Amerigas Propane, L.P.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF AMERIGAS PROPANE, L.P., AMERIGAS PROPANE, INC., ENERGY TRANSFER PARTNERS, L.P., AND ENERGY TRANSFER PARTNERS GP, L.P.

Docket No. C-4346. Order, May 31, 2012 Letter approving the divesture of Heritage Propane Express to JP Energy Partners, LP.

LETTER ORDER APPROVING DIVESTITURE OF CERTAIN ASSETS Dionne C. Lomax Vinson & Elkins LLP Re: Amerigas Partners, L.P./Energy Transfer Partners L.P., Docket No. C-4346 Dear Ms. Lomax:

This is in reference to the Petition of Energy Transfer Partners, L.P. and Energy Transfer Partners, GP, L.P. for Approval of the Proposed Divestiture of Heritage Propane Express to JP Energy Partners, LP (“the Petition”). Pursuant to the Decision and Order in Docket No. C-4346, Energy Transfer Partners requests prior Commission approval of its proposal to sell its Heritage Propane Express business and related assets to JP Energy Partners.

After consideration of Energy Transfer Partner’s Petition and other available information, the Commission has determined to approve the proposed sale as set forth in the Petition. In according its approval, the Commission has relied upon the information submitted and the representations made by Energy Transfer Partners and JP Energy Partners in connection with Energy Transfer Partner’s Application and has assumed them to be accurate and complete.

AMERIGAS PROPANE, L.P. 1795 Interlocutory Orders, Etc.

By direction of the Commission, Commissioner Ohlhausen not participating.

RESPONSES TO PETITIONS TO QUASH OR LIMIT COMPULSORY PROCESS WYNDHAM WORLDWIDE CORPORATION, WYNDHAM HOTEL GROUP, LLC, WYNDHAM HOTELS & RESORTS, LLC, AND WYNDHAM HOTEL MANAGEMENT, INC.

FTC File No. 102 3142 – Decision, April 11, 2012 RESPONSE TO WYNDHAM HOTELS AND RESORTS, LLC AND WYNDHAM WORLDWIDE CORPORATION’S PETITION TO QUASH OR LIMIT CIVIL INVESTIGATIVE DEMAND DATED DECEMBER 8, 2011 Dear Messrs. Silber and Meal:

On January 20, 2012, the Federal Trade Commission (“FTC” or “Commission”) received the petition filed by Wyndham Hotels and Resorts (“WHR”) and its parent company Wyndham Worldwide Corporation (“WWC,” and collectively with WHR, “Wyndham,” or “Petitioners”). This letter advises you of the Commission’s disposition of the petition, effected through this ruling by Commissioner Julie Brill, acting as the Commission’s delegate.1 For the reasons explained below, the petition is granted as to modifying the definition of personal information and one CID Instruction and denied in all other respects. The documents and information required by the CID must now be produced on or before April 23, 2012, consistent with modifications to the CID definitions and instructions described below. You have the right to request review of this ruling by the full Commission.2 Any such request must be filed with the Secretary of the Commission 1 See 16 C.F.R. § 2.7(d)(4).

2 16 C.F.R. § 2.7(f).

WYNDHAM WORLDWIDE CORPORATION 1797 Responses to Petitions to Quash within three days after service of this letter ruling.3 The timely filing of a request for review of this ruling by the full Commission does not stay the return dates established by this ruling.4 I. INTRODUCTION In early 2010, WHR disclosed that an intruder or intruders had gained access to its computer networks and to networks belonging to independently-owned Wyndham-branded hotels. Later press reports indicated that breaches of its computer network occurred on three occasions between July 2008 and January 2010.5 Among the information compromised in these repeated breaches were payment cards for more than 619,000 people.6 The exposure of this information can result in harms including identity theft, financial fraud, and the basic inconvenience of replacing stolen card numbers.7 In response, on April 8, 2010, FTC staff commenced an investigation and delivered to WHR a voluntary request for information (“Access Letter”) that included both interrogatories and document requests. Though the letter was addressed to an official at WHR, the letter defined “Wyndham” to include not only WHR but also “its parents, subsidiaries, affiliates, franchisees, hotels managed by franchisees that use the Wyndham trade name, and agents.”8 After discussions, staff and WHR agreed to limit an initial production to two custodians, although 3 Id. This letter ruling is being delivered by e-mail and courier delivery. The email copy is provided as a courtesy, and the deadline by which an appeal to the full Commission would have to be filed should be calculated from the date on which you receive the original letter by courier delivery. 4 Id.

5 Pet., Exh. 3, at 1 n.1.

6 See, e.g., Pet. Exh. 5, at 4 (proposed complaint). 7 See, e.g., Data Breaches and Identity Theft: Hearing Before the S. Comm. on Commerce, Science, and Transportation, 109th Cong. 3-4, 10 (2005) (statement of Deborah Platt Majoras, Chairman of the Federal Trade Commission).

8 Pet., Exh. 3, at 2.

VOLUME 153 Responses to Petitions to Quash staff reserved the right to identify additional custodians based on the materials produced. The letter called for a response by May 10, 2010, but WHR did not respond to the interrogatories until July 19, 2010, and did not complete production of documents until October 2010.

Upon review, staff identified deficiencies in the production, most notably that WHR produced a large number of completely irrelevant and nonresponsive materials. WHR also failed to produce information that was obviously relevant to the investigation, such as supporting documents and information referenced in forensic reports that the company did provide. In November 2010, Commission staff informed WHR of these deficiencies and the need to obtain documents from additional custodians. During these negotiations, WHR expressed an interest in pursuing settlement. The company stated, however, that it could not respond to the Access Letter and negotiate settlement simultaneously, and it asked staff to suspend the document collection. In January 2011, staff agreed to do so, but informed WHR that it reserved the right to demand resumption of document collection and to pursue additional custodians should settlement discussions fail.

Staff pursued settlement discussions with WHR over the next nine months. Staff and WHR were unable to reach settlement terms, and on September 19, 2011, WHR informed staff it would not enter into a settlement on the terms staff proposed. Accordingly, in September 2011, staff informed WHR that it would resume the investigation. Soon thereafter, WHR agreed to provide a certification as to the completeness of the materials it had produced to date in response to the Access Letter. WHR provided this certification on December 1, 2011. The FTC issued a CID to WHR on December 8, 2011 pursuant to Resolution P954807, a “blanket resolution” issued by the Commission on January 3, 2008. This Resolution authorizes FTC staff to use compulsory process in investigations WYNDHAM WORLDWIDE CORPORATION 1799 Responses to Petitions to Quash [t]o determine whether unnamed persons, partnerships, corporations, or others are engaged in, or may have engaged in, deceptive or unfair acts or practices related to consumer privacy and/or data security, in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended. Such investigation shall, in addition, determine whether Commission action to obtain redress of injury to consumers or others would be in the public interest.9 II. ANALYSIS A. The CID was lawfully issued and Petitioners have sufficient notice of the nature and scope of the investigation.

Petitioners’ principal objection, which they restate in various ways, is that the CID and its authorizing resolution are deficient for failing to inform them sufficiently of the nature and scope of the investigation. We find this complaint not credible, coming as it does nearly two years after the investigation commenced. As the petition acknowledges, there have been substantial ongoing communications since FTC staff first contacted Petitioners in April 2010. As Petitioners readily admit, they have already reviewed and produced over one million pages of documents at significant expense; presumably, Petitioners did not do so without some understanding of why those documents had been requested.10 Moreover, Petitioners admit that the “CID did not come as a surprise[,]” because they undertook to certify their prior productions in anticipation.11 Indeed, staff presented Petitioners with a draft complaint, Petitioners responded with a 60-page “white paper,” and both parties have engaged in detailed and lengthy settlement negotiations.12 In light of these facts, we find 9 Pet., Exh. 1.

10 Pet., at 35.

11 Id., at 10.

12 Id., at 7-9 and Exh. 7.

VOLUME 153 Responses to Petitions to Quash that the nature and scope of the investigation are quite clear to Petitioners and consequently that their claim of insufficient notice is specious.13 More important, it is well-established that a CID is proper if it “state[s] the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.”14 In the present matter, we find that the authorizing resolution adequately delineates the purpose and scope of the investigation: “[t]o determine whether unnamed persons, partnerships; corporations, or others are engaged in, or may have engaged in, deceptive or unfair acts or practices related to consumer privacy and/or data security, in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended” (emphasis added). The description of the subject matter of the investigation, coupled with a citation to the statutory prohibition on “unfair or deceptive acts or practices” satisfies that requirement.15 This has put WHR on notice as to the purpose, scope, and legal basis for the Commission’s investigation. There is no need to either state the 13 Cf. Assocs. First Capital Corp., 127 F.T.C. 910, 915 (1999) (“In sum, the notice provided in the compulsory process resolutions, CIDs, and other communications with Petitioners more than meets the Commission’s obligation of providing notice of the conduct and the potential statutory violations under investigation.”).

14 15 U.S.C. § 57b-1(c)(2). See also 16 C.F.R. § 2.6. 15 FTC v. O’Connell Assoc., 828 F. Supp. 165, 170-71 (E.D.N.Y. 1993) (quoting FTC v. Invention Submission Corp., 965 F.2d 1086, 1090 (D.C. Cir. 1992)); see also FTC v. Carter, 636 F.2d 781, 788 (D.C. Cir. 1980). Petitioners attempt to distinguish O’Connell on the grounds that the resolution in that case was an omnibus resolution, not a blanket one, and it was used on the basis of a tip to authorize compulsory process to a new recipient as part of an ongoing investigation. The issue of whether a resolution is blanket or omnibus is not relevant because either is an acceptable form of resolution. Furthermore, the resolution upheld in O’Connell stated only that the nature and scope of that investigation involved Section 5 and the Fair Credit Reporting Act. O’Connell, 828 F. Supp. at 167 & n.1. This description is at least as specific as “consumer privacy and/or data security,” the description at issue here. Finally, just as in O’Connell, the CID here was issued as part of a pre-existing, ongoing investigation. In fact, considering the history of the investigation before the CID was issued, Petitioners here had far greater information about what staff was investigating than did O’Connell Associates. WYNDHAM WORLDWIDE CORPORATION 1801 Responses to Petitions to Quash purpose of an investigation with greater specificity, or tie the conduct under investigation to any particular theory of violation.16 Moreover, contrary to Petitioners’ contention, the resolution is not invalid because it is a so-called “blanket resolution.” According to Petitioners, Sections 2.4 and 2.7 of the Commission’s Rules of Practice, 16 C.F.R. §§ 2.4, 2.7, require resolutions to be tailored to the facts of each investigation.17 But no such requirement arises under the Commission’s Rules. Rule 2.4 states that the Commission “may, in any matter under investigation adopt a resolution authorizing the use of any or all of the compulsory processes provided for by law.”18 That provision does not require a separate investigational resolution for each investigation, as Petitioners seem to suggest.19 Likewise, Rule 2.7 simply states that the Commission may, pursuant to a resolution, issue compulsory process for documents or testimony.20 This rule does not address the contents or form of 16 Invention Submission, 965 F.2d at 1090; FTC v. National Claims Serv., Inc., No. S 98-283 FCD DAD, 1999 WL 819640, at *2 (E.D. Cal. Feb. 9, 1999) (citing EPA v. Alyeska Pipeline Serv. Co., 836 F.2d 443, 477 (9th Cir. 1988)). 17 Pet., at 16-18 (citing 16 C.F.R. §§ 2.4, 2.7). 18 16 C.F.R. § 2.4.

