Labmd, Inc

Text (OCR of the scan; may contain errors)

VOLUME 153

Responses to Petitions to Quash The Commission issued the CIDs on December 21, 2011. Both require testimony relating to information security policies, practices, training, and procedures. They also include a limited number of interrogatories that require Petitioners to identify documents used by the witnesses to prepare for their testimony.⁷ The LabMD CID also includes a single document request asking for only those documents that were both identified in response to the CID’s interrogatories and had not been previously produced to staff.⁸ Petitioners seek to quash or limit the CIDs because, they claim, the CIDs “appear to be premised on” the download of the 1,718 File (hereinafter, the “File disclosure”).9 Their principal objection relates to the merits of the investigation. In particular, they contend (without citing any authority) that the Commission must have a “justifiable” belief that a law violation has occurred before it can issue CIDs, and that the File disclosure cannot support such a belief. They claim that the File disclosure occurred not because LabMD failed to implement reasonable and appropriate security measures, but because the company was the victim of an illegal intrusion conducted by Tiversa (a P2P information technology and investigation services company) and Dartmouth College faculty using Tiversa’s powerful P2P searching technology.10 Further, Petitioners argue that no actual harm to consumers resulted from the File disclosure.11 Accordingly, they contend that investigating either the File disclosure or the adequacy of LabMD’s security practices is 7 LabMD Pet., Ex. A.

8 LabMD Pet., Ex. A.

9 LabMD Pet., at 1.

10 Petitioners claim that in the course of a Department of Homeland Securityfunded research project, Professor M. Eric Johnson of Dartmouth College’s Tuck School of Business and Tiversa used Tiversa’s P2P searching technology to search for and then download the file. LabMD Pet., at 3-4, 7, & Ex. F, at 10- 12.

11 The Petitions claim that there is no allegation of actual consumer injury from the File disclosure. LabMD Pet., at 7.

Responses to Petitions to Quash improper because no law violation can have occurred, and that the CIDs therefore should be quashed.12 As discussed below, these arguments are undermined by: (1) the obvious point that an investigation necessarily must precede assessment of whether there is reason to believe a law violation may have occurred (in any matter); (2) the scope of the authorizing resolution; and (3) the language of the FTC Act. The resolution authorizes use of compulsory process in an investigation to determine whether Petitioners engaged in deceptive or unfair practices related to privacy or security. Petitioners’ focus on the File disclosure is misplaced – it may bear on the adequacy of LabMD’s security practices under the FTC Act but does not establish the investigation’s scope under the resolution.13 Further, in such an investigation Section 5 directs the Commission to consider whether security practices are unfair because they create a sufficient risk of harm, even if no harm has been reported.

Petitioners make two additional arguments in support of their Petitions. First, they argue that the resolution authorizing the CIDs did not provide them with sufficient notice of the purpose and scope of the investigation. Second, they argue that the FTC is without jurisdiction to pursue this investigation. Both of these additional arguments are equally without merit.

II. ANALYSIS

A. The applicable legal standards.

Compulsory process such as a CID is proper if the inquiry is within the authority of the agency, the demand is not too indefinite and the information sought is reasonably relevant to the 12 LabMD Pet., at 7-8.

¹³ See, e.g., CVS Caremark Corp., No. 072-3119, at 4 (Dec. 3, 2008) (confirming that the scope of an investigation authorized by Resolution P954807 properly included all of CVS’ “consumer privacy and data security practices” (including its computer security practices) and could not be limited (as the company argued) to just known incidents of unauthorized disposal of paper documents in dumpsters).

VOLUME 153

Responses to Petitions to Quash inquiry, as that inquiry is defined by the investigatory resolution.14 Agencies have wide latitude to determine what information is relevant to their law enforcement investigations and are not required to have “a justifiable belief that wrongdoing has actually occurred,” as Petitioners claim.15 As the D.C. Circuit has stated, “The standard for judging relevancy in an investigatory proceeding is more relaxed than in an adjudicatory one. . . . The requested material, therefore, need only be relevant to the investigation – the boundary of which may be defined quite generally, as it was in the Commission’s resolution here.”16 Agencies thus have “extreme breadth” in conducting their investigations,17 and “in light of [this] broad deference. . ., it is essentially the respondent’s burden to show that the information is irrelevant.”18 B. The CIDs satisfy the foregoing standards. Petitioners argue that the CIDs are improper for several reasons. In particular, they claim no law violation could have occurred, by arguing that: (1) not even “perfect” security measures (let alone the reasonable security measure standard the 14 United States v. Morton Salt Co., 338 U.S. 632, 652 (1950); FTC v. Invention Submission Corp., 965 F.2d 1086, 1088 (D.C. Cir. 1992); FTC v. Texaco, Inc., 555 F.2d 862, 874 (D.C. Cir. 1977). 15 LabMD Pet., at 6. See, e.g., Morton Salt, 338 U.S. at 642-43 (“[Administrative agencies have] a power of inquisition, if one chooses to call it that, which is not derived from the judicial function. It is more analogous to the Grand Jury, which does not depend on a case or controversy for power to get evidence but can investigate merely on suspicion that the law is being violated, or even just because it wants an assurance that it is not.”). 16 Invention Submission, 965 F.2d at 1090 (emphasis in original, internal citations omitted) (citing FTC v. Carter, 636 F.2d 781, 787-88 (D.C. Cir. 1980), and Texaco, 555 F.2d at 874 & n.26). 17 Linde Thomsen Langworthy Kohn & Van Dyke, P.C. v. Resolution Trust Corp., 5 F.3d 1508, 1517 (D.C. Cir. 1993) (citing Texaco, 555 F.2d at 882). 18 Invention Submission, 965 F.2d at 1090 (citing Texaco, 555 F.2d at 882) (“burden of showing that the request is unreasonable is on the subpoenaed party”). Accord FTC v. Church & Dwight Co., 756 F. Supp. 2d 81, 85 (D.D.C. 2010).

