Labmd, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF LABMD, INC.

Docket No. 9357. Order, January 16, 2014 Opinion and Order denying respondent’s motion to dismiss the Complaint in this adjudicatory proceeding, arguing that the Commission has no authority to address private companies’ data security practices as “unfair . . . acts or practices” under Section 5(a)(1) of the Federal Trade Commission Act. ORDER DENYING RESPONDENT LABMD’S MOTION TO DISMISS By Commissioner Joshua D. Wright, for a unanimous Commission:1 This case presents fundamental questions about the authority of the Federal Trade Commission (“FTC” or “the Commission”) to protect consumers from harmful business practices in the increasingly important field of data security. In our interconnected and data-driven economy, businesses are collecting more personal information about their customers and other individuals than ever before. Companies store this information in digital form on their computer systems and networks, and often transact business by transmitting and receiving such data over the Internet and other public networks. This creates a fertile environment for hackers and others to exploit computer system vulnerabilities, covertly obtain access to consumers’ financial, medical, and other sensitive information, and potentially misuse it in ways that can inflict serious harms on consumers. Businesses that store, transmit, and use consumer information can, however, implement safeguards to reduce the likelihood of data breaches and help prevent sensitive consumer data from falling into the wrong hands.

Respondent Labmd, Inc. (“Labmd”) has moved to dismiss the Complaint in this adjudicatory proceeding, arguing that the Commission has no authority to address private companies’ data security practices as “unfair . . . acts or practices” under Section 1 Commissioner Brill did not take part in the consideration or decision herein. VOLUME 157 Interlocutory Orders, Etc.

5(a)(1) of the Federal Trade Commission Act (“FTC Act” or “the Act”), 15 U.S.C. § 45(a)(1). This view, if accepted, would greatly restrict the Commission’s ability to protect consumers from unwanted privacy intrusions, fraudulent misuse of their personal information, or even identity theft that may result from businesses’ failure to establish and maintain reasonable and appropriate data security measures. The Commission would be unable to hold a business accountable for its conduct, even if its data security program is so inadequate that it “causes or is likely to cause substantial injury to consumers [that] is not reasonably avoidable by consumers themselves and [such injury is] not outweighed by countervailing benefits to consumers or competition.” 15 U.S.C. § 45(n).

LabMD’s Motion to Dismiss Complaint with Prejudice and to Stay Administrative Proceedings (“Motion to Dismiss” or “Motion”), filed November 12, 2013, calls on the Commission to decide whether the FTC Act’s prohibition of “unfair . . . acts or practices” applies to a company’s failure to implement reasonable and appropriate data security measures. We conclude that it does. We also reject LabMD’s contention that, by enacting the Health Insurance Portability and Accountability Act (“HIPAA”) and other statutes touching on data security, Congress has implicitly stripped the Commission of authority to enforce Section 5 of the FTC Act in the field of data security, despite the absence of any express statutory language to that effect. Nor can we accept the premise underlying LabMD’s “due process” arguments – that, in effect, companies are free to violate the FTC Act’s prohibition of “unfair . . . acts or practices” without fear of enforcement actions by the Commission, unless the Commission has first adopted regulations. Accordingly, we deny LabMD’s Motion to Dismiss. PROCEDURAL BACKGROUND On August 28, 2013, the Commission issued an administrative complaint (“Complaint”) against Labmd, a Georgia-based company in the business of conducting clinical laboratory tests on specimen samples from consumers and reporting test results to consumers’ health care providers. The Complaint alleges that Labmd engaged in “practices that, taken together, failed to provide reasonable and appropriate security for personal LABMD, INC. 1809 Interlocutory Orders, Etc.

information on its computer networks,” see Complaint, ¶ 10; that these practices caused harm to consumers, including exposure to identity theft and disclosure of sensitive, private medical information, id., ¶¶ 12, 17-21; and, consequently, that Labmd engaged in “unfair . . . acts or practices” in violation of the FTC Act. Id., ¶¶ 22-23. Labmd submitted its Answer and Affirmative Defenses to the Administrative Complaint (“Answer”) on September 17, 2013.