19 The narrowly tailored resolution that Petitioners desire is known as a “special resolution,” and is one of three possible types suggested for FTC staff in the Commission’s Operating Manual. See FTC Operating Manual, Chapter 3.3.6.7.4.1 to 3.3.6.7.4.4. The Commission has repeatedly rejected the proposition that such specificity is required in every investigation. See, e.g., D. R. Horton, Inc., Nos. 102-3050, 102-3051, at 4 (July 12, 2010) (“The Commission is not required to identify to Petitioners the specific acts or practices under investigation”), available at http://www.ftc.gov/os/quash/100712hortonresponse.pdf; Dr. William V. Judy, No. X000069, at 4-5 (Oct. 11, 2002) (sustaining validity of CIDs issued pursuant to an omnibus resolution), available at http://www.ftc.gov/os/quash/021011confirmanthonyltr.pdf; In re Assocs. First Capital Corp., 127 F.T.C. at 914 (“[R]ecitation of statutory authorities provides adequate notice to Petitioner as to [the] purposes of the investigation.”). To the extent that courts have considered the issue, they also have rejected the proposition that the Commission is so constrained. FTC v. National Claims Serv., Inc., No. S 98-283 FCD DAD, 1999 WL 819640, at *2; O’Connell, 828 F. Supp. at 170-71.

20 16 C.F.R. § 2.7(a).

VOLUME 153 Responses to Petitions to Quash the authorizing resolution. Accordingly, the resolution in this case satisfies the Commission’s Rules.21 Petitioners also challenge the resolution as insufficiently specific in light of the legislative history of the Federal Trade Commission Improvements Act of 1980, which added a new Section 20 of the FTC Act.22 Petitioners allege that this legislative history shows that Congress intended the FTC to provide more than “a vague description of the general subject matter of the inquiry . . .[,]”23 and that the resolution here does not meet Congress’s expectations.

We reject this argument for the same reason we rejected Petitioners’ other arguments: the Commission’s resolution satisfies the requirements of the statute.24 It informs Petitioners of the nature of the conduct constituting the alleged violation— unfair or deceptive acts or practices involving consumer privacy and/or data security—and it identifies the applicable provision of law—Section 5 of the FTC Act. Moreover, even as Congress expressed its desire for specific notice, it nonetheless cautioned against reading too much into Section 20: “[T]his requirement is 21 Petitioners also contend that the resolution fails to conform to the FTC’s Operating Manual. Pet., at 17-18. However, the sufficiency of staff’s compliance with the Operating Manual is of no concern to Petitioners because the Operating Manual confers no rights on them. See FTC Operating Manual, Chapter 1.1.1 (“Failure by the staff or the Commission to adhere to procedures outlined by this Operating Manual does not constitute a violation of the Rules of Practice nor does it serve as a basis for nullifying any action of the Commission or the staff.”) See also FTC v. Natl Bus. Consultants, Inc., 1990 U.S. Dist. LEXIS 3105, 1990-1 Trade Cas. (CCH) & 68,984, at *29 (E.D. La. 1990) (reading Chapter 1.1.1 to find that the Operating Manual was “not binding”).

22 Pet., at 18, 20-21, 24.

23 S. Rep. No. 96-500, at 23 (1979).

24 See 15 U.S.C. 57b-1(c)(2) (“Each civil investigative demand shall state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.”); see also O’Connell, 828 F. Supp. at 170-71; Dr. William V. Judy, No. X000069, at 4-5 (rejecting a challenge to a resolution based on the legislative history of Section 20), available at http://www.ftc.gov/os/quash/021011confirmanthonyltr.pdf. WYNDHAM WORLDWIDE CORPORATION 1803 Responses to Petitions to Quash not intended to be overly strict so as to defeat the purpose of the act or to breed litigation and encourage the parties investigated to challenge the sufficiency of the notice.”25 We find that the resolution meets all legal requirements.26 Finally, Petitioners claim that the CID exceeded the FTC’s jurisdiction by requesting information about employees, a group it contends is distinct from “consumers” for purposes of Section 5. Pet., at 28-32. We need not entertain this claim because challenges to the FTC’s jurisdiction or regulatory coverage are not properly raised through challenges to investigatory process. See, e.g., FTC v. Ken Roberts Co., 276 F.3d 583, 586 (D.C. Cir. 2001) (citing United States v. Sturm, Ruger & Co., 84 F.3d 1, 5 (1st Cir. 1996). However, we choose to adopt this modification because staff already offered to modify the CID definitions to exclude employee information. Pet., Exh. 11, at 3. B. The CID is not overbroad, unduly burdensome, or indefinite.

Petitioners also advance a series of arguments about the CID specifications, claiming that the CID is overbroad and asks for information not reasonably related to the investigation, in particular, information related to WHR’s corporate parent WWC and its affiliates.27 An administrative subpoena is valid if the requested information is “reasonably relevant” to the purposes of the investigation.28 Reasonable relevance is defined broadly in agency law enforcement investigations. As the D.C. Circuit has stated, “The standard for judging relevancy in an investigatory 25 S. Rep. No. 96-500, at 23 (1979).

26 Ken Roberts Co., 276 F.3d.

27 Pet., at 33-36.

28 Linde Thomson Langworthy Kohn & Van Dyke, P.C. v. RTC, 5 F.3d 1508, 1516 (D.C. Cir. 1993) (citing Invention Submission Corp., 965 F.2d at 1089; FTC v. Anderson, 631 F.2d 741, 745 (D.C. Cir. 1979); FTC v. Texaco, Inc., 555 F.2d 862, 874 (D.C. Cir. 1977)).

VOLUME 153 Responses to Petitions to Quash proceeding is more relaxed than in an adjudicatory one . . . . The requested material, therefore, need only be relevant to the investigation—the boundary of which may be defined quite generally, as it was in the Commission’s resolution here.”29 Courts thus place the burden on Petitioners to show that the Commission’s determination is “obviously wrong” and that the information is irrelevant.30 Here, as Petitioners admit, Commission staff provided an explanation of the relevance of these requests.31 More generally, staff’s investigation focuses on a series of breaches of WHR’s data security processes that are managed by other Wyndham entities.32 In light of this, CID specifications that probe the details of the information security systems developed by Petitioners and their affiliates are relevant to this investigation. Petitioners have not met their burden of showing that this information is irrelevant, or that the Commission’s request for it is “obviously wrong.” Petitioners further claim the CID is unduly burdensome, for the following reasons: (1) they have already spent over $5 million in responding, including producing over one million pages, and staff should now have enough information; (2) responding to the interrogatories will require six months and significant additional costs; (3) responding to the document requests that ask for “all documents” relating to a given subject will require about 10 weeks and $1 million to produce documents from an additional three custodians; and (4) responding to the document requests that ask for “documents sufficient to identify” a given subject are “hugely burdensome” and will require 6 months and $2.75 million to produce documents from the same three custodians. In sum, 29 Invention Submission Corp., 965 F.2d at 1090 (emphasis in original; internal citations omitted) (citing Carter, 636 F.2d at 787-88, and Texaco, 555 F.2d at 874 & n. 26).

30 Invention Submission Corp., 965 F.2d at 1090 (citing Texaco, 555 F.2d at 882) (“The burden of showing that the request is unreasonable is on the subpoenaed party.”)); Texaco, 555 F.2d at 877 n.32. Accord FTC v. Church & Dwight Co., Inc., 756 F. Supp. 2d 81, 85 (D.D.C. 2010). 31 Pet., at 33 (citing Pet., Ex. 11, at 2). 32 Pet., Exh. 11, at 2.

WYNDHAM WORLDWIDE CORPORATION 1805 Responses to Petitions to Quash Petitioners claim that responding to the CID will require an additional $3.75 million, on top of what they have spent to date, and 1 to 2 years’ additional time.33 Of course, the recipient of a CID must expect to incur some burden in responding to a CID.34 The responsibility of establishing undue burden rests on Petitioners,35 who must show that compliance threatens to seriously impair or unduly disrupt the normal operations of their business.36 Likewise, a CID is not unreasonably broad where the breadth of the inquiry is in large part attributable to the magnitude or complexity of the subject’s business operations.37 Petitioners’ estimate is not insubstantial, but we find that they have not sustained their burden. First, Petitioners’ estimate is neither specific nor detailed and does not account for factors that may reduce the cost and time of production. For one, Petitioners have not sufficiently addressed the availability of e-discovery technology, such as advanced analytical tools and predictive coding, to enable fast and efficient search, retrieval, and production of electronically stored information (ESI).38 While Petitioners do tally the potential costs 33 Pet., at 36-39; see also Pet., Exh. 4, at 2-4. 34 See FTC v. Shaffner, 626 F.2d 32, 38 (7th Cir. 1980); Texaco, 555 F.2d at 882.

35 See Texaco, 555 F.2d at 882; In re Nat=l Claims Serv., Inc., 125 F.T.C. 1325, 1328-29 (1998). See also EEOC v. Maryland Cup Corp., 785 F.2d 471, 476 (4th Cir. 1986); FTC v. Standard American, Inc., 306 F.2d 231, 235 (3d Cir. 1962) (appellants have the burden to show unreasonableness of the Commission’s demand and make a record to show the “measure of their grievance rather than [asking the court] to assume it”) (citing Oklahoma Press Publ’g Co. v. Walling, 327 U.S. 186, 217-18 (1946); United States v. Morton Salt Co., 338 U.S. 632, 654 (1950)).

36 See Shaffner, 626 F.2d at 38; Texaco, 555 F.2d at 882. 37 See Texaco, 555 F.2d at 882.

38 See, e.g., Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 318 (S.D.N.Y. 2003) (Sheindlin, J.) (“Electronic evidence is frequently cheaper and easier to produce than paper evidence because it can be searched automatically, key words can be run for privilege checks, and the production can be made in electronic form obviating the need for mass photocopying.”); John Markoff, Armies of Expensive Lawyers, Replaced by Cheaper Software, NEW YORK VOLUME 153 Responses to Petitions to Quash of an ESI production and refer to a vendor, these costs are unsupported by any detailed breakdown or itemization.39 Petitioners’ estimate also does not account for the effect of Instruction K, which permits Petitioners to identify, without having to reproduce, documents that were previously provided to the Commission.40 To the extent that Petitioners’ cost estimate includes production of duplicate materials, Instruction K permits Petitioners to avoid this expense and reduces the potential burden. Though Petitioners respond that staff, and not they, should bear the burden of avoiding duplicative document requests,41 Petitioners are the ones with the most information about their document collections and productions to date. In fact, Petitioners have already identified the areas of overlap between the Access Letter and the CID.42 The Access Letter instructed Petitioners to identify which of the documents produced answered the TIMES, Mar. 5, 2011, at A1, available at, http://www.nytimes.com/2011/03/05/science/05legal.html). 39 Pet., Exh. 4, at 2-4. The lack of factual support for the claim of undue burden is underscored by the fact that the estimated costs appear out of proportion to the number of custodians involved. According to the declaration from Korin Neff, WHR spent approximately $2.5 million per custodian for its first production, and now estimates that it will spend approximately another $3.75 million for three custodians, or $1.25 million per custodian, in response to the CID. Id. One explanation for the cost of the production to date may be the fact that WHR produced a large number of irrelevant and nonresponsive materials, including, among others, multiple copies of third party software licenses, in various languages; numerous magazines and newsletters not specific to WHR; and, human resources materials. This may explain why WHR could generate more than one million pages from only two individuals. 40 Pet., Exh. 1, at 7 (“K. Documents that may be responsive to more than one specification of this CID need not be submitted more than once; however, your response should indicate, for each document submitted, each specification to which the document is responsive. If any documents responsive to this CID have been previously supplied to the Commission, you may comply with this CID by identifying the document(s) previously provided and the date of submission.”).