Responses to Petitions to Quash Commission uses to determine whether a law violation may have occurred) could have prevented the File disclosure because Tiversa’s technology “can penetrate even the most robust network security,”19 and (2) no actual injury resulted from the File disclosure.

The Commission is not required, as a precondition to conducting a law enforcement investigation, to make a showing that it is likely that a law violation has occurred. The D.C. Circuit confirmed this point in FTC v. Texaco, Inc., when it stated, “[I]n the pre-complaint stage, an investigating agency is under no obligation to propound a narrowly focused theory of a possible future case. . . . The court must not lose sight of the fact that the agency is merely exercising its legitimate right to determine the facts, and that a complaint may not, and need not, ever issue.”20 Here, Petitioners seek to quash the CIDs by asserting that LabMD’s practices must have been reasonable under the FTC Act because the 1,718 File was retrieved using Tiversa’s powerful searching technology. Accepting this argument would prevent the Commission from exploring relevant issues bearing on reasonableness, such as, for example, whether the company’s security practices could have prevented the 1,718 File from being retrieved using the common P2P programs that are used by millions of computer users each day or whether there were readily available security measures LabMD did not implement that would have prevented even Tiversa’s technology from successfully retrieving the file. Although such evidence (if it exists at all) could undermine their reasonableness claim, Petitioners nonetheless argue that the Commission cannot use CIDs to investigate whether the evidence exists unless it already has reason to believe it does exist. For this reason, Petitioners’ argument that the strength of Tiversa’s P2P searching technology 19 LabMD Pet., at 7.

²⁰ 555 F.2d 862, 874 (D.C. Cir. 1977). This holding from Texaco has been repeatedly reaffirmed, most recently in FTC v. Church & Dwight, 747 F. Supp. 2d 3, 6, aff’d, 2011 U.S. App. LEXIS 24587 (D.C. Cir. Dec. 13, 2011). 21 15 U.S.C. § 45(n) (an unfair practice is one that “causes or is likely to cause substantial injury to consumers”); see also FTC Policy Statement on Unfairness, 104 F.T.C. 949, 1073 & n.15 (1984).

VOLUME 153

Responses to Petitions to Quash precludes the possibility that a law violation occurred, regardless of the state of LabMD’s security, must fail. Similarly, Petitioners’ assertion that no law violation can have occurred because no actual harm has been shown also fails because, under Section 5, a failure to implement reasonable security measures may be an unfair act or practice if the failure is likely to cause harm. No showing of actual harm is needed.21 Both arguments conflate the purpose of a CID with the purpose of a future potential complaint. A CID can only compel information necessary for an investigation, and the investigation may or may not result in allegations of a law violation.22 Additionally, Petitioners have claimed that the CIDs are burdensome, but they have not come forward with any support for these assertions. Instead, they make only bald statements that the CIDs are “highly burdensome,” “unduly burdensome,” “costly and burdensome,” and “deeply burdensome.”23 Having offered no factual information about the alleged burdens of complying with 22 Petitioners also argue that the CIDs are improper for other reasons. They claim that because security issues posed by P2P programs were common (according to Tiversa), such issues could not constitute an unfair or deceptive practice in violation of the FTC Act. LabMD Pet., at 7-8 & n.34. This argument is unavailing. The fact that a particular practice may be pervasive or widespread has no bearing on whether the FTC may investigate it as also deceptive or unfair. Indeed, accepting Petitioners’ argument would confine the FTC to investigating only those activities that were rare or uncommon, thus crippling the agency’s law enforcement mission. Along the same lines, Petitioners contend that the risks of P2P technology, and the resulting potential liabilities to businesses, were not known in 2008, when the File disclosure occurred. In support of this claim, they assert that the FTC did not notify businesses or publish guidance about P2P until 2010. LabMD Pet., at 8. In fact, many, including the FTC, warned about the risks presented by P2P programs years before the File disclosure occurred. See, e.g., FTC Staff Report, “Peer-to- Peer File Sharing Technology: Consumer Protection and Competition Issues” (June 2005), available at http://www.ftc.gov/reports/ p2p05/050623p2prpt.pdf; Prepared Statement of the Federal Trade Commission Before The Committee on Oversight and Government Reform, United States House of Representatives (July 24, 2007) (discussing P2P programs and risks), available at http://www.ftc.gov/os/testimony/P034517p2pshare.pdf. 23 LabMD Pet., at 7, 9, & 10.

