acquired by it after the time of the events that gave rise to this investigation. Petition at 4 (Caremark “had no role in the incidents that form the basis of the inquiry, all of which occurred nearly two years before the 2007 merger.”). CVS offers two reasons for excluding Caremark from the CID. Having already decided that CVS’s electronic security is within the scope of the investigation, CVS’s only remaining argument is that the CVS and Caremark “businesses are distinct.” Petition at 18. CVS further argues that it “maintains a comprehensive firewall separating the businesses and records” of the parent and subsidiary firms. Id. That, however, does not provide a basis for eliminating Caremark from the CID. The Commission has reason to believe that the CVS and Caremark databases are interconnected. The information provided by CVS has not demonstrated that an intruder into the CVS system would be unable to gain access to sensitive personal information contained in the Caremark system. The Declarations of Nobles and Balnaves, Exhibits Y and Z respectively to the Petition, do not mention whether personal information is protected by the firewalls. The written firewall policy annexed to Exhibit Y applies to sensitive commercial information (such as prices and VOLUME 146 Responses to Petitions to Quash contracts); it does not appear to address sensitive personal information at all. Accordingly, the Commission has no factual basis to conclude that continued investigation of CVS, including its Caremark subsidiary, is no longer in the public interest.8 V. CVS Has Provided No Factual Support for Its Claims that CID Compliance Would Be Burdensome.

Allegations of burden must be supported with specificity. In re National Claims Service, Inc., Petition to Limit Civil Investigative Demand, 125 F.T.C. 1325, 1328-29, 1998 FTC LEXIS 192, *8 (1998). National Claims teaches that, “[a]t a minimum, a petitioner alleging burden must (i) identify the particular requests that impose an undue burden; (ii) describe the records that would need to be searched to meet that burden; and (iii) provide evidence in the form of testimony or documents establishing the burden (e.g., the person-hours and cost of meeting the particular specifications at issue).” Id. CVS’s Petition fails to meet this burden.

Even assuming that there were some merit in CVS’s claims of burden, we have no factual basis upon which to rely in order to fashion a CID modification with respect to either its scope or the time within which compliance should occur. Additionally, any claim of burden must be assessed in the context of the size and scope of the investigation and of the Petitioner. CVS has provided no facts relative to these issues. Accordingly, the Commission has no reason to believe that CVS’s compliance with the CID is likely to “pose a threat to the normal operation of [CVS’s business] considering [its] size.” Fed. Trade Commu v. Rockefeller, 591 8 CVS’s claim that the CID is defective, based on its speculation that procedures contained in the Commission’s Operating Manual were not followed, Petition at 23-25, is without merit. The Operating Manual specifies internal operating procedures; it creates no rights enforceable by recipients of a CID, and CVS cites no authority to support its arguments based on the Operating Manual, even if it had a factual basis for its speculations. CVS CAREMARK CORPORATION 981 Responses to Petitions to Quash F.2d 182, 190 (DC Cir. 1979).9 Here, given the scope and scale of CVS’s business, compliance with the CID seems unlikely to pose such a threat to CVS. The fact that compliance may be inconvenient or even of some burden is not a sufficient basis to quash or limit a CID. Texaco, 555 F.2d at 882 (“Some burden on subpoenaed parties is to be expected and is necessary in furtherance of the agency’s legitimate inquiry and the public interest.”).

VI. CONCLUSION AND ORDER For all the foregoing reasons, IT IS ORDERED that CVS’s Petition be, and it hereby is, DENIED. Pursuant to Rule 2.7(e), Petitioner must comply with the CID by August 18, 2008. By direction of the Commission 9 See also Federal Trade Comm. v. Standard American, Inc., 306 F.2d 231, 235 (3rd Cir. 1962) (finding petitioner had not provided sufficient evidence that compliance would lead to the “virtual destruction” of a business).