41 Pet., at 39.

42 See Pet., Exh. 2, at Exhs. C, D. As Petitioners point out, WHR has already responded to 42 out of the 89 interrogatories and subparts in the CID, and 25 of the 38 document requests and subparts. Pet., Exh. 2, at 2. WYNDHAM WORLDWIDE CORPORATION 1807 Responses to Petitions to Quash specifications in the Access Letter.43 It is not unduly burdensome for Petitioners to compare their Access Letter response with the CID to identify duplicates.

Second, Petitioners have not established that this will seriously disrupt their operations. As expressed in Texaco and other key cases, some cost to recipients of process is expected, and the burden posed by this cost is evaluated in relation to the size and complexity of a recipient’s business operations. In Texaco, for instance, the court affirmed enforcement of a subpoena that the company claimed would require 62 work-years and $4 million for compliance.44 As in that case, it appears that the burden here may be a consequence of size—in 2010, Wyndham had an annual revenue of more than $3.8 billion—as well as the complexity of the corporate structure Wyndham has adopted.45 Thus, full compliance with the CID, even if it were to reach the estimates included in the petition, is unlikely to “pose a threat to the normal operation of” Wyndham “considering [its] size.”46 Third, Petitioners have claimed that the requests that ask for documents “sufficient to describe” the subject of the request present a “huge cost” and “extreme burden,” particularly because the companies do not keep records in the manner called for.47 It is unclear why a request that calls for documents “sufficient to describe” should be more burdensome than a request that calls for “all documents”; by definition, documents “sufficient to describe” should involve fewer than “all documents.” The fact that Petitioners do not keep records in the manner that matches the request is not unusual and by itself does not present a basis for quashing these requests. Because staff often does not know how a 43 See Pet., Exh. 3, at 2 (“Please Bates stamp your response and itemize it according to the numbered paragraphs in this letter.”). 44 Texaco, 555 F.2d at 922 (Wilkey, J., dissenting). 45 Wyndham Worldwide Corp., Annual Report (Form 10-K), at 34 (Feb. 22, 2011).

46 FTC v. Rockefeller, 591 F.2d 182, 190 (2d Cir. 1970). 47 Pet., at 38-39. See also Pet., Exh. 10, at 6. VOLUME 153 Responses to Petitions to Quash CID recipient keeps its records, staff crafts its requests broadly, but provides a recipient flexibility in responding by allowing the recipient to produce those documents “sufficient to describe.” Fourth, the fact that Petitioners have already produced information to staff does not establish either that staff has sufficient information, or that further requests are unduly burdensome. The obligation is on Petitioners to show that the CID is unduly burdensome, not on staff to show that the CID is necessary.48 Fifth, we find that Petitioners have not sufficiently availed themselves of the meet-and-confer process required by the FTC’s Rules of Practice and the CID itself.49 As we have previously said, this meet-and-confer requirement “provides a mechanism for discussing adjustment and scheduling issues and resolving disputes in an efficient manner.”50 Thus, the meet-and-confer requirements offer a critical opportunity for the recipient of a CID to engage with staff in a meaningful discussion aimed at reducing the burden of compliance. Here, Petitioners did not engage in a good faith exchange with staff intended to identify and discuss issues of burden.51 Instead, Petitioners raised many of the same arguments found in this petition, often verbatim, and did not respond to legitimate requests from staff for specific proposals for narrowing or limiting the CID’s scope. While staff was apparently willing to compromise on several issues, Petitioners demanded blanket and arbitrary caps on the number of document requests, interrogatories, and custodians. Petitioners cannot claim undue burden when they themselves undertook an inadequate meet-and-confer with staff.

48 Cf. United States v. AT&T, Inc., No. 1:11-cv-01560, 2011 WL 5347178, at *6 (D.D.C. Nov. 6, 2011) (“There is no requirement that AT&T demonstrate to Sprint’s satisfaction that the legal theories AT&T wishes to consider require documents beyond those [Sprint previously] supplied to DOJ . . . .”). 49 16 C.F.R. § 2.7(d)(2); Pet. Exh. 1, at 5. 50 Firefighters Charitable Found., Inc., FTC File No. 102-3023, at 3 (Sept. 23, 2010).

51 See Pet. Exhs. 9-15.

WYNDHAM WORLDWIDE CORPORATION 1809 Responses to Petitions to Quash Despite Petitioners’ failure to carry their burden, we conclude that some modifications to the CID instructions may lessen Petitioners’ costs of compliance. Accordingly, we amend the instructions to permit Petitioners to submit documents in lieu of interrogatories. This modification will allow Petitioners to avoid the time and expense of preparing interrogatory responses. In addition, to the extent that a document may be responsive to multiple interrogatories or document requests, Petitioners need not produce multiple copies but, pursuant to Instruction K, discussed above, may produce one copy of a relevant document, and then indicate each specification or interrogatory to which the document is responsive. This should mitigate the costs of compliance.

Finally, Petitioners argue that the CID is indefinite. This claim appears to restate several of Petitioners’ other objections, including their claim of a lack of notice of the purpose and scope of the investigation, overbreadth, and burden.52 For the reasons discussed above, this claim of indefiniteness is without basis. C. The CID was not issued for an improper purpose. Petitioners claim that the size and timing of the CID shows that its true purposes were either to coerce settlement, or to obtain discovery outside of the rules of civil procedure. The facts of the investigation refute this conclusion. Mid-investigation, Petitioners expressed an interest in exploring settlement talks as a means of resolving the matter short of a full-blown investigation and consequent possible law enforcement action. At Petitioners’ request, staff voluntarily allowed them to suspend their production, in order to reduce the burden on Petitioners. But staff also advised Petitioners that they would resume their investigation should settlement talks fail. And, as Petitioners admit, when the CID was issued, it was no surprise.53 In light of these circumstances, there is no evidence of improper purpose, either to coerce settlement or to obtain information outside of the information necessary to complete the investigation. 52 Pet., at 39-40.

53 Id., at 10.

VOLUME 153 Responses to Petitions to Quash III. CONCLUSION AND ORDER For the foregoing reasons, IT IS HEREBY ORDERED THAT the Petition of Wyndham Hotels & Resorts and Wyndham Worldwide Corporation to Quash, or Alternatively, Limit Civil Investigative Demand be, and it hereby is, DENIED IN PART AND GRANTED IN PART.

IT IS FURTHER ORDERED THAT the Definition T, “Personal information,” be amended to exclude employee information as follows:

“Personal information” shall mean individually identifiable from or about an individual consumer, including, but not limited to: (1) first and last name; (2) home or other physical address, including street name and name of city or town; (3) e-mail address or other online contact information, such as instant messenger user identifier or a screen name; (4) telephone number; (5) date of birth; (6) government-issued identification number, such as a driver’s license, military identification, passport, or Social Security number, or other personal identification number; (7) financial information, including but not limited to: investment account information; income tax information; insurance policy information; checking account information; and payment card or check-cashing card information, including card number, expiration date, security number (such as card verification value), information stored on the magnetic stripe of the card, and personal identification number; (8) a persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual consumer; or (9) any information from or about an individual consumer that is combined with any of (1) through (8) above. IT IS FURTHER ORDERED THAT the CID Instructions be modified to include the following instruction: “Q. Submission of Documents in lieu of Interrogatory Answers: Previously existing documents WYNDHAM WORLDWIDE CORPORATION 1811 Responses to Petitions to Quash that contain the information requested in any written Interrogatory may be submitted as an answer to the Interrogatory. In lieu of identifying documents as requested in any Interrogatory, you may, at your option, submit true copies of the documents responsive to the Interrogatory, provided that you clearly indicate the specific Interrogatory to which such documents are responsive.”

IT IS FURTHER ORDERED THAT all other responses to the specifications in the Civil Investigative Demand to Wyndham Hotels & Resorts and Wyndham Worldwide Corporation must now be produced on or before April 23, 2012. By direction of the Commission.

VOLUME 153 Responses to Petitions to Quash LABMD, INC.

FTC File No. 102 3099 – Decision, April 20, 2012 RESPONSE TO LABMD, INC.’S AND ITS PRESIDENT, MICHAEL J. DAUGHERTY’S PETITIONS TO LIMIT OR QUASH THE CIVIL INVESTIGATIVE DEMANDS DATED DECEMBER 21, 2011 Dear Ms. Callaway, Ms. Grigorian, and Mr. Dayal: On January 10, 2012, the Federal Trade Commission (“FTC” or “Commission”) received the above Petitions filed by Labmd, Inc. (“Labmd”) and its President, Michael J. Daugherty (collectively, “Petitioners”). This letter advises you of the Commission’s disposition of the Petitions, effected through this ruling by Commissioner Julie Brill, acting as the Commission’s delegate.1 For the reasons explained below, the Petitions are denied. You may request review of this ruling by the full Commission.2 Any such request must be filed with the Secretary of the Commission within three days after service of this letter ruling.3 The timely filing of a request for review by the full Commission shall not stay the return dates established by this ruling.4 I. INTRODUCTION The FTC commenced its investigation into the adequacy of LabMD’s information security practices in January 2010, after a Labmd file had been discovered on a peer-to-peer (“P2P”) file 1 See 16 C.F.R. § 2.7(d)(4).

2 16 C.F.R. § 2.7(f).

3 Id. This ruling is being delivered by e-mail and courier delivery. The e-mail copy is provided as a courtesy, and the deadline by which an appeal to the full Commission would have to be filed should be calculated from the date on which you receive the original letter by courier delivery. 4 Id.

LABMD, INC. 1813 Responses to Petitions to Quash sharing network.5 The file, which Petitioners call the “1,718 File” because it is 1,718 pages long, is a spreadsheet of health insurance billing information for uropathology and microbiology medical tests of around 9,000 patients. It contains highly sensitive information about these consumers, including: •Name;

•Social Security Number;

•Date of birth;

•Health insurance provider and policy number; and •Standardized medical treatment codes.6 Such information can be misused to harm consumers. The purpose of the investigation is to determine whether Petitioners violated the FTC Act by engaging in deceptive or unfair acts or practices relating to privacy or information security. The inquiry is authorized by Resolution File No. P954807, which provides for the use of compulsory process in investigations of potential Section 5 violations involving “consumer privacy and/or data security.”

The investigation began with voluntary information requests for documents and information about LabMD’s information security policies, procedures, practices, and training generally, as well as information about security incidents, including, but not limited to, the discovery of the 1,718 File on P2P networks. In response, Labmd produced hundreds of pages of documents, including supplements and responses to follow-up questions. To complete the investigation, staff requested issuance of CIDs to Labmd and Michael J. Daugherty, LabMD’s President. 5 P2P programs allow users to form networks with others using the same or a compatible P2P program. Such programs allow users to locate and retrieve files of interest to them that are stored on computers of other users on the networks.

6 Labmd Pet., Ex. C, at Fig. 4. Because the Labmd and Daugherty Petitions make the same arguments (the Petitions differ only in details about the submitter), we generally cite only to LabMD’s Petition. VOLUME 153 Responses to Petitions to Quash The Commission issued the CIDs on December 21, 2011. Both require testimony relating to information security policies, practices, training, and procedures. They also include a limited number of interrogatories that require Petitioners to identify documents used by the witnesses to prepare for their testimony.7 The Labmd CID also includes a single document request asking for only those documents that were both identified in response to the CID’s interrogatories and had not been previously produced to staff.8 Petitioners seek to quash or limit the CIDs because, they claim, the CIDs “appear to be premised on” the download of the 1,718 File (hereinafter, the “File disclosure”).9 Their principal objection relates to the merits of the investigation. In particular, they contend (without citing any authority) that the Commission must have a “justifiable” belief that a law violation has occurred before it can issue CIDs, and that the File disclosure cannot support such a belief. They claim that the File disclosure occurred not because Labmd failed to implement reasonable and appropriate security measures, but because the company was the victim of an illegal intrusion conducted by Tiversa (a P2P information technology and investigation services company) and Dartmouth College faculty using Tiversa’s powerful P2P searching technology.10 Further, Petitioners argue that no actual harm to consumers resulted from the File disclosure.11 Accordingly, they contend that investigating either the File disclosure or the adequacy of LabMD’s security practices is 7 Labmd Pet., Ex. A.