Responses to Petitions to Quash the CIDs, Petitioners have not sustained their burden to demonstrate that the CIDs are unduly burdensome.24 Such a showing would be difficult here in any event. Notwithstanding Petitioners’ description, the CIDs call primarily for testimony, not documents. Thus, it seems unlikely that compliance would require large-scale or time-consuming document production. Furthermore, to the extent that the CIDs call for narrative responses, they merely require Petitioners to identify documents related to the requested testimony. In fact, there is only one specification that requires the production of documents, and even that specification is limited to documents identified in response to the interrogatories to the extent they were “not already been produced to the FTC.”25 Finally, Petitioners, without explaining its relevance, contend that the timing of the CIDs is “troubling,” coming after LabMD’s conduct had been reviewed by two congressional committees, and after LabMD filed suit against Tiversa and others alleging conversion and trespass, among other violations, based on the File disclosure in 2008.26 Though Petitioners seem to believe that there is some connection between their rejection of Tiversa’s offer to provide LabMD with information security services, their subsequent lawsuit, and the FTC’s investigation, the chronology of the investigation does not support such a conclusion. The FTC first contacted LabMD for information in January 2010, well 24 See, e.g., Texaco, 555 F.2d at 882 (“The burden of showing that the request is unreasonable is on the subpoenaed party.”) (citing United States v. Powell, 379 U.S. 48, 58 (1964)); accord EEOC v. Maryland Cup Corp., 785 F.2d 471, 476 (4th Cir. 1986) (subpoena is enforceable absent a showing by recipient that the requests are unduly burdensome); FTC v. Standard American, Inc., 306 F.2d 231, 235 (3d Cir. 1962) (recipient has responsibility to show burden and must make “a record. . . of the measure of their grievance rather than ask [the court] to assume it”); In re Nat’l Claims Serv., Inc., 125 F.T.C. 1325, 1328-29 (1998) (FTC ruling that petition to quash must substantiate burden with specific factual detail).

25 LabMD Pet., Ex. A.

26 LabMD Pet., at 9 & Ex. F.

VOLUME 153

Responses to Petitions to Quash before LabMD filed its lawsuit against Tiversa in October 2011.27 Moreover, the claim that LabMD’s conduct was reviewed by congressional committees does not appear to be based on evidence presented in the Petitions. Although Petitioners have attached as exhibits three instances of congressional testimony by Tiversa, none identifies LabMD by name or discusses the specifics of the File disclosure.

C. The resolution provides sufficient notice of the purpose and scope of the FTC’s investigation.

Under the FTC Act, a CID is proper when it “state[s] the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.”28 It is well-established that the resolution authorizing the process provides the requisite statement of the purpose and scope of the investigation,29 and also that the resolution may define the investigation generally, need not state the purpose with specificity, and need not tie it to any particular theory of violation.30 Despite this, Petitioners object that Resolution File No. P954807 did not provide sufficient notice of the purpose and scope of the investigation, and they further claim that this resolution is inadequate under the standard developed by the D.C. Circuit in FTC v. Carter, 636 F.2d 781, 788 (D.C. Cir. 1980).31 27 We note further that this suit came more than three years after the solicitations Petitioners complain of in their Petitions. LabMD Pet., Ex. F, at 1, 17-23.

29 Invention Submission., 965 F.2d at 1088; accord Texaco, 555 F.2d at 874; FTC v. Carter, 636 F.2d 781, 789 (D.C. Cir. 1980); FTC v. Anderson, 631 F.2d 741, 746 (D.C. Cir. 1979).

30 Invention Submission, 965 F.2d at 1090; Texaco, 555 F.2d at 874 & n.26; FTC v. Nat’l Claims Serv., Inc., No. S 98-283 FCD DAD, 1999 WL 819640, at *2 (E.D. Cal. Feb. 9, 1999) (citing EPA v. Alyeska Pipeline Serv. Co., 836 F.2d 443, 477 (9th Cir. 1988)).

31 LabMD Pet., at 10-12.

Responses to Petitions to Quash Petitioners’ first argument reads the governing standard too narrowly. Resolution File No. P954807 authorizes the use of compulsory process: to determine whether unnamed persons, partnerships, corporations, or others are engaged in, or may have engaged in, deceptive or unfair acts or practices related to consumer privacy and/or data security, in or affecting commerce, in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended.32 This general statement of the purpose and scope of the investigation is more than sufficient under the standard for such resolutions, and courts have enforced compulsory process issued under similarly broad resolutions.33 Petitioners’ reliance on Carter is also misplaced. While Carter held that a bare reference to Section 5, without more, “would not serve very specific notice of purpose,” the Court approved the resolution at issue in that case, noting that it also referred to specific statutory provisions of the Cigarette Labeling and Advertising Act, and further related it to the subject matter of the investigation.34 With this additional information, the Court felt “comfortably apprised of the purposes of the investigation and the subpoenas issued in its pursuit. . . .”35 32 LabMD Pet., Ex. A.

³³ See FTC v. Nat’l Claims Serv., 1999 WL 819640, at *2 (finding omnibus resolution referring to FTC Act and Fair Credit Reporting Act sufficient); FTC v. O’Connell Assoc., Inc., 828 F. Supp. 165, 171 (E.D.N.Y. 1993) (enforcing CIDs issued pursuant to omnibus resolution). The Commission has repeatedly rejected similar arguments about such omnibus resolutions. See, e.g., Firefighters Charitable Found., No. 102-3023, at 4 (Sept. 23, 2010); D. R. Horton, Inc., Nos. 102-3050, 102-3051, at 4 (July 12, 2010); CVS Caremark Corp., No. 072-3119, at 4 (Dec. 3, 2008). 34 Carter, 636 F.2d at 788.