Labmd filed its Motion to Dismiss on November 12, 2013.2 On November 22, 2013, Complaint Counsel filed its Response in Opposition to Respondent’s Motion to Dismiss Complaint with Prejudice (“CC Opp.”). Labmd filed its Reply to Complaint Counsel’s Response in Opposition to Respondent’s Motion to Dismiss (“Reply”) on December 2, 2013. Factual discovery is now underway and is scheduled to close on March 5, 2014. The evidentiary hearing before the Administrative Law Judge is scheduled to begin on May 20, 2014.

STANDARD OF REVIEW We review LabMD’s Motion to Dismiss using the standards a reviewing court would apply in assessing a motion to dismiss for failure to state a claim.3 See Fed. R. Civ. P. 12(b)(6); see also Motion at 8; CC Opp. at 3; S.C. State Bd. of Dentistry, 138 F.T.C. 230, 232-33 (2004); Union Oil Co., 138 F.T.C. 1, 16 (2004). Under this framework, “[o]ur task is to determine whether the 2 The Commission issued an Order on December 13, 2013, denying both LabMD’s request for a stay of the administrative proceedings pending resolution of its Motion to Dismiss (see Motion at 29-30) and a separate Motion for Stay Pending Judicial Review that Labmd filed on November 26, 2013.

3 The Commission’s administrative adjudicatory proceedings are governed by the FTC Act and the Commission’s Rules of Practice, rather than the rules and standards that govern federal courts. Nonetheless, “since many adjudicative rules are derived from the Federal Rules of Civil Procedure, the latter may be consulted for guidance and interpretation of Commission rules where no other authority exists.” FTC Op. Manual § 10.7. Here, the most relevant provision in the Commission’s Rules of Practice (16 C.F.R. § 3.11(b)(2)) is very similar to the analogous court rule (Fed. R. Civ. P. 8(a)(2)). Thus, in this instance, we exercise our discretion to apply the pleading standards summarized above. VOLUME 157 Interlocutory Orders, Etc.

[Complaint] contains sufficient factual matter . . . to state a claim to relief that is plausible on its face.” Resnick v. AvMed, Inc., 693 F.3d 1317, 1326 (11th Cir. 2010) (citation omitted). For purposes of this analysis, we “accept[] the allegations in the complaint as true and constru[e] them in the light most favorable to [Complaint Counsel].” Am. Dental Assn v. Cigna Corp., 605 F.3d 1283, 1288 (11th Cir. 2010).

ANALYSIS I. THE COMMISSION HAS AUTHORITY TO ENFORCE THE FTC ACT BY ADJUDICATING WHETHER THE DATA SECURITY PRACTICES ALLEGED IN THE COMPLAINT ARE “UNFAIR.”

Labmd contends that the Commission lacks statutory authority to regulate or bring enforcement action with respect to the data security practices alleged. Motion at 9-21. We disagree. As discussed below, the Commission’s authority to protect consumers from unfair practices relating to deficient data security measures is well-supported by the FTC Act, is fully consistent with other statutes, and is confirmed by extensive case law.4 A. Congress Intended to Delegate Broad Authority to the Commission to Proscribe Activities that Qualify as “Unfair Acts or Practices.”

LabMD’s broadest argument is that Section 5 does not authorize the FTC to address any data security practices. See, 4 At some points in the Motion, Labmd frames its arguments as challenges to the scope of the Commission’s “jurisdiction” (e.g., at 1, 2, 8, 16, 18, 19), while elsewhere it acknowledges the Commission’s “Section 5 ‘unfairness’ authority” but asserts that we cannot apply such authority to LabMD’s data security practices. Id. at 18. As the Supreme Court recently clarified, “there is no difference, insofar as the validity of agency action is concerned, between an agency’s exceeding the scope of its authority (its ‘jurisdiction’) and its exceeding authorized application of authority that it unquestionably has.” City of Arlington v. FCC, 133 S. Ct. 1863, 1870 (2013). This is because, “for agencies charged with administering congressional statutes[,] [b]oth their power to act and how they are to act is authoritatively prescribed by Congress.” Id. at 1869; see Motion at 9.