8 Labmd Pet., Ex. A.

9 Labmd Pet., at 1.

10 Petitioners claim that in the course of a Department of Homeland Securityfunded research project, Professor M. Eric Johnson of Dartmouth College’s Tuck School of Business and Tiversa used Tiversa’s P2P searching technology to search for and then download the file. Labmd Pet., at 3-4, 7, & Ex. F, at 10- 12.

11 The Petitions claim that there is no allegation of actual consumer injury from the File disclosure. Labmd Pet., at 7.

LABMD, INC. 1815 Responses to Petitions to Quash improper because no law violation can have occurred, and that the CIDs therefore should be quashed.12 As discussed below, these arguments are undermined by: (1) the obvious point that an investigation necessarily must precede assessment of whether there is reason to believe a law violation may have occurred (in any matter); (2) the scope of the authorizing resolution; and (3) the language of the FTC Act. The resolution authorizes use of compulsory process in an investigation to determine whether Petitioners engaged in deceptive or unfair practices related to privacy or security. Petitioners’ focus on the File disclosure is misplaced – it may bear on the adequacy of LabMD’s security practices under the FTC Act but does not establish the investigation’s scope under the resolution.13 Further, in such an investigation Section 5 directs the Commission to consider whether security practices are unfair because they create a sufficient risk of harm, even if no harm has been reported.

Petitioners make two additional arguments in support of their Petitions. First, they argue that the resolution authorizing the CIDs did not provide them with sufficient notice of the purpose and scope of the investigation. Second, they argue that the FTC is without jurisdiction to pursue this investigation. Both of these additional arguments are equally without merit. II. ANALYSIS A. The applicable legal standards.

Compulsory process such as a CID is proper if the inquiry is within the authority of the agency, the demand is not too indefinite and the information sought is reasonably relevant to the 12 Labmd Pet., at 7-8.

13 See, e.g., CVS Caremark Corp., No. 072-3119, at 4 (Dec. 3, 2008) (confirming that the scope of an investigation authorized by Resolution P954807 properly included all of CVS’ “consumer privacy and data security practices” (including its computer security practices) and could not be limited (as the company argued) to just known incidents of unauthorized disposal of paper documents in dumpsters).

VOLUME 153 Responses to Petitions to Quash inquiry, as that inquiry is defined by the investigatory resolution.14 Agencies have wide latitude to determine what information is relevant to their law enforcement investigations and are not required to have “a justifiable belief that wrongdoing has actually occurred,” as Petitioners claim.15 As the D.C. Circuit has stated, “The standard for judging relevancy in an investigatory proceeding is more relaxed than in an adjudicatory one . . . . The requested material, therefore, need only be relevant to the investigation – the boundary of which may be defined quite generally, as it was in the Commission’s resolution here.”16 Agencies thus have “extreme breadth” in conducting their investigations,17 and “in light of [this] broad deference . . ., it is essentially the respondent’s burden to show that the information is irrelevant.”18 B. The CIDs satisfy the foregoing standards. Petitioners argue that the CIDs are improper for several reasons. In particular, they claim no law violation could have occurred, by arguing that: (1) not even “perfect” security measures (let alone the reasonable security measure standard the 14 United States v. Morton Salt Co., 338 U.S. 632, 652 (1950); FTC v. Invention Submission Corp., 965 F.2d 1086, 1088 (D.C. Cir. 1992); FTC v. Texaco, Inc., 555 F.2d 862, 874 (D.C. Cir. 1977). 15 Labmd Pet., at 6. See, e.g., Morton Salt, 338 U.S. at 642-43 (“[Administrative agencies have] a power of inquisition, if one chooses to call it that, which is not derived from the judicial function. It is more analogous to the Grand Jury, which does not depend on a case or controversy for power to get evidence but can investigate merely on suspicion that the law is being violated, or even just because it wants an assurance that it is not.”). 16 Invention Submission, 965 F.2d at 1090 (emphasis in original, internal citations omitted) (citing FTC v. Carter, 636 F.2d 781, 787-88 (D.C. Cir. 1980), and Texaco, 555 F.2d at 874 & n.26). 17 Linde Thomsen Langworthy Kohn & Van Dyke, P.C. v. Resolution Trust Corp., 5 F.3d 1508, 1517 (D.C. Cir. 1993) (citing Texaco, 555 F.2d at 882). 18 Invention Submission, 965 F.2d at 1090 (citing Texaco, 555 F.2d at 882) (“burden of showing that the request is unreasonable is on the subpoenaed party”). Accord FTC v. Church & Dwight Co., 756 F. Supp. 2d 81, 85 (D.D.C. 2010).

LABMD, INC. 1817 Responses to Petitions to Quash Commission uses to determine whether a law violation may have occurred) could have prevented the File disclosure because Tiversa’s technology “can penetrate even the most robust network security,”19 and (2) no actual injury resulted from the File disclosure.

The Commission is not required, as a precondition to conducting a law enforcement investigation, to make a showing that it is likely that a law violation has occurred. The D.C. Circuit confirmed this point in FTC v. Texaco, Inc., when it stated, “[I]n the pre-complaint stage, an investigating agency is under no obligation to propound a narrowly focused theory of a possible future case . . . . The court must not lose sight of the fact that the agency is merely exercising its legitimate right to determine the facts, and that a complaint may not, and need not, ever issue.”20 Here, Petitioners seek to quash the CIDs by asserting that LabMD’s practices must have been reasonable under the FTC Act because the 1,718 File was retrieved using Tiversa’s powerful searching technology. Accepting this argument would prevent the Commission from exploring relevant issues bearing on reasonableness, such as, for example, whether the company’s security practices could have prevented the 1,718 File from being retrieved using the common P2P programs that are used by millions of computer users each day or whether there were readily available security measures Labmd did not implement that would have prevented even Tiversa’s technology from successfully retrieving the file. Although such evidence (if it exists at all) could undermine their reasonableness claim, Petitioners nonetheless argue that the Commission cannot use CIDs to investigate whether the evidence exists unless it already has reason to believe it does exist. For this reason, Petitioners’ argument that the strength of Tiversa’s P2P searching technology 19 Labmd Pet., at 7.

20 555 F.2d 862, 874 (D.C. Cir. 1977). This holding from Texaco has been repeatedly reaffirmed, most recently in FTC v. Church & Dwight, 747 F. Supp. 2d 3, 6, aff’d, 2011 U.S. App. LEXIS 24587 (D.C. Cir. Dec. 13, 2011). 21 15 U.S.C. § 45(n) (an unfair practice is one that “causes or is likely to cause substantial injury to consumers”); see also FTC Policy Statement on Unfairness, 104 F.T.C. 949, 1073 & n.15 (1984). VOLUME 153 Responses to Petitions to Quash precludes the possibility that a law violation occurred, regardless of the state of LabMD’s security, must fail. Similarly, Petitioners’ assertion that no law violation can have occurred because no actual harm has been shown also fails because, under Section 5, a failure to implement reasonable security measures may be an unfair act or practice if the failure is likely to cause harm. No showing of actual harm is needed.21 Both arguments conflate the purpose of a CID with the purpose of a future potential complaint. A CID can only compel information necessary for an investigation, and the investigation may or may not result in allegations of a law violation.22 Additionally, Petitioners have claimed that the CIDs are burdensome, but they have not come forward with any support for these assertions. Instead, they make only bald statements that the CIDs are “highly burdensome,” “unduly burdensome,” “costly and burdensome,” and “deeply burdensome.”23 Having offered no factual information about the alleged burdens of complying with 22 Petitioners also argue that the CIDs are improper for other reasons. They claim that because security issues posed by P2P programs were common (according to Tiversa), such issues could not constitute an unfair or deceptive practice in violation of the FTC Act. Labmd Pet., at 7-8 & n.34. This argument is unavailing. The fact that a particular practice may be pervasive or widespread has no bearing on whether the FTC may investigate it as also deceptive or unfair. Indeed, accepting Petitioners’ argument would confine the FTC to investigating only those activities that were rare or uncommon, thus crippling the agency’s law enforcement mission. Along the same lines, Petitioners contend that the risks of P2P technology, and the resulting potential liabilities to businesses, were not known in 2008, when the File disclosure occurred. In support of this claim, they assert that the FTC did not notify businesses or publish guidance about P2P until 2010. Labmd Pet., at 8. In fact, many, including the FTC, warned about the risks presented by P2P programs years before the File disclosure occurred. See, e.g., FTC Staff Report, “Peer-to- Peer File Sharing Technology: Consumer Protection and Competition Issues” (June 2005), available at http://www.ftc.gov/reports/ p2p05/050623p2prpt.pdf; Prepared Statement of the Federal Trade Commission Before The Committee on Oversight and Government Reform, United States House of Representatives (July 24, 2007) (discussing P2P programs and risks), available at http://www.ftc.gov/os/testimony/P034517p2pshare.pdf. 23 Labmd Pet., at 7, 9, & 10.

LABMD, INC. 1819 Responses to Petitions to Quash the CIDs, Petitioners have not sustained their burden to demonstrate that the CIDs are unduly burdensome.24 Such a showing would be difficult here in any event. Notwithstanding Petitioners’ description, the CIDs call primarily for testimony, not documents. Thus, it seems unlikely that compliance would require large-scale or time-consuming document production. Furthermore, to the extent that the CIDs call for narrative responses, they merely require Petitioners to identify documents related to the requested testimony. In fact, there is only one specification that requires the production of documents, and even that specification is limited to documents identified in response to the interrogatories to the extent they were “not already been produced to the FTC.”25 Finally, Petitioners, without explaining its relevance, contend that the timing of the CIDs is “troubling,” coming after LabMD’s conduct had been reviewed by two congressional committees, and after Labmd filed suit against Tiversa and others alleging conversion and trespass, among other violations, based on the File disclosure in 2008.26 Though Petitioners seem to believe that there is some connection between their rejection of Tiversa’s offer to provide Labmd with information security services, their subsequent lawsuit, and the FTC’s investigation, the chronology of the investigation does not support such a conclusion. The FTC first contacted Labmd for information in January 2010, well 24 See, e.g., Texaco, 555 F.2d at 882 (“The burden of showing that the request is unreasonable is on the subpoenaed party.”) (citing United States v. Powell, 379 U.S. 48, 58 (1964)); accord EEOC v. Maryland Cup Corp., 785 F.2d 471, 476 (4th Cir. 1986) (subpoena is enforceable absent a showing by recipient that the requests are unduly burdensome); FTC v. Standard American, Inc., 306 F.2d 231, 235 (3d Cir. 1962) (recipient has responsibility to show burden and must make “a record . . . of the measure of their grievance rather than ask [the court] to assume it”); In re Natl Claims Serv., Inc., 125 F.T.C. 1325, 1328-29 (1998) (FTC ruling that petition to quash must substantiate burden with specific factual detail).