³⁵ Id.

VOLUME 153

Responses to Petitions to Quash The resolution here, like the one in Carter, does not cite solely to Section 5, but also recites the subject matter of the investigation: “deceptive or unfair acts or practices related to consumer privacy and/or data security.” Since the resolution here discloses the subject matter of the investigation in addition to invoking Section 5, the resolution provides notice sufficient under Carter of the purpose and scope of the investigation. As a final note, the history of the investigation itself undermines Petitioners’ argument that the present CIDs do not sufficiently advise them of the nature and scope of the investigation. Petitioners have been under investigation since January 2010 and have engaged in repeated discussions with staff. At no point have Petitioners indicated they did not understand the purpose or scope; in fact, Petitioners have already produced hundreds of pages of documents in response to staff requests. Moreover, the Petitions under consideration here present highly detailed and factual arguments going to the very merits of the investigation. The Commission has previously found that such interactions may be considered along with the resolution in evaluating the notice provided to Petitioners.36 D. Petitioners’ challenge to the FTC’s regulatory authority is premature and without basis. Petitioners’ final argument is that the FTC lacks jurisdiction to conduct the instant investigation.37 Petitioners assert that LabMD is a health care company and that the information disclosed in the 36 Assoc. First Capital Corp., 127 F.T.C. 910, 915 (1999) ( “[T]he notice provided in the compulsory process resolutions, CIDs and other communications with Petitioner more than meets the Commission’s obligation of providing notice of the conduct and the potential statutory violations under investigation.”).

37 Petitioners also claim that the resolution does not meet the requirements established by the FTC’s Operating Manual. LabMD Pet., at 10. As discussed above, by disclosing the statutory basis and subject matter of the investigation, the resolution does provide notice as required by the Operating Manual. That said, the Operating Manual, by its own terms, is advisory. It is not a “basis for nullifying any action of the Commission or the staff.” Operating Manual, § 1.1.1.1. See also FTC v. Nat’l Bus. Consultants, Inc. 1990 U.S. Dist. LEXIS 3105, 1990-1 Trade Cas. (CCH) ¶68,984, at *29 (E.D. La. March 19, 1990).

LABMD, INC. 1823

Responses to Petitions to Quash 1,718 File is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). Accordingly, they contend, the adequacy of their security practices with respect to this information is subject to the exclusive jurisdiction of HHS.38 As an initial matter, it is well-established that challenges to the FTC’s jurisdiction are not properly raised through challenges to investigatory process. As the D.C. Circuit stated: “Following Endicott [Johnson Corp. v. Perkins, 317 U.S. 501, 509 (1943)], courts of appeals have consistently deferred to agency determinations of their own investigative authority, and have generally refused to entertain challenges to agency authority in proceedings to enforce compulsory process.”39 The reasons for such a rule are obvious. If a party under investigation could raise substantive challenges in an enforcement proceeding, before the agency has obtained the information necessary for its case – essentially requiring the FTC to litigate an issue before it can learn about it – then the FTC’s investigations would be foreclosed or substantially delayed.40 Thus, Petitioners’ basic challenge to the FTC’s jurisdiction is premature and will not support quashing the instant CIDs.

In any event, the claim that HHS has exclusive jurisdiction to investigate privacy and data security issues involving PHI is without basis. Petitioners essentially invoke the doctrine of implied repeal to assert that HIPAA and its Privacy and Security Rules displace FTC jurisdiction. But implied repeal is “strongly 38 LabMD Pet., at 12-13.

³⁹ FTC v. Ken Roberts Co., 276 F.3d 583, 586 (D.C. Cir. 2001) (citing United States v. Sturm, Ruger & Co., 84 F.3d 1, 5 (1st Cir. 1996)); United States v. Construction Prods. Research, Inc., 73 F.3d 464, 468-73 (2d Cir. 1996); EEOC v. Peat, Marwick, Mitchell & Co., 775 F.2d 928, 930 (8th Cir. 1985); Donovan v. Shaw, 668 F.2d 985, 989 (8th Cir. 1982); FTC v. Ernstthal, 607 F.2d 488, 490 (D.C. Cir. 1979); accord Oklahoma Press Publ’g Co. v. Walling, 327 U.S. 186, 213-14 (1946).

40 Texaco, 555 F.2d at 879.

VOLUME 153

Responses to Petitions to Quash disfavored,” for two reasons.41 First, courts have recognized that agencies may have overlapping or concurrent jurisdiction, and thus that the same issues may be addressed and the same parties proceeded against simultaneously by more than one agency.42 Second, courts rarely hold that one federal statute impliedly repeals another because “‘when two statutes are capable of coexistence, it is the duty of the courts. . . to regard each as effective.’”43 Thus, repeals by implication will only be found where the Congressional intent to effect such a repeal is “clear and manifest.”44 Petitioners can point to no such “clear or manifest” evidence that Congress intended HIPAA or its rules to displace the FTC Act. The authority Petitioners cite for the proposition that HHS has exclusive jurisdiction does not address such repeal.45 To the contrary, there is ample evidence against such implied repeal. For one, the same authority cited by Petitioners – the preamble to the Privacy Rule – expressly provides that entities covered by that Rule are “also subject to other federal statutes and regulations.”46 41 Galliano v. United States Postal Serv., 836 F.2d 1362, 1369 (D.C. Cir. 1988).