LABMD, INC. 1811 Interlocutory Orders, Etc.

e.g., Motion at 10 (“even if Section 5 does authorize the FTC to regulate data-security, which it does not”); id. at 17 (asserting “the Commission’s lack of power to regulate data security through its general Section 5 ‘unfairness’ authority’”). Motion at 16. Labmd points out that “there is nothing in Section 5 explicitly authorizing the FTC to directly regulate . . . data-security practices.” Id. at 20. Ignoring the facially broad reach of Section 5’s prohibition of “unfair . . . acts or practices in or affecting commerce,” Labmd urges the Commission to conclude from the absence of explicit “data security” authority in the FTC Act that the Commission has no such authority. See, e.g., Motion at 14 (“When Congress has wanted the FTC to have data security authority, it has said so”); id. (“However, Congress has never given the Commission such authority and has, in fact, repeatedly made it clear that the FTC’s power is very limited in application and very narrow in scope.”); id. at 16 (“Section 5 does not give the FTC the authority to regulate data-security practices as ‘unfair’ acts or practices”); id. at 21 (“Section 5 does not contain a clear and manifest statement from Congress to authorize the Commission’s [authority over] data security”). The statutory text, legislative history, and nearly a century of case law refute LabMD’s argument.

As the courts have long recognized, “[n]either the language nor the history of the [FTC] [A]ct suggests that Congress intended to confine the forbidden methods to fixed and unyielding categories.” FTC v. R.F. Keppel & Bro., Inc., 291 U.S. 304, 310 (1934). Rather, the legislative history of the FTC Act confirms that Congress decided to delegate broad authority “to the [C]ommission to determine what practices were unfair,” rather than “enumerating the particular practices to which [the term ‘unfair’] was intended to apply. . . . There is no limit to human inventiveness in this field. Even if all known unfair practices were specifically defined and prohibited, it would be at once necessary to begin over again.” FTC v. Sperry & Hutchinson Co., 405 U.S. 233, 240 (1972) (quoting S. Rep. No. 597, 63d Cong., 2d Sess., 13 (1914), and H.R. Conf. Rep. No.1142, 63d Cong., 2d Sess., 19 (1914)). See also Atl. Refining Co. v. FTC, 381 U.S. 357, 367 (1965) (Congress “intentionally left development of the term ‘unfair’ to the Commission rather than attempting to define ‘the many and variable unfair practices which prevail in VOLUME 157 Interlocutory Orders, Etc.

commerce.’”) (quoting S. Rep. No. 592, 63d Cong., 2d Sess., 13 (1914)).