25 Labmd Pet., Ex. A.

26 Labmd Pet., at 9 & Ex. F.

VOLUME 153 Responses to Petitions to Quash before Labmd filed its lawsuit against Tiversa in October 2011.27 Moreover, the claim that LabMD’s conduct was reviewed by congressional committees does not appear to be based on evidence presented in the Petitions. Although Petitioners have attached as exhibits three instances of congressional testimony by Tiversa, none identifies Labmd by name or discusses the specifics of the File disclosure.

C. The resolution provides sufficient notice of the purpose and scope of the FTC’s investigation.

Under the FTC Act, a CID is proper when it “state[s] the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.”28 It is well-established that the resolution authorizing the process provides the requisite statement of the purpose and scope of the investigation,29 and also that the resolution may define the investigation generally, need not state the purpose with specificity, and need not tie it to any particular theory of violation.30 Despite this, Petitioners object that Resolution File No. P954807 did not provide sufficient notice of the purpose and scope of the investigation, and they further claim that this resolution is inadequate under the standard developed by the D.C. Circuit in FTC v. Carter, 636 F.2d 781, 788 (D.C. Cir. 1980).31 27 We note further that this suit came more than three years after the solicitations Petitioners complain of in their Petitions. Labmd Pet., Ex. F, at 1, 17-23.

28 15 U.S.C. § 57b-1(c)(2).

29 Invention Submission., 965 F.2d at 1088; accord Texaco, 555 F.2d at 874; FTC v. Carter, 636 F.2d 781, 789 (D.C. Cir. 1980); FTC v. Anderson, 631 F.2d 741, 746 (D.C. Cir. 1979).

30 Invention Submission, 965 F.2d at 1090; Texaco, 555 F.2d at 874 & n.26; FTC v. Natl Claims Serv., Inc., No. S 98-283 FCD DAD, 1999 WL 819640, at *2 (E.D. Cal. Feb. 9, 1999) (citing EPA v. Alyeska Pipeline Serv. Co., 836 F.2d 443, 477 (9th Cir. 1988)).

31 Labmd Pet., at 10-12.

LABMD, INC. 1821 Responses to Petitions to Quash Petitioners’ first argument reads the governing standard too narrowly. Resolution File No. P954807 authorizes the use of compulsory process:

to determine whether unnamed persons, partnerships, corporations, or others are engaged in, or may have engaged in, deceptive or unfair acts or practices related to consumer privacy and/or data security, in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended.32 This general statement of the purpose and scope of the investigation is more than sufficient under the standard for such resolutions, and courts have enforced compulsory process issued under similarly broad resolutions.33 Petitioners’ reliance on Carter is also misplaced. While Carter held that a bare reference to Section 5, without more, “would not serve very specific notice of purpose,” the Court approved the resolution at issue in that case, noting that it also referred to specific statutory provisions of the Cigarette Labeling and Advertising Act, and further related it to the subject matter of the investigation.34 With this additional information, the Court felt “comfortably apprised of the purposes of the investigation and the subpoenas issued in its pursuit . . . .”35 32 Labmd Pet., Ex. A.

33 See FTC v. Natl Claims Serv., 1999 WL 819640, at *2 (finding omnibus resolution referring to FTC Act and Fair Credit Reporting Act sufficient); FTC v. O’Connell Assoc., Inc., 828 F. Supp. 165, 171 (E.D.N.Y. 1993) (enforcing CIDs issued pursuant to omnibus resolution). The Commission has repeatedly rejected similar arguments about such omnibus resolutions. See, e.g., Firefighters Charitable Found., No. 102-3023, at 4 (Sept. 23, 2010); D. R. Horton, Inc., Nos. 102-3050, 102-3051, at 4 (July 12, 2010); CVS Caremark Corp., No. 072-3119, at 4 (Dec. 3, 2008). 34 Carter, 636 F.2d at 788.

35 Id.

VOLUME 153 Responses to Petitions to Quash The resolution here, like the one in Carter, does not cite solely to Section 5, but also recites the subject matter of the investigation: “deceptive or unfair acts or practices related to consumer privacy and/or data security.” Since the resolution here discloses the subject matter of the investigation in addition to invoking Section 5, the resolution provides notice sufficient under Carter of the purpose and scope of the investigation. As a final note, the history of the investigation itself undermines Petitioners’ argument that the present CIDs do not sufficiently advise them of the nature and scope of the investigation. Petitioners have been under investigation since January 2010 and have engaged in repeated discussions with staff. At no point have Petitioners indicated they did not understand the purpose or scope; in fact, Petitioners have already produced hundreds of pages of documents in response to staff requests. Moreover, the Petitions under consideration here present highly detailed and factual arguments going to the very merits of the investigation. The Commission has previously found that such interactions may be considered along with the resolution in evaluating the notice provided to Petitioners.36 D. Petitioners’ challenge to the FTC’s regulatory authority is premature and without basis. Petitioners’ final argument is that the FTC lacks jurisdiction to conduct the instant investigation.37 Petitioners assert that Labmd is a health care company and that the information disclosed in the 36 Assoc. First Capital Corp., 127 F.T.C. 910, 915 (1999) ( “[T]he notice provided in the compulsory process resolutions, CIDs and other communications with Petitioner more than meets the Commission’s obligation of providing notice of the conduct and the potential statutory violations under investigation.”).

37 Petitioners also claim that the resolution does not meet the requirements established by the FTC’s Operating Manual. Labmd Pet., at 10. As discussed above, by disclosing the statutory basis and subject matter of the investigation, the resolution does provide notice as required by the Operating Manual. That said, the Operating Manual, by its own terms, is advisory. It is not a “basis for nullifying any action of the Commission or the staff.” Operating Manual, § 1.1.1.1. See also FTC v. Natl Bus. Consultants, Inc. 1990 U.S. Dist. LEXIS 3105, 1990-1 Trade Cas. (CCH) ¶68,984, at *29 (E.D. La. March 19, 1990). LABMD, INC. 1823 Responses to Petitions to Quash 1,718 File is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). Accordingly, they contend, the adequacy of their security practices with respect to this information is subject to the exclusive jurisdiction of HHS.38 As an initial matter, it is well-established that challenges to the FTC’s jurisdiction are not properly raised through challenges to investigatory process. As the D.C. Circuit stated: “Following Endicott [Johnson Corp. v. Perkins, 317 U.S. 501, 509 (1943)], courts of appeals have consistently deferred to agency determinations of their own investigative authority, and have generally refused to entertain challenges to agency authority in proceedings to enforce compulsory process.”39 The reasons for such a rule are obvious. If a party under investigation could raise substantive challenges in an enforcement proceeding, before the agency has obtained the information necessary for its case – essentially requiring the FTC to litigate an issue before it can learn about it – then the FTC’s investigations would be foreclosed or substantially delayed.40 Thus, Petitioners’ basic challenge to the FTC’s jurisdiction is premature and will not support quashing the instant CIDs.

In any event, the claim that HHS has exclusive jurisdiction to investigate privacy and data security issues involving PHI is without basis. Petitioners essentially invoke the doctrine of implied repeal to assert that HIPAA and its Privacy and Security Rules displace FTC jurisdiction. But implied repeal is “strongly 38 Labmd Pet., at 12-13.

39 FTC v. Ken Roberts Co., 276 F.3d 583, 586 (D.C. Cir. 2001) (citing United States v. Sturm, Ruger & Co., 84 F.3d 1, 5 (1st Cir. 1996)); United States v. Construction Prods. Research, Inc., 73 F.3d 464, 468-73 (2d Cir. 1996); EEOC v. Peat, Marwick, Mitchell & Co., 775 F.2d 928, 930 (8th Cir. 1985); Donovan v. Shaw, 668 F.2d 985, 989 (8th Cir. 1982); FTC v. Ernstthal, 607 F.2d 488, 490 (D.C. Cir. 1979); accord Oklahoma Press Publ’g Co. v. Walling, 327 U.S. 186, 213-14 (1946).

40 Texaco, 555 F.2d at 879.

VOLUME 153 Responses to Petitions to Quash disfavored,” for two reasons.41 First, courts have recognized that agencies may have overlapping or concurrent jurisdiction, and thus that the same issues may be addressed and the same parties proceeded against simultaneously by more than one agency.42 Second, courts rarely hold that one federal statute impliedly repeals another because “‘when two statutes are capable of coexistence, it is the duty of the courts . . . to regard each as effective.’”43 Thus, repeals by implication will only be found where the Congressional intent to effect such a repeal is “clear and manifest.”44 Petitioners can point to no such “clear or manifest” evidence that Congress intended HIPAA or its rules to displace the FTC Act. The authority Petitioners cite for the proposition that HHS has exclusive jurisdiction does not address such repeal.45 To the contrary, there is ample evidence against such implied repeal. For one, the same authority cited by Petitioners – the preamble to the Privacy Rule – expressly provides that entities covered by that Rule are “also subject to other federal statutes and regulations.”46 41 Galliano v. United States Postal Serv., 836 F.2d 1362, 1369 (D.C. Cir. 1988).

42 FTC v. Cement Inst., 333 U.S. 683, 694 (1948); see also Texaco, 555 F.2d at 881 (“[T]his is an era of overlapping agency jurisdiction under different statutory mandates.”); Thompson Med. Co. v. FTC, 791 F.2d 189, 192 (D.C. Cir. 1986). Because agencies have overlapping jurisdiction, they often work together. For instance, the FTC and HHS collaborated on the investigation of CVS Caremark Corporation. See CVS Caremark Corp., No. 072-3119, at 7 (Aug. 6, 2008).

43 Radzanower v. Touche Ross & Co., 426 U.S. 148, 155 (1976) (quoting Morton v. Mancari, 417 U.S. 535, 551 (1974)). 44 Id. at 154.

45 Labmd Pet., at 12 (citing 65 Fed. Reg. 82,462, 82,472 (Dec. 28, 2000)). This Federal Register notice is the Notice of Public Rulemaking for the Privacy and Security Rules under HIPAA. The excerpt cited by Petitioners does not address the scope of HHS’ enforcement jurisdiction, but rather discusses the delegation of enforcement authority from the Secretary of HHS to HHS’ Office for Civil Rights. 65 Fed. Reg. 82,472 (Dec. 28, 2000). 46 65 Fed. Reg. 82,462, 82,481 (Dec. 28, 2000). LABMD, INC. 1825 Responses to Petitions to Quash Also, this preamble includes an “Implied Repeal Analysis,” which is silent as to any implied repeal of the FTC Act.47 Recent legislation shows that, if anything, Congress intended the FTC and HHS to work collaboratively to address potential privacy and data security risks related to health information. The American Recovery and Reinvestment Act of 2009, for instance, required HHS and the FTC to develop harmonized rules for data breach notifications by HIPAA-covered and non-HIPAA-covered entities, respectively. See 74 Fed. Reg. 42,962, 42,962-63 (Aug. 25, 2009). Thus, HIPAA and its Rules do not serve to repeal FTC jurisdiction, which is overlapping and concurrent to HHS’. This is particularly appropriate where, as here, the consumer information at issue included more than just health information. The consumer information exposed in the 1,718 File also included names, Social Security numbers, and dates of birth. While this information can be considered PHI under HIPAA when combined with health information, the information clearly exposes consumers to the risk of identity theft and is exactly the kind of sensitive personal information that the Commission is charged with protecting under Section 5 of the FTC Act and other statutes. Petitioners have provided no proper basis to challenge the investigation as an exercise of the Commission’s jurisdiction under these authorities.