⁴² FTC v. Cement Inst., 333 U.S. 683, 694 (1948); see also Texaco, 555 F.2d at 881 (“[T]his is an era of overlapping agency jurisdiction under different statutory mandates.”); Thompson Med. Co. v. FTC, 791 F.2d 189, 192 (D.C. Cir. 1986). Because agencies have overlapping jurisdiction, they often work together. For instance, the FTC and HHS collaborated on the investigation of CVS Caremark Corporation. See CVS Caremark Corp., No. 072-3119, at 7 (Aug. 6, 2008).

⁴³ Radzanower v. Touche Ross & Co., 426 U.S. 148, 155 (1976) (quoting Morton v. Mancari, 417 U.S. 535, 551 (1974)). 44 Id. at 154.

45 LabMD Pet., at 12 (citing 65 Fed. Reg. 82,462, 82,472 (Dec. 28, 2000)). This Federal Register notice is the Notice of Public Rulemaking for the Privacy and Security Rules under HIPAA. The excerpt cited by Petitioners does not address the scope of HHS’ enforcement jurisdiction, but rather discusses the delegation of enforcement authority from the Secretary of HHS to HHS’ Office for Civil Rights. 65 Fed. Reg. 82,472 (Dec. 28, 2000). 46 65 Fed. Reg. 82,462, 82,481 (Dec. 28, 2000).

LABMD, INC. 1825

Responses to Petitions to Quash Also, this preamble includes an “Implied Repeal Analysis,” which is silent as to any implied repeal of the FTC Act.47 Recent legislation shows that, if anything, Congress intended the FTC and HHS to work collaboratively to address potential privacy and data security risks related to health information. The American Recovery and Reinvestment Act of 2009, for instance, required HHS and the FTC to develop harmonized rules for data breach notifications by HIPAA-covered and non-HIPAA-covered entities, respectively. See 74 Fed. Reg. 42,962, 42,962-63 (Aug. 25, 2009). Thus, HIPAA and its Rules do not serve to repeal FTC jurisdiction, which is overlapping and concurrent to HHS’. This is particularly appropriate where, as here, the consumer information at issue included more than just health information. The consumer information exposed in the 1,718 File also included names, Social Security numbers, and dates of birth. While this information can be considered PHI under HIPAA when combined with health information, the information clearly exposes consumers to the risk of identity theft and is exactly the kind of sensitive personal information that the Commission is charged with protecting under Section 5 of the FTC Act and other statutes. Petitioners have provided no proper basis to challenge the investigation as an exercise of the Commission’s jurisdiction under these authorities.

III. CONCLUSION AND ORDER

For the foregoing reasons, IT IS HEREBY ORDERED THAT LabMD, Inc.’s Petition to Limit or Quash the Civil Investigative Demand be, and hereby is, DENIED; and

IT IS FURTHER ORDERED THAT Michael J.

Daugherty’s Petition to Limit or Quash the Civil Investigative Demand be, and hereby is, DENIED; and

IT IS FURTHER ORDERED THAT Commission staff may reschedule the investigational hearings of LabMD and Michael J. Daugherty at such dates and times as they may direct in writing, 47 Id. at 82,481-487.

VOLUME 153

Responses to Petitions to Quash in accordance with the powers delegated to them by 16 C.F.R. § 2.9(b)(6); and

IT IS FURTHER ORDERED THAT all other responses to the specifications in the Civil Investigative Demands to LabMD, Inc. and Michael J. Daugherty must now be produced on or before May 11, 2012.

By direction of the Commission.

Responses to Petitions to Quash

GOOGLE INC.

FTC File No. 111 0163 – Decision, June 18, 2012

RESPONSE TO SAMSUNG TELECOMMUNICATIONS AMERICA, LLC’S

PETITION TO LIMIT SUBPOENA DUCES TECUM

DATED FEBRUARY 9, 2012

Dear Messrs. Huffman and Stoltz and Ms. Williams: On April 23, 2012, the Federal Trade Commission (“FTC” or “Commission”) received the above Petition filed by Samsung Telecommunications America, LLC (“Samsung”). This letter advises you of the Commission’s disposition of the Petition, effected through this ruling by Commissioner Julie Brill, acting as the Commission’s delegate.¹ For the reasons explained below, the Petition is denied. You may request review of this ruling by the full Commission.² Any such request must be filed with the Secretary of the Commission within three days after service of this letter ruling.³ The timely filing of a request for review by the full Commission shall not stay the return dates established by this ruling.4

I. INTRODUCTION

In 2011, in connection with an investigation of Google, Inc., the FTC issued a resolution authorizing its staff to use compulsory process 1 See 16 C.F.R. § 2.7(d)(4).

³ Id. This ruling is being delivered by e-mail and courier delivery. The e-mail copy is provided as a courtesy, and the deadline by which an appeal to the full Commission would have to be filed should be calculated from the date on which you receive the original letter by courier delivery. 4 Id.