This legislative history pertains to Congress’ enactment of the prohibition of “unfair methods of competition” in 1914. Similar considerations motivated Congress’s reuse of the same broad term (“unfair”) when it amended the statute in 1938 to proscribe “unfair and deceptive acts and practices” as well as “unfair methods of competition.” The 1938 amendment perpetuated and expanded the broad congressional delegation of authority to the Commission by “overturn[ing] . . . attempts [in some court decisions] to narrowly circumscribe the FTC’s authority.” Am. Fin. Servs. Assn v. FTC, 767 F.2d 957, 966 (D.C. Cir. 1985). Congress thus clarified that “the Commission can prevent such acts or practices which injuriously affect the general public as well as those which are unfair to competitors.” Id. (quoting H.R. Rep. No. 1613, 75th Cong., 1st Sess. 3 (1937)). As Labmd points out (see Motion at 18), Congress enacted legislation in 1994 that provided a sharper focus for the application of the Commission’s “unfairness” authority, by amending the FTC Act to incorporate three specific criteria governing the application of “unfair . . . acts or practices” in adjudicatory and rulemaking proceedings. Specifically, the new Section 5(n) of the Act provides that, in enforcement actions or rulemaking proceedings, the Commission has authority to determine that an act or practice is “unfair” if that act or practice “[1] causes or is likely to cause substantial injury to consumers which is [2] not reasonably avoidable by consumers themselves and [3] not outweighed by countervailing benefits to consumers or competition.” 15 U.S.C. 45(n). These criteria, derived from the Commission’s pre-existing Policy Statement on Unfairness, codified the analytical framework that the Commission already had been applying for the preceding decade in its efforts to combat “unfair . . . acts or practices.” See Commission Statement of Policy on the Scope of Consumer Unfairness Jurisdiction (Dec. 17, 1980) (“Policy Statement on Unfairness”), reprinted in Intl Harvester Co., 104 F.T.C. 949, 1070, 1073 (1984). Section 5(n)’s specific criteria provide greater certainty for businesses by setting forth the factors to be used to evaluate whether their acts or practices are “unfair.” That fact alone refutes LabMD’s LABMD, INC. 1813 Interlocutory Orders, Etc.

contention that the “general statutory terms” in Section 5 are too “vague” to be applied to the conduct alleged in the Complaint. See Motion at 19.

At the same time, Congress, in enacting Section 5(n), confirmed its intent to allow the Commission to continue to ascertain, on a case-by-case basis, which specific practices should be condemned as “unfair.” Thus, to this day, “Congress has not at any time withdrawn the broad discretionary authority originally granted the Commission in 1914 to define unfair practices on a flexible, incremental basis.” Am. Fin. Servs. Assn, 767 F.2d at 966.

The Commission and the federal courts have been applying these three “unfairness” factors for decades and, on that basis, have found a wide range of acts or practices that satisfy the applicable criteria to be “unfair,” even though – like the data security practices alleged in this case – “there is nothing in Section 5 explicitly authorizing the FTC to directly regulate” such practices (see Motion at 20). See, e.g., FTC v. Neovi, Inc., 604 F.3d 1150, 1155 (9th Cir. 2010) (creating and delivering unverified checks that enabled fraudsters to take unauthorized withdrawals from consumers’ bank accounts); FTC v. Accusearch, Inc., 570 F.3d 1187, 1193 (10th Cir. 2009) (covert retrieval and sale of consumers’ telephone billing information); Orkin Exterminating Co. v. FTC, 849 F.2d 1354, 1364 (11th Cir.1988) (unilateral breach of standardized service contracts); Am. Fin. Servs. Assn, 767 F.2d at 971 (oppressive litigation conduct to repossess household goods sold on credit). Labmd cites American Bar Association v. FTC, 430 F.3d 457 (D.C. Cir. 2005), for the proposition that the Commission is overstepping the bounds of its authority to interpret the FTC Act. See Motion at 20. But that case is inapposite. ABA concerned the agency’s determination, in construing the Gramm-Leach-Bliley Act (“GLB Act”), that attorneys fell within that statute’s definition of “financial institutions” – a defined term that, in turn, incorporated by reference a set of lengthy and detailed definitions imported from other statutes and other agencies’ regulations. The court found it “difficult to believe” that, in enacting a statutory “scheme of the length, detail, and intricacy of the one” under VOLUME 157 Interlocutory Orders, Etc.

review, Congress could have left sufficient remaining ambiguity, “hidden beneath an incredibly deep mound of specificity,” to support imposing GLB Act requirements upon “a profession never before regulated by federal [financial service] regulators, and never mentioned in the statute.” 430 F.3d at 469. By contrast, the statutory text at issue in this case – “unfair . . . acts or practices” – conveys a far broader scope of interpretive flexibility, particularly given that this term is at the core of the Commission’s own organic statute, the FTC Act.