III. CONCLUSION AND ORDER For the foregoing reasons, IT IS HEREBY ORDERED THAT Labmd, Inc.’s Petition to Limit or Quash the Civil Investigative Demand be, and hereby is, DENIED; and IT IS FURTHER ORDERED THAT Michael J. Daugherty’s Petition to Limit or Quash the Civil Investigative Demand be, and hereby is, DENIED; and IT IS FURTHER ORDERED THAT Commission staff may reschedule the investigational hearings of Labmd and Michael J. Daugherty at such dates and times as they may direct in writing, 47 Id. at 82,481-487.

VOLUME 153 Responses to Petitions to Quash in accordance with the powers delegated to them by 16 C.F.R. § 2.9(b)(6); and IT IS FURTHER ORDERED THAT all other responses to the specifications in the Civil Investigative Demands to Labmd, Inc. and Michael J. Daugherty must now be produced on or before May 11, 2012.

By direction of the Commission.

GOOGLE INC. 1827 Responses to Petitions to Quash GOOGLE INC.

FTC File No. 111 0163 – Decision, June 18, 2012 RESPONSE TO SAMSUNG TELECOMMUNICATIONS AMERICA, LLC’S PETITION TO LIMIT SUBPOENA DUCES TECUM DATED FEBRUARY 9, 2012 Dear Messrs. Huffman and Stoltz and Ms. Williams: On April 23, 2012, the Federal Trade Commission (“FTC” or “Commission”) received the above Petition filed by Samsung Telecommunications America, LLC (“Samsung”). This letter advises you of the Commission’s disposition of the Petition, effected through this ruling by Commissioner Julie Brill, acting as the Commission’s delegate.1 For the reasons explained below, the Petition is denied. You may request review of this ruling by the full Commission.2 Any such request must be filed with the Secretary of the Commission within three days after service of this letter ruling.3 The timely filing of a request for review by the full Commission shall not stay the return dates established by this ruling.4 I. INTRODUCTION In 2011, in connection with an investigation of Google, Inc., the FTC issued a resolution authorizing its staff to use compulsory process 1 See 16 C.F.R. § 2.7(d)(4).

2 16 C.F.R. § 2.7(f).

3 Id. This ruling is being delivered by e-mail and courier delivery. The e-mail copy is provided as a courtesy, and the deadline by which an appeal to the full Commission would have to be filed should be calculated from the date on which you receive the original letter by courier delivery. 4 Id.

VOLUME 153 Responses to Petitions to Quash [t]o determine whether Google Inc. may be engaging, or may have engaged, in any unfair methods of competition in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended, by monopolizing, attempting to monopolize, or restraining competition in online or mobile search, search advertising, or Internetrelated goods or services.5 On February 9, 2012, in furtherance of the investigation, the Commission issued a third-party subpoena duces tecum (“subpoena”) to Samsung.6 Samsung manufactures and sells mobile phones and devices, many of which are installed with Google’s Android operating system as well as other mobile applications and services developed by Google and Google’s competitors. The subpoena required Samsung to provide the requested documents no later than March 9, 2012.7 On or about March 1, 2012, Samsung asked, and received, an extension of the return date to April 9, 2012, conditioned on Samsung producing documents responsive to Specifications 1, 2, and 11, no later than Monday, March 9.8 FTC staff also agreed to obviate the requirement that Samsung obtain and produce documents from its corporate parent in Korea.9 On April 5, 2012, Samsung requested a second extension of the return date.10 In subsequent discussions regarding the need for 5 Petition of Samsung Telecomm. of America, LLC, to Limit Subpoena Duces Tecum, File No. 111-0163, Google, Inc., Att. 1, Exh. A (Apr. 21, 2012) [hereinafter Petition].

6 Id.

7 Id.

8 Id. at Att. 4, Ex. B (E-mail from Gregory Huffman to Melissa Westman- Cherry (Mar. 2, 2012, 12:22 PM); id. at Att. 4, Ex. C (Letter from Melissa Westman-Cherry to Gregory Huffman (Mar. 2, 2012)). 9 Id. at Att. 4, Ex. B (E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar. 2, 2012, 10:27 AM); E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar 2, 2012, 11:55 AM)). 10 Id. at Att. 4, Ex. B (E-mail from Gregory Huffman to Melissa Westman- Cherry (Apr. 5, 2012, 6:15 PM)).

GOOGLE INC. 1829 Responses to Petitions to Quash the extension, Samsung for the first time also asked staff to limit the required response in several respects.11 Specifically, with regard to Specifications 5, 9, and 10, Samsung asked FTC staff to provide a set of keywords that Samsung would then use to search a “limited set” of custodians. Samsung asked staff to offer one set of keywords to reflect Google products and services and a second set of keywords to reflect competing non-Google products and services, both of which it would then run in Boolean searches to find documents containing one or more terms from both sets.12 Samsung also asked staff to accept other limitations, including foregoing a search for informal agreements between Samsung and Google, and restated its request for an extension of the return date.

FTC staff accepted some of Samsung’s proposals, modified the subpoena pursuant to 16 C.F.R. § 2.7(c), and extended the return date to April 23, 2012.13 On April 11, 2012, On April 11, Samsung claimed that their proposed search was going to be unduly burdensome.15 On April 20, 2012, based on the results of the searches it had performed to date, Samsung requested a third extension of time. When staff declined a further extension, Samsung filed the instant petition. 11 Id. at Att. 4, Ex. C (Letter from Melissa Westman-Cherry to Gregory Huffman (Apr. 10, 2012)).

12 Id.

13 Id.

14 Id., at Att. 4, Ex. B (Letter from Melissa Westman-Cherry to Gregory Huffman (Apr. 11, 2012)).

15 Id., at Att. 4, Ex. B. (E-mail from Melissa Westman-Cherry to Gregory Huffman (Apr. 11, 2012, 4:15 PM); E-mail from Richard Rosalez to Melissa Westman-Cherry and Gregory Huffman (Apr. 11, 2012, at 6:45 PM)). VOLUME 153 Responses to Petitions to Quash II. ANALYSIS Samsung’s petition lodges objections to each of the specifications in the subpoena. Among these objections, Samsung claims the specifications: (1) are overly broad or unduly burdensome; (2) seek information not relevant to the investigation or not likely to lead to the discovery of relevant evidence; and (3) include vague terms or fail to seek documents with sufficient particularity.16 For the following reasons, these objections fail. A. Samsung has not supported its claims of undue burden and overbreadth.

We conclude that Samsung has failed to support its claims that the subpoena is overly broad and unduly burdensome. As the courts have clearly stated, “[a]ny subpoena places a burden on the person to whom it is directed. Time must be taken from normal activities and resources must be committed to gathering the information necessary to comply.”17 Thus, the recipient of process bears the burden of demonstrating that this burden is undue.18 Specifically, a recipient of FTC investigative process must show that compliance threatens to seriously impair or 16 Samsung objects generally that the subpoena calls for documents in the possession, custody, and control of its corporate parent in Korea, and goes on to assert that it cannot access these documents and therefore should not have to produce them. FTC staff has already agreed that Samsung need not obtain documents from its Korean parent. Id. at Att. 4, Ex. B (E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar. 2, 2012, 10:27 AM); E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar 2, 2012, 11:55 AM)). As this issue has been resolved, we need not address it here. 17 FTC v. Shaffner, 626 F.2d 32, 38 (7th Cir. 1980); accord FTC v. Texaco, 555 F.2d 862, 882 (D.C. Cir. 1977).

18 Texaco, 555 F.2d at 882; In re Nat_l Claims Serv., Inc., 125 F.T.C. 1325, 1328-29 (1998). See also EEOC v. Maryland Cup Corp., 785 F.2d 471, 476 (4th Cir. 1986); FTC v. Standard American, Inc., 306 F.2d 231, 235 (3d Cir. 1962) (recipients of subpoena must show unreasonableness of the Commission_s demand and make a record to show the “measure of their grievance rather than [asking the court] to assume it.”) (citing United States v. Morton Salt Co., 338 U.S. 632, 654 (1950); Okla. Press Publ_g Co. v. Walling, 327 U.S. 186, 217-18 (1946)).

GOOGLE INC. 1831 Responses to Petitions to Quash unduly disrupt the normal operations of its business.19 Likewise, investigative process is not unreasonably broad where the breadth of the inquiry is commensurate with the magnitude or complexity of a recipient’s business operations.20 Here, Samsung offers essentially three arguments to support its claim of burden.21 First, noting that the subpoena calls for information about mobile phones, Samsung states that it manufactured over 300 different models of mobile phone during the period in question, each with a distinct configuration of software, and that collecting information related to each phone would be unduly burdensome.22 Second, may yield more than one million “hits” of possibly responsive documents that would have to be reviewed and produced.23 Third, Samsung offers a declaration from a litigation support supervisor, who states that this review of the documents identified will require 2000 days of review time, assuming that a single reviewer reviews 500 documents per day (1 reviewer times 19 Shaffner, 626 F.2d at 38; Texaco, 555 F.2d at 882. 20 Texaco, 555 F.2d at 882.

21 The cases Samsung cites for the proposition that requests that ask for “all documents” are overly broad and unreasonable are inapposite. In McKinley v. F.D.I.C., 807 F. Supp. 2d, 1 (D.D.C. 2011), the request at issue was directed to the FDIC under FOIA. The request did not ask for “all documents” but rather “any information available.” Id. at 6-77. The court found that such requests for records that relate “in any way” did not enable FDIC staff to identify responsive records with reasonable effort. Id. In this case, however, FTC staff has not asked Samsung for documents that relate to subjects “in any way.” For the same reason, Judicial Watch, Inc. v. Ex-Im Bank, 108 F. Supp. 2d 19, 27-28 (D.D.C. 2000) is also inapposite. In Judicial Watch, the request at issue asked for contacts between two individuals and “companies, entities, and/or persons related or doing or conducting business in any way with the People's Republic of China.” Id. at 26 (emphasis added). None of the requests in the FTC’s subpoena to Samsung is similarly broad. 22 Petition, supra note 5, at 3-4.

23 Id., at 5.

VOLUME 153 Responses to Petitions to Quash 500 documents/per day times 2,000 days = 1 million documents).24 These arguments do not establish that the subpoena is overly broad or unduly burdensome. Samsung has not provided facts or details, such as reliable estimates of the costs of compliance, to support these claims. Instead, Samsung’s objections to the specifications appear premised on the fact that they may result in many potentially responsive documents. But the volume of potentially responsive documents is not dispositive of the question whether a subpoena is unduly burdensome.25 The searches may have resulted in many “hits,” but ultimately it is Samsung’s responsibility to show that the burden of compliance rises to the high threshold set by cases such as Texaco and Samsung has not offered solid evidence – or even alleged – that compliance here meets that standard.26 Moreover, given the magnitude and complexity of the company’s operations and the breadth of its product line, there is nothing unusual about the possibility that the subpoena potentially calls for many documents related to a large number of mobile devices.27 B. Samsung has not shown that the information requested is irrelevant to this administrative investigation. Samsung has also objected to several specifications on the grounds they fail to seek information relevant to the subject matter of the investigation, or are not likely to lead to the discovery of relevant or admissible evidence.28 As such, 24 Id.., Att. 5.

25 NLRB v. Carolina Food Processors, Inc., 81 F.3d 507, 513-14 (4th Cir. 1996) (“[A] subpoena is not unduly burdensome merely because it requires production of a large number of documents . . . .”). See also F.D.I.C. v. Garner, 126 F.3d 1138, 1145-46 (9th Cir. 1997) (enforcing subpoena that called for over one million documents where recipients failed to demonstrate the requests were unduly burdensome).