VOLUME 153

Responses to Petitions to Quash [t]o determine whether Google Inc. may be engaging, or may have engaged, in any unfair methods of competition in violation of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, as amended, by monopolizing, attempting to monopolize, or restraining competition in online or mobile search, search advertising, or Internetrelated goods or services.⁵ On February 9, 2012, in furtherance of the investigation, the Commission issued a third-party subpoena duces tecum (“subpoena”) to Samsung.⁶ Samsung manufactures and sells mobile phones and devices, many of which are installed with Google’s Android operating system as well as other mobile applications and services developed by Google and Google’s competitors. The subpoena required Samsung to provide the requested documents no later than March 9, 2012.7 On or about March 1, 2012, Samsung asked, and received, an extension of the return date to April 9, 2012, conditioned on Samsung producing documents responsive to Specifications 1, 2, and 11, no later than Monday, March 9.8 FTC staff also agreed to obviate the requirement that Samsung obtain and produce documents from its corporate parent in Korea.⁹ On April 5, 2012, Samsung requested a second extension of the return date.10 In subsequent discussions regarding the need for 5 Petition of Samsung Telecomm. of America, LLC, to Limit Subpoena Duces Tecum, File No. 111-0163, Google, Inc., Att. 1, Exh. A (Apr. 21, 2012) [hereinafter Petition].

⁶ Id.

⁷ Id.

⁸ Id. at Att. 4, Ex. B (E-mail from Gregory Huffman to Melissa Westman- Cherry (Mar. 2, 2012, 12:22 PM); id. at Att. 4, Ex. C (Letter from Melissa Westman-Cherry to Gregory Huffman (Mar. 2, 2012)). 9 Id. at Att. 4, Ex. B (E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar. 2, 2012, 10:27 AM); E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar 2, 2012, 11:55 AM)). 10 Id. at Att. 4, Ex. B (E-mail from Gregory Huffman to Melissa Westman- Cherry (Apr. 5, 2012, 6:15 PM)).

GOOGLE INC. 1829

Responses to Petitions to Quash the extension, Samsung for the first time also asked staff to limit the required response in several respects.11 Specifically, with regard to Specifications 5, 9, and 10, Samsung asked FTC staff to provide a set of keywords that Samsung would then use to search a “limited set” of custodians. Samsung asked staff to offer one set of keywords to reflect Google products and services and a second set of keywords to reflect competing non-Google products and services, both of which it would then run in Boolean searches to find documents containing one or more terms from both sets.12 Samsung also asked staff to accept other limitations, including foregoing a search for informal agreements between Samsung and Google, and restated its request for an extension of the return date.

FTC staff accepted some of Samsung’s proposals, modified the subpoena pursuant to 16 C.F.R. § 2.7(c), and extended the return date to April 23, 2012.13 On April 11, 2012, On April 11, Samsung claimed that their proposed search was going to be unduly burdensome.15 On April 20, 2012, based on the results of the searches it had performed to date, Samsung requested a third extension of time. When staff declined a further extension, Samsung filed the instant petition. 11 Id. at Att. 4, Ex. C (Letter from Melissa Westman-Cherry to Gregory Huffman (Apr. 10, 2012)).

¹² Id.

¹³ Id.

¹⁴ Id., at Att. 4, Ex. B (Letter from Melissa Westman-Cherry to Gregory Huffman (Apr. 11, 2012)).

¹⁵ Id., at Att. 4, Ex. B. (E-mail from Melissa Westman-Cherry to Gregory Huffman (Apr. 11, 2012, 4:15 PM); E-mail from Richard Rosalez to Melissa Westman-Cherry and Gregory Huffman (Apr. 11, 2012, at 6:45 PM)).

VOLUME 153

Responses to Petitions to Quash

II. ANALYSIS

Samsung’s petition lodges objections to each of the specifications in the subpoena. Among these objections, Samsung claims the specifications: (1) are overly broad or unduly burdensome; (2) seek information not relevant to the investigation or not likely to lead to the discovery of relevant evidence; and (3) include vague terms or fail to seek documents with sufficient particularity.16 For the following reasons, these objections fail. A. Samsung has not supported its claims of undue burden and overbreadth.

We conclude that Samsung has failed to support its claims that the subpoena is overly broad and unduly burdensome. As the courts have clearly stated, “[a]ny subpoena places a burden on the person to whom it is directed. Time must be taken from normal activities and resources must be committed to gathering the information necessary to comply.”17 Thus, the recipient of process bears the burden of demonstrating that this burden is undue.18 Specifically, a recipient of FTC investigative process must show that compliance threatens to seriously impair or 16 Samsung objects generally that the subpoena calls for documents in the possession, custody, and control of its corporate parent in Korea, and goes on to assert that it cannot access these documents and therefore should not have to produce them. FTC staff has already agreed that Samsung need not obtain documents from its Korean parent. Id. at Att. 4, Ex. B (E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar. 2, 2012, 10:27 AM); E-mail from Melissa Westman-Cherry to Gregory Huffman (Mar 2, 2012, 11:55 AM)). As this issue has been resolved, we need not address it here. 17 FTC v. Shaffner, 626 F.2d 32, 38 (7th Cir. 1980); accord FTC v. Texaco, 555 F.2d 862, 882 (D.C. Cir. 1977).