Labmd similarly invokes FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 133 (2000), for the proposition that “simple ‘common sense as to the manner in which Congress is likely to delegate a policy decision of such economic and political magnitude’ . . . reinforces the conclusion that the FTC lacks the authority to regulate the acts or practices alleged in the Complaint.” Motion at 19 (quoting Brown & Williamson, 529 U.S. at 133). But Brown & Williamson is inapposite as well. In that case, the Court found that the Food and Drug Administration’s attempts to regulate tobacco products conflicted directly with concrete manifestations of congressional intent. In particular, the Court concluded that, if the FDA had the authority it claimed, its own findings would have compelled it to ban tobacco products outright, whereas various tobacco-related statutes made clear that Congress wished not to ban such products. See 529 U.S. at 137-39. Here, of course, Labmd can cite no similar congressional intent to preserve inadequate data security practices that unreasonably injure consumers. Similarly, the Court found that “Congress’ specific intent when it enacted the FDCA” (Food, Drug & Cosmetics Act) in 1938 was to deny the FDA authority to regulate tobacco products. 529 U.S. at 146. The Court reasoned that, “given the economic and political significance of the tobacco industry at the time, it is extremely unlikely that Congress could have intended to place tobacco within the ambit of the FDCA absent any discussion of the matter.” Id. at 147 (emphasis added).5 By contrast, when 5 As the D.C. Circuit has recently recognized, these considerations are essential to the holding of Brown & Williamson, and, in their absence, that case does not justify restricting agency action under a broad statutory mandate. See Verizon v. FCC, No. 11-1355, at 23-25 (D.C. Cir., Jan. 14, 2014) (slip op.). LABMD, INC. 1815 Interlocutory Orders, Etc.

enacting the FTC Act in 1914 and amending it in 1938, Congress had no way of anticipating the “economic and political significance” of data security practices in today’s online environment. Accordingly, the fact that “there is no evidence in the text of the [FTC Act] or its legislative history that Congress in 1938 even considered the applicability of the Act” to data security practices is completely irrelevant. Congress could not possibly have had any “specific intent” to deny the FTC authority over data security practices. It did, however, intend to delegate broad authority to the FTC to address emerging business practices – including those that were unforeseeable when the statute was enacted. That is the only congressional intent that matters here. B. The Commission Has Consistently Affirmed Its Authority under the FTC Act to Take Enforcement Action against Unreasonable Data Security Activities that Qualify as Unfair Acts and Practices Labmd similarly attempts to draw support from the Brown & Williamson Court’s determination that the FDA’s 1996 “assertion of authority to regulate tobacco products” contradicted the agency’s previous “consistent and repeated statements [over the preceding 73 years] that it lacked authority . . . to regulate tobacco absent claims of therapeutic benefit by the manufacturer,” and the Court’s conclusion that congressional enactments “against the backdrop” of the FDA’s historic disavowal of authority confirmed that Congress did not intend to authorize such regulation. 529 U.S. at 132, 144-46. Labmd argues, by analogy, that “the Commission [previously] did not claim Section 5 ‘unfairness’ authority to regulate patient-information (or any other) datasecurity practices,” but “recently reversed course without explanation,” thus purportedly defying congressional intent. Motion at 16, 18.

That analogy, too, is without merit. Unlike the FDA, the Commission has never disavowed authority over online privacy or data security matters. To the contrary, “[t]he Commission has been involved in addressing online privacy issues for almost as long as there has been an online marketplace,” and has repeatedly VOLUME 157 Interlocutory Orders, Etc.