26 See, e.g., Texaco, 555 F.2d at 882.

27 Texaco, 555 F.2d at 882.

28 See, e.g., Petition, supra note 5, at 8-10. GOOGLE INC. 1833 Responses to Petitions to Quash Samsung seems to argue that the requirements of the subpoena do not comport with the requirements applicable to discovery requests propounded under the Federal Rules of Civil Procedure.29 However, the Federal Rules of Civil Procedure do not apply to agency investigations. “Unlike a discovery procedure, an administrative investigation is a proceeding distinct from any litigation that may flow from it.”30 As the D.C. Circuit and other courts have recognized, “[t]he standard for judging relevancy in an investigatory proceeding is more relaxed than in an adjudicatory one . . . . The requested material, therefore, need only be relevant to the investigation – the boundary of which may be defined quite generally, as it was in the Commission’s resolution here.”31 Agencies thus have “extreme breadth” in conducting their investigations,32 and “in light of [this] broad deference . . ., it is essentially the respondent’s burden to show that the information is irrelevant.”33 Samsung’s conclusory assertions34 do not satisfy this standard. As stated in the Commission’s investigatory resolution, the purpose of the investigation is to determine whether Google is 29 One such example is Samsung’s claim that the subpoena calls for irrelevant evidence, or evidence that is not reasonably likely to lead to the discovery of relevant or admissible evidence. These objections are premised on Fed. R. Civ. P. 26(b)(1), which addresses the scope of discovery in a civil action. 30 Linde Thomsen Langworthy Kohn & Van Dyke, P.C. v. Resolution Trust Corp., 5 F.3d 1508, 1513 (D.C. Cir. 1993) (citing EEOC v. Deer Valley Unified Sch. Dist., 968 F. 2d 904, 906 (9th Cir. 1992); EEOC v. Univ. of Notre Dame du Lac, 551 F. Supp. 737, 742 (N.D. Ind. 1982), rev’d on other grounds, 715 F.2d 331 (7th Cir. 1983)).

31 FTC v. Invention Submission Corp., 965 F. 2d 1086, 1090 (D.C. Cir. 1992) (emphasis in original; internal citations omitted) (citing FTC v. Carter, 636 F.2d 781, 787-88 (D.C. Cir. 1980); Texaco, 555 F.2d at 874 & n.26)). 32 Linde Thomsen, 5 F.3d at 1517 (citing Texaco, 555 F.2d at 882). 33 Invention Submission Corp., 965 F.2d at 1090 (citing Texaco, 555 F.2d at 882); accord FTC v. Church & Dwight Co., Inc., 756 F. Supp. 2d 81, 85 (D.D.C. 2010).

34 See, e.g., Petition, supra note 5, at 8-13. VOLUME 153 Responses to Petitions to Quash engaged in “unfair methods of competition” by, inter alia, monopolizing, attempting to monopolize, or restraining competition in online or mobile search, search advertising, or Internet-related goods or services. Samsung is a manufacturer of mobile devices that are used by consumers for online or mobile search, for using Internet-related goods and services, and on which consumers receive search advertising. Thus, information about the relationship between Google and Samsung as it relates to those topics is plainly relevant to this investigation, and Samsung has offered nothing to challenge this conclusion. C. The subpoena specifications are not vague and identify the requested documents with sufficient particularity. Samsung also objects to Specifications 5 and 10 on the grounds that they include terms that Samsung finds vague, such as “business strategy,” “consideration, development and use,” or “competes with.” Samsung claims that it cannot identify which documents might be responsive to these requests. Samsung has not shown that these terms have multiple meanings that make it difficult to determine which documents are responsive. Terms such as “business strategy,” or “consideration, development and use” are commonly employed by companies of Samsung’s size and complexity. In particular, we expect that Samsung, a global manufacturer of mobile devices, understands the term “competes with” in the context of mobile products and software. Furthermore, these terms appear in the subpoena in the context of specifications that contain additional guidance as to the limits and scope of the requests. For example, specification 5 includes examples of responsive documents, such as “strategic plans, business plans, marketing plans, advertising plans, pricing plans, technology plans, forecasts, strategies, and decisions; market studies; and presentations to management committees, executive committees, and boards of directors.”35 Instead, it appears that Samsung objects to these terms because they call for many responsive documents, but, as discussed above, without more, this is not a proper basis for an objection.36 For these 35 Id., Att. 1, Ex. A, at 7.

36 Carolina Food Processors, Inc., 81 F.3d at 513-14. GOOGLE INC. 1835 Responses to Petitions to Quash reasons, Samsung’s claim that the subpoena terms are vague or insufficiently particular fails.

III. CONCLUSION AND ORDER For the foregoing reasons, IT IS HEREBY ORDERED THAT Samsung Telecommunications America LLC’s Petition to Limit Subpoena Duces Tecum be, and it hereby is, DENIED; and IT IS FURTHER ORDERED THAT all other responses to the specifications in the subpoena duces tecum must now be produced on or before July 2, 2012. Pursuant to Rule 2.7(c), 16 C.F.R. § 2.7(c), staff has the authority to determine the terms of satisfactory compliance, including allowing Petitioner to abide by previously-reached agreements to limit the production of documents and information responsive to the subpoena duces tecum.

By direction of the Commission.

VOLUME 153 Responses to Petitions to Quash LABMD, INC.

FTC File No. 102 3099 – Decision, June 21, 2012 RESPONSE BY THE FULL COMMISSION TO LABMD, INC.’S AND ITS PRESIDENT, MICHAEL J. DAUGHERTY’S PETITIONS TO LIMIT OR QUASH THE CIVIL INVESTIGATIVE DEMANDS DATED DECEMBER 21, 2011 Dear Mr. Fusco:

This letter advises you of the Commission’s disposition of Labmd, Inc.’s and Michael J. Daugherty’s request dated April 25, 2012, that the full Commission review the denial of their petition to limit or quash civil investigative demands. The Commission issued the CIDs to Labmd and Mr. Daugherty on December 21, 2011. Labmd and Mr. Daugherty filed petitions to limit or quash the CIDs, which were received by the Commission on January 10, 2012. On April 20, 2012, Commissioner Brill directed the issuance of a letter denying both petitions and directing both petitioners to comply by May 11, 2012. That deadline was extended to June 8, 2012 due to emergency circumstances that you brought to the Commission’s attention.1 The Commission affirms the ruling denying the petitions to limit or quash the civil investigative demands. The Commission has independently reviewed Labmd and Mr. Daugherty’s petitions to limit or quash the CIDs, and their requests for full Commission review. The Commission has also reviewed the letter ruling issued by the Commission at the direction of Commissioner Brill, and hereby affirms that ruling, finding its conclusions to be valid and correct.

1 On April 30, 2012, you contacted the Commission’s Office of the Secretary to request additional time to comply with the CID due to emergency circumstances. By letter dated May 7, 2012, the Commission modified the date to June 8, 2012.

LABMD, INC. 1837 Responses to Petitions to Quash Commissioner Rosch generally agrees with the Commission’s decision to enforce the CIDs, but dissents from this ruling to the extent it permits staff to rely on a Labmd document found on a peer-to-peer file sharing network, out of concern about petitioners’ allegations that a third party located this document through wrongdoing and for financially-motivated reasons. In this ruling, we make no findings of fact regarding that third party’s conduct or the admissibility of this document, nor do we need to do so. In upholding the CIDs, the Commission allows staff to continue to use pertinent information—including information from or concerning any Labmd documents made available to users of peer-to-peer file-sharing networks and accessed by any third party—to conduct its data security investigation. Indeed, in our data security investigations, the Commission often uses information obtained by third parties concerning security vulnerabilities of entities that maintain substantial amounts of personal information. Although we understand petitioners have alleged that the third party in question has a financial incentive to use its patented monitoring tool to find information that has been improperly disclosed on peer-to-peer file sharing networks, that does not overcome the Commission’s compelling public interest in seeking to protect consumers’ sensitive health data by pursuing this investigation through all lawful means, including the use of this document. The April 25, 2012 request for full Commission review also requested a hearing on the denial of the petitions. The FTC Rule governing petitions to quash or limit, 16 C.F.R. § 2.7, does not provide for such a hearing, however, and accordingly, this request will be denied.

For the forgoing reasons, IT IS ORDERED THAT the April 20, 2012 letter ruling is AFFIRMED;

IT IS FURTHER ORDERED THAT LabMD’s and Mr. Daugherty’s request for a hearing is DENIED; IT IS FURTHER ORDERED THAT Commission staff may reschedule the investigational hearings of Labmd and Michael J. VOLUME 153 Dissenting Statement Daugherty at such dates and times as they may direct in writing, in accordance with the powers delegated to them by 16 C.F.R. § 2.9(b)(6)(2012); and IT IS FURTHER ORDERED THAT all other responses to the specifications in the Civil Investigative Demands to Labmd, Inc. and Michael J. Daugherty must be produced on or before June 8, 2012.

By direction of the Commission, Commissioner Rosch dissenting, and Commissioner Ohlhausen not participating. Dissenting Statement of Commissioner J. Thomas Rosch I dissent from the Commission’s vote affirming Commissioner Brill’s letter decision, dated April 20, 2012, that denied the petitions of Labmd, Inc. and Michael J. Dougherty to limit or quash the civil investigative demands. I generally agree with Commissioner Brill’s decision to enforce the document requests and interrogatories, and to allow investigational hearings to proceed. As she has concluded, further discovery may establish that there is indeed reason to believe there is Section 5 liability regarding petitioners’ security failings independent of the “1,718 File” (the 1,718 page spreadsheet containing sensitive personally identifiable information regarding approximately 9,000 patients) that was originally discovered through the efforts of Dartmouth Professor M. Eric Johnson and Tiversa, Inc. In my view, however, as a matter of prosecutorial discretion under the unique circumstances posed by this investigation, the CIDs should be limited. Accordingly, without reaching the merits of petitioners’ legal claims, I do not agree that staff should further inquire - either by document request, interrogatory, or investigational hearing - about the 1,718 File. LABMD, INC. 1839 Dissenting Statement Specifically, I am concerned that Tiversa is more than an ordinary witness, informant, or “whistle-blower.” It is a commercial entity that has a financial interest in intentionally exposing and capturing sensitive files on computer networks, and a business model of offering its services to help organizations protect against similar infiltrations. Indeed, in the instant matter, an argument has been raised that Tiversa used its robust, patented peer-to-peer monitoring technology to retrieve the 1,718 File, and then repeatedly solicited Labmd, offering investigative and remediation services regarding the breach, long before Commission staff contacted Labmd. In my view, while there appears to be nothing per se unlawful about this evidence, the Commission should avoid even the appearance of bias or impropriety by not relying on such evidence or information in this investigation. ADVISORY OPINION IN THE MATTER OF NATIONAL CONSUMER LAW CENTER FTC File No. P124802 - Opinion, May 3, 2012 Re: Whether the Holder Rule limits a consumer’s right to an affirmative recovery to circumstances where the consumer can legally rescind the transaction or where the goods or services sold to the consumer are worthless.