18 Texaco, 555 F.2d at 882; In re Nat_l Claims Serv., Inc., 125 F.T.C. 1325, 1328-29 (1998). See also EEOC v. Maryland Cup Corp., 785 F.2d 471, 476 (4th Cir. 1986); FTC v. Standard American, Inc., 306 F.2d 231, 235 (3d Cir. 1962) (recipients of subpoena must show unreasonableness of the Commission_s demand and make a record to show the “measure of their grievance rather than [asking the court] to assume it.”) (citing United States v. Morton Salt Co., 338 U.S. 632, 654 (1950); Okla. Press Publ_g Co. v. Walling,

327 U.S. 186, 217-18 (1946)).

Responses to Petitions to Quash unduly disrupt the normal operations of its business.19 Likewise, investigative process is not unreasonably broad where the breadth of the inquiry is commensurate with the magnitude or complexity of a recipient’s business operations.20 Here, Samsung offers essentially three arguments to support its claim of burden.21 First, noting that the subpoena calls for information about mobile phones, Samsung states that it manufactured over 300 different models of mobile phone during the period in question, each with a distinct configuration of software, and that collecting information related to each phone would be unduly burdensome.22 Second, may yield more than one million “hits” of possibly responsive documents that would have to be reviewed and produced.23 Third, Samsung offers a declaration from a litigation support supervisor, who states that this review of the documents identified will require 2000 days of review time, assuming that a single reviewer reviews 500 documents per day (1 reviewer times 19 Shaffner, 626 F.2d at 38; Texaco, 555 F.2d at 882. 20 Texaco, 555 F.2d at 882.

21 The cases Samsung cites for the proposition that requests that ask for “all documents” are overly broad and unreasonable are inapposite. In McKinley v. F.D.I.C., 807 F. Supp. 2d, 1 (D.D.C. 2011), the request at issue was directed to the FDIC under FOIA. The request did not ask for “all documents” but rather “any information available.” Id. at 6-77. The court found that such requests for records that relate “in any way” did not enable FDIC staff to identify responsive records with reasonable effort. Id. In this case, however, FTC staff has not asked Samsung for documents that relate to subjects “in any way.” For the same reason, Judicial Watch, Inc. v. Ex-Im Bank, 108 F. Supp. 2d 19, 27-28 (D.D.C. 2000) is also inapposite. In Judicial Watch, the request at issue asked for contacts between two individuals and “companies, entities, and/or persons related or doing or conducting business in any way with the People's Republic of China.” Id. at 26 (emphasis added). None of the requests in the FTC’s subpoena to Samsung is similarly broad. 22 Petition, supra note 5, at 3-4.

VOLUME 153

Responses to Petitions to Quash 500 documents/per day times 2,000 days = 1 million documents).24 These arguments do not establish that the subpoena is overly broad or unduly burdensome. Samsung has not provided facts or details, such as reliable estimates of the costs of compliance, to support these claims. Instead, Samsung’s objections to the specifications appear premised on the fact that they may result in many potentially responsive documents. But the volume of potentially responsive documents is not dispositive of the question whether a subpoena is unduly burdensome.25 The searches may have resulted in many “hits,” but ultimately it is Samsung’s responsibility to show that the burden of compliance rises to the high threshold set by cases such as Texaco and Samsung has not offered solid evidence – or even alleged – that compliance here meets that standard.26 Moreover, given the magnitude and complexity of the company’s operations and the breadth of its product line, there is nothing unusual about the possibility that the subpoena potentially calls for many documents related to a large number of mobile devices.27 B. Samsung has not shown that the information requested is irrelevant to this administrative investigation. Samsung has also objected to several specifications on the grounds they fail to seek information relevant to the subject matter of the investigation, or are not likely to lead to the discovery of relevant or admissible evidence.28 As such, 24 Id.., Att. 5.

²⁵ NLRB v. Carolina Food Processors, Inc., 81 F.3d 507, 513-14 (4th Cir. 1996) (“[A] subpoena is not unduly burdensome merely because it requires production of a large number of documents. . . .”). See also F.D.I.C. v. Garner, 126 F.3d 1138, 1145-46 (9th Cir. 1997) (enforcing subpoena that called for over one million documents where recipients failed to demonstrate the requests were unduly burdensome).

²⁶ See, e.g., Texaco, 555 F.2d at 882.

27 Texaco, 555 F.2d at 882.

28 See, e.g., Petition, supra note 5, at 8-10. Responses to Petitions to Quash Samsung seems to argue that the requirements of the subpoena do not comport with the requirements applicable to discovery requests propounded under the Federal Rules of Civil Procedure.29 However, the Federal Rules of Civil Procedure do not apply to agency investigations. “Unlike a discovery procedure, an administrative investigation is a proceeding distinct from any litigation that may flow from it.”30 As the D.C. Circuit and other courts have recognized, “[t]he standard for judging relevancy in an investigatory proceeding is more relaxed than in an adjudicatory one. . . . The requested material, therefore, need only be relevant to the investigation – the boundary of which may be defined quite generally, as it was in the Commission’s resolution here.”31 Agencies thus have “extreme breadth” in conducting their investigations,32 and “in light of [this] broad deference. . ., it is essentially the respondent’s burden to show that the information is irrelevant.”33 Samsung’s conclusory assertions34 do not satisfy this standard. As stated in the Commission’s investigatory resolution, the purpose of the investigation is to determine whether Google is 29 One such example is Samsung’s claim that the subpoena calls for irrelevant evidence, or evidence that is not reasonably likely to lead to the discovery of relevant or admissible evidence. These objections are premised on Fed. R. Civ. P. 26(b)(1), which addresses the scope of discovery in a civil action. 30 Linde Thomsen Langworthy Kohn & Van Dyke, P.C. v. Resolution Trust Corp., 5 F.3d 1508, 1513 (D.C. Cir. 1993) (citing EEOC v. Deer Valley Unified Sch. Dist., 968 F. 2d 904, 906 (9th Cir. 1992); EEOC v. Univ. of Notre Dame du Lac, 551 F. Supp. 737, 742 (N.D. Ind. 1982), rev’d on other grounds, 715 F.2d 331 (7th Cir. 1983)).