and consistently affirmed its authority to challenge unreasonable data security measures as “unfair . . . acts or practices” in violation of Section 5. See FTC Report to Congress, Privacy Online, at 2 (June 1998) (“1998 Online Privacy Report”).6 Labmd cites out-of-context snippets from the Commission’s 1998 and 2000 reports to Congress for the unfounded proposition that, at that time, the Commission believed its authority over data security matters was “limited to ensuring that Web sites follow their stated information practices.”7 LabMD’s characterization does not withstand scrutiny. Neither the text it quotes nor the reports as a whole can plausibly be read as disavowing the Commission’s authority to take enforcement action against data security practices that violate Section 5’s prohibition of “unfair . . . acts or practices,” as defined in Section 5(n). Indeed, the Commission clearly stated that certain conduct relating to online data security is “likely to be an unfair practice,” and, in both reports, confirmed its view that the FTC Act “provides a basis for government enforcement” against information practices [that] may be inherently . . . unfair, regardless of whether the entity has publicly adopted any fair information practice policies.”8 In context, the sentences from the 1998 and 2000 reports relied upon 6 See http://www.ftc.gov/sites/default/files/documents/reports/privacy-onlinereport-congress/priv-23a.pdf.

7 Motion at 16 n.12 (quoting 1998 Online Privacy Report at 41) (“As a general matter, the Commission lacks authority to require firms to adopt information practice policies.”); Reply at 7-8 (quoting FTC Report to Congress, Privacy Online: Fair Information Practices in the Electronic Age (May 2000) (“2000 Online Privacy Report”) (http://www.ftc.gov/sites/default/files/documents/ reports/privacy-online-fair-information-practices-electronic-marketplacefederal-trade-commission-report/privacy2000.pdf) (“As a general matter, . . . the Commission lacks authority to require firms to adopt information practice policies or to abide by the fair information practice principles on their Web sites”).

8 1998 Online Privacy Report at 12-13, 40-41. See also 2000 Online Privacy Report at 33-34 (“The Commission’s authority over the collection and dissemination of personal data collected online stems from Section 5[,]” which “prohibits unfair and deceptive practices in and affecting commerce,” and thus “authorizes the Commission to seek injunctive and other equitable relief, including redress, for violations of the Act, and provides a basis for government enforcement of certain [norms concerning] fair information practices”).

LABMD, INC. 1817 Interlocutory Orders, Etc.

by Labmd simply recognize that the Commission’s existing authority may not be sufficient to effectively protect consumers with regard to all data privacy issues of potential concern (such as aspects of children’s online privacy) and that expanded rulemaking authority and enforcement remedies could enhance the Commission’s ability to meaningfully address a broader range of such concerns.9 The same error infects LabMD’s mischaracterization of testimony that Commissioners and highlevel Commission staff members delivered to various congressional committees and subcommittees.10 Since the late 1990s, the Commission has repeatedly affirmed its authority to take action against unreasonable data security measures as “unfair . . . acts or practices” in violation of Section 5, in reports, testimony to Congress, and other publicly-released documents.11 The Commission has also confirmed this view by 9 See 1998 Online Privacy Report at 42 (recognizing that “Section 5 may only have application to some but not all practices that raise concern about the online collection and use of information from children,” and recommending legislation authorizing the Commission to promulgate “standards of practice governing the online collection and use of information from children.”); 2000 Online Privacy Report at 36-37 (seeking legislation granting “authority to promulgate more detailed standards pursuant to the Administrative Procedure Act,” including “rules or regulations [that] could provide further guidance to Web sites by defining fair information practices with greater specificity[,]”such as “what constitutes ‘reasonable access’ and ‘adequate security’”). See also Motion at 17 n.13 (quoting same).

10 See Motion at 16-17, nn.12, 13, 14 (citing testimony by Chairman Robert Pitofsky in 1998, then-Commissioner Edith Ramirez in 2011, Chairman Jonathan Leibowitz in 2012, and Bureau Directors Eileen Harrington and David Vladeck in 2009 and 2011, respectively). In such testimony, the FTC representatives conveyed the Commission’s support for draft data security legislation that would expand the FTC’s existing authority by providing it with rulemaking authority under the Administrative Procedure Act and civil penalty authority. See, e.g., Prepared Statement of the FTC, Data Security, presented by Commissioner Edith