Dear Mr. Sheldon and Ms. Carter:

This letter is in response to the National Consumer Law Center’s request for a Commission advisory opinion regarding the Federal Trade Commission’s Trade Regulation Rule Concerning Preservation of Consumers’ Claims and Defenses, 16 C.F.R. § 433, commonly known as the Holder Rule.1 Specifically, you ask the Commission to affirm that the Holder Rule does not limit a consumer’s right to an affirmative recovery to circumstances where the consumer can legally rescind the transaction or where the goods or services sold to the consumer are worthless. Your letter states that even though the plain language of the Rule is clear—which FTC staff confirmed in a 1999 opinion letter2— some courts continue to bar consumers from affirmative recoveries unless rescission is warranted.3 1 Your letter requesting an advisory opinion is co-signed by representatives from Public Citizen, U.S. PIRG, the Center for Responsible Lending, and the National Association of Consumer Advocates. 2 See Attachment, FTC Staff Letter (Sept. 25, 1999). 3 Your letter lists six cases that have been decided since the issuance of the 1999 FTC staff opinion letter that have held that a consumer may only obtain an affirmative recovery against a creditor under the Holder Rule when the seller’s breach is so substantial that rescission and restitution are justified or where the goods or services sold to the consumer are worthless: Rollins v. Drive-1 of Norfolk, Inc., No. 2:06cv375, 2007 WL 602089 (E.D. Va. Feb. 21, 2007); Phillips v. Lithia Motors, Inc., No. 03-3109-HO, 2006 WL 1113608 (D. NATIONAL CONSUMER LAW CENTER 1841 Advisory Opinion The Holder Rule protects consumers who enter into credit contracts with a seller of goods or services by preserving their right to assert claims and defenses against any holder of the contract, even if the original seller subsequently assigns the contract to a third-party creditor. In particular, the Holder Rule requires sellers that arrange for or offer credit to finance consumers’ purchases to include in their credit contracts the following Notice:

ANY HOLDER OF THIS CONSUMER CREDIT CONTRACT IS SUBJECT TO ALL CLAIMS AND DEFENSES WHICH THE DEBTOR COULD ASSERT AGAINST THE SELLER OF GOODS OR SERVICES OBTAINED [PURSUANT HERETO OR] WITH THE PROCEEDS HEREOF. RECOVERY HEREUNDER BY THE DEBTOR SHALL NOT EXCEED AMOUNTS PAID BY THE DEBTOR HEREUNDER.

16 C.F.R. § 433.2.

A creditor or assignee of the contract is thus subject to all claims or defenses that the consumer could assert against the seller. The Holder Rule does not create any new claims or defenses for the consumer; it simply protects the consumer’s existing claims and defenses. The only limitation included in the Rule is that a consumer’s recovery “shall not exceed amounts paid” by the consumer under the contract. Thus, the plain language of the Rule permits a consumer to assert a seller’s misconduct (1) to defend against a creditor’s lawsuit for amounts owed under the contract and/or (2) to maintain a claim against the creditor for a refund of money the Or. Apr. 27, 2006); Costa v. Mauro Chevrolet, Inc., 390 F. Supp. 2d 720 (N.D. Ill. 2005); Comer v. Person Auto Sales, Inc., 368 F. Supp. 2d 478 (M.D.N.C. 2005); Herrara v. North & Kimball Group, Inc., No. 01C7349, 2002 U.S. Dist. LEXIS 2640 (N.D. Ill. Feb. 15, 2002); Bellik v. Bank of America, 869 N.E.2d 1179 (Ill. App. Ct. 2007). You cite Comer as pointedly rejecting the FTC staff opinion letter. Comer notes that the staff letter is “not binding on the Commission.” 368 F. Supp. 2d at 490.

VOLUME 153 Advisory Opinion consumer has already paid under the contract (i.e., an affirmative recovery). Despite the Rule’s plain language, however, some courts have imposed additional limitations on a consumer’s right to affirmative recovery. Beginning with Ford Motor Credit Co. v. Morgan, 536 N.E.2d 587 (Mass. 1989),4 these courts have allowed affirmative recovery only if the consumer is entitled to rescission or similar relief under state law.5 Courts following the Morgan approach have not imposed any similar limitation on a consumer’s right to raise the seller’s misconduct as a defense in a lawsuit.

The Commission affirms that the Rule is unambiguous, and its plain language should be applied.6 No additional limitations on a consumer’s right to an affirmative recovery should be read into the Rule, especially since a consumer would not have notice of those limitations because they are not included in the credit contract. Had the Commission meant to limit recovery to claims subject to rescission or similar remedy, it would have said so in the text of the Rule and drafted the contractual provision 4 In Morgan, the court faced extensive consumer misconduct in connection with the financing of a car purchase. After experiencing problems with the car, the consumer concealed the automobile, removed the battery, removed or deflated the tires, and surrendered the automobile only after being found in contempt by the trial judge. He also delayed the sale of the automobile, during which time it was extensively vandalized, resulting in a total loss that was not recoverable due to the consumer’s failure to obtain insurance. The creditor sued the consumer for the balance due under the contract, and the consumer filed a counterclaim based on the dealer’s misrepresentations. Notably, in contravention of the one express limitation in the Holder Rule, the consumer sought recovery of an amount in excess of what the consumer had paid under the contract. The court ultimately held that the consumer was not entitled to any affirmative recovery, but he did not have to pay the remaining balance due. 536 N.E.2d at 588.

5 See, e.g., n.3, supra.

6 See Qwest Corp. v. Colorado Public Utilities Commu, 656 F.3d 1093, 1099 (10th Cir. 2011) (“We begin with the plain language of the regulation. . . . If the regulation’s language is clear, our analysis ends and we must apply its plain meaning.”) (internal citations and quotations omitted); Lozada v. Dale Baker Oldsmobile, Inc., 91 F. Supp. 2d 1087, 1095 (W.D. Mich. 2000) (“No basis exists for referring to the commentary to understand the meaning of language that is unambiguous on its face.”).

NATIONAL CONSUMER LAW CENTER 1843 Advisory Opinion accordingly. It remains the Commission’s intent that the plain language of the Rule be applied, which many courts have done.7 The purpose of the Holder Rule, as stated in the Rule’s Statement of Basis and Purpose (“SBP”), supports this plain reading. The Commission adopted the Rule to provide recourse to consumers who otherwise would be legally obligated to make full payment to a creditor despite breach of warranty, misrepresentation, or even fraud on the part of the seller.8 The Commission found that “the creditor is always in a better position than the buyer to return seller misconduct costs to sellers, the guilty party,”9 and therefore concluded that “[s]ellers and creditors will be responsible for seller misconduct.”10 Moreover, the Commission considered, but firmly rejected, a suggestion by industry representatives that the Rule be amended so that a consumer “may assert his rights only as a matter of defense or setoff against a claim by the assignee or holder,” finding instead that “[t]he practical and policy considerations which militate against such a limitation on affirmative actions by consumers are 7 See, e.g., Lozada, 91 F. Supp. 2d at 1094-95; Simpson v. Anthony Auto Sales, Inc., 32 F. Supp. 2d 405, 409 n.10 (W.D. La. 1998); Riggs v. Anthony Auto Sales, 32 F. Supp. 2d 411, 416 n.13 (W.D. La. 1998); Beemus v. Interstate Natl Dealer Servs., Inc., 823 A.2d 979, 984-85 (Pa. Super. Ct. 2003); Jaramillo v. Gonzalez, 50 P.3d 554, 561 (N.M. Ct. App. 2002); Scott v. Mayflower Home Improvement Corp., 831 A.2d 564, 573-74 (N.J. Super. Ct. Law Div. 2001).

8 See 40 Fed. Reg. 53506, 53507 (Nov. 18, 1975) (“The rule is directed at what the Commission believes to be an anomaly. . . . The creditor may assert his right to be paid by the consumer despite misrepresentation, breach of warranty or contract, or even fraud on the part of the seller, and despite the fact that the consumer’s debt was generated by the sale.”) 9 Id. at 53523 (emphasis added); see also id. at 53509 (“Between an innocent consumer, whose dealings with an unreliable seller are, at most, episodic, and a finance institution qualifying as ‘a holder in due course,’ the financer is in a better position both to protect itself and to assume the risk of a seller’s reliability.”); id. at 53523 (“We believe that a rule which compels creditors to either absorb seller misconduct costs or return them to sellers, by denying sellers access to cut-off devices, will discourage many of the predatory practices and schemes. . . . The market will be policed in this fashion and all parties will benefit accordingly.”).

10 Id. at 53524.

VOLUME 153 Advisory Opinion far more persuasive.”11 For example, the Commission noted that some consumers may feel compelled to continue payments because of the threat of negative credit reporting and that “a stronger potential consumer remedy will encourage greater policing of merchants by finance institutions.”12 Thus, to give full effect to the Commission’s original intent to shift seller misconduct costs away from consumers, consumers must have the right to recover funds already paid under the contract if such recovery is necessary to fully compensate the consumer for the misconduct—even if rescission of the transaction is not warranted. Otherwise, whether a consumer is able to be fully compensated would depend on how much the consumer paid under the contract at the time of the dispute. For example, consider a consumer who finances the purchase of an automobile, later discovered to be defective, for $10,000 and is entitled to compensation of $3,000 based on the seller’s misrepresentations regarding the condition of the automobile. If the consumer has paid $4,000 under the financing contract and still owes $6,000, the consumer could withhold $3,000 of the balance due and be fully compensated—a defensive posture sanctioned by Morgan. If, however, the consumer has paid $8,000 and owes $2,000, the Morgan approach would permit the consumer to withhold the remaining $2,000 payment, but not affirmatively recover the additional $1,000 that would be necessary to make the consumer whole.13 There is no basis under the plain language and the intent of the Rule for such an anomalous result.

Courts that have followed the Morgan approach have misinterpreted two isolated comments in the SBP that accompanies the Rule. In part, the SBP states that affirmative recovery by the consumer “will only be available where a seller’s breach is so substantial that a court is persuaded that rescission 11 Id. at 53526.

12 Id. at 53527.

13 This example is drawn from Michael Greenfield & Nina Ross, Limits on a Consumer’s Ability to Assert Claims and Defenses Under the FTC’s Holder in Due Course Rule, 46 Bus. Law. 1135, 1140 (1991). NATIONAL CONSUMER LAW CENTER 1845 Advisory Opinion and restitution are justified”14 and that consumers “will not be in a position to obtain an affirmative recovery from a creditor, unless they have actually commenced payments and received little or nothing of value from the seller.”15 However, when read in context of the entire SBP, including the SBP language highlighted above, the two SBP comments cited by Morgan and its progeny do not undermine the plain language of the Rule. As explained by one court that rejected the Morgan approach, “[w]here one or more parts of the [SBP] fully comport with the text of the rule while another, read in a particular way, is at odds with the plain language of the regulation, there exists no basis for giving controlling weight to an interpretation which narrows the language of the rule itself.”16 These statements should be read as practical observations or predictions, instead of as contradicting the Rule. In most instances where there is significant consumer injury associated with seller misconduct but rescission is not warranted, the consumer is likely to find out about the injury shortly after the transaction is consummated, and thus is likely to stop payments before the claim amount is larger than the balance due. In other words, affirmative recoveries will be rare in cases where rescission is not justified because such recoveries occur only if the consumer’s claim is larger than what the consumer still owes on the loan.17 When read in this context, the two SBP comments do not conflict with the rest of the SBP and the plain language of the Rule.

Thus, the Commission affirms the plain language of the Holder Rule and the intent of the Rule as discussed in the entire SBP. Specifically, the Rule places no limits on a consumer’s right to an affirmative recovery other than limiting recovery to a refund of monies paid under the contract. Further, the Rule does 14 40 Fed. Reg. at 53524.

15 Id. at 53527.

16 Lozada, 91 F. Supp. 2d at 1096.

17 See id. at 1095 (noting that the SBP “is susceptible of being understood as a statement of agency prediction that affirmative recoveries will occur only when courts are persuaded that the equities so require and when damages exceed the amount due on the account”); accord Jaramillo, 50 P.3d at 561. VOLUME 153 Advisory Opinion not limit affirmative recovery only to those circumstances where rescission is warranted or where the goods or services sold to the consumer are worthless.

By direction of the Commission.