³¹ FTC v. Invention Submission Corp., 965 F. 2d 1086, 1090 (D.C. Cir. 1992) (emphasis in original; internal citations omitted) (citing FTC v. Carter, 636 F.2d 781, 787-88 (D.C. Cir. 1980); Texaco, 555 F.2d at 874 & n.26)). 32 Linde Thomsen, 5 F.3d at 1517 (citing Texaco, 555 F.2d at 882). 33 Invention Submission Corp., 965 F.2d at 1090 (citing Texaco, 555 F.2d at 882); accord FTC v. Church & Dwight Co., Inc., 756 F. Supp. 2d 81, 85

(D.D.C. 2010).

³⁴ See, e.g., Petition, supra note 5, at 8-13.

VOLUME 153

Responses to Petitions to Quash engaged in “unfair methods of competition” by, inter alia, monopolizing, attempting to monopolize, or restraining competition in online or mobile search, search advertising, or Internet-related goods or services. Samsung is a manufacturer of mobile devices that are used by consumers for online or mobile search, for using Internet-related goods and services, and on which consumers receive search advertising. Thus, information about the relationship between Google and Samsung as it relates to those topics is plainly relevant to this investigation, and Samsung has offered nothing to challenge this conclusion. C. The subpoena specifications are not vague and identify the requested documents with sufficient particularity. Samsung also objects to Specifications 5 and 10 on the grounds that they include terms that Samsung finds vague, such as “business strategy,” “consideration, development and use,” or “competes with.” Samsung claims that it cannot identify which documents might be responsive to these requests. Samsung has not shown that these terms have multiple meanings that make it difficult to determine which documents are responsive. Terms such as “business strategy,” or “consideration, development and use” are commonly employed by companies of Samsung’s size and complexity. In particular, we expect that Samsung, a global manufacturer of mobile devices, understands the term “competes with” in the context of mobile products and software. Furthermore, these terms appear in the subpoena in the context of specifications that contain additional guidance as to the limits and scope of the requests. For example, specification 5 includes examples of responsive documents, such as “strategic plans, business plans, marketing plans, advertising plans, pricing plans, technology plans, forecasts, strategies, and decisions; market studies; and presentations to management committees, executive committees, and boards of directors.”35 Instead, it appears that Samsung objects to these terms because they call for many responsive documents, but, as discussed above, without more, this is not a proper basis for an objection.36 For these 35 Id., Att. 1, Ex. A, at 7.

36 Carolina Food Processors, Inc., 81 F.3d at 513-14. Responses to Petitions to Quash reasons, Samsung’s claim that the subpoena terms are vague or insufficiently particular fails.

III. CONCLUSION AND ORDER

For the foregoing reasons, IT IS HEREBY ORDERED THAT Samsung Telecommunications America LLC’s Petition to Limit Subpoena Duces Tecum be, and it hereby is, DENIED; and

IT IS FURTHER ORDERED THAT all other responses to the specifications in the subpoena duces tecum must now be produced on or before July 2, 2012. Pursuant to Rule 2.7(c), 16 C.F.R. § 2.7(c), staff has the authority to determine the terms of satisfactory compliance, including allowing Petitioner to abide by previously-reached agreements to limit the production of documents and information responsive to the subpoena duces tecum.

By direction of the Commission.

VOLUME 153

Responses to Petitions to Quash

LABMD, INC.

FTC File No. 102 3099 – Decision, June 21, 2012 RESPONSE BY THE FULL COMMISSION TO LABMD, INC.’S AND ITS

PRESIDENT, MICHAEL J. DAUGHERTY’S PETITIONS TO LIMIT OR

QUASH THE CIVIL INVESTIGATIVE DEMANDS

DATED DECEMBER 21, 2011

Dear Mr. Fusco:

This letter advises you of the Commission’s disposition of LabMD, Inc.’s and Michael J. Daugherty’s request dated April 25, 2012, that the full Commission review the denial of their petition to limit or quash civil investigative demands. The Commission issued the CIDs to LabMD and Mr. Daugherty on December 21, 2011. LabMD and Mr. Daugherty filed petitions to limit or quash the CIDs, which were received by the Commission on January 10, 2012. On April 20, 2012, Commissioner Brill directed the issuance of a letter denying both petitions and directing both petitioners to comply by May 11, 2012. That deadline was extended to June 8, 2012 due to emergency circumstances that you brought to the Commission’s attention.¹ The Commission affirms the ruling denying the petitions to limit or quash the civil investigative demands. The Commission has independently reviewed LabMD and Mr. Daugherty’s petitions to limit or quash the CIDs, and their requests for full Commission review. The Commission has also reviewed the letter ruling issued by the Commission at the direction of Commissioner Brill, and hereby affirms that ruling, finding its conclusions to be valid and correct.

1 On April 30, 2012, you contacted the Commission’s Office of the Secretary to request additional time to comply with the CID due to emergency circumstances. By letter dated May 7, 2012, the Commission modified the date to June 8, 2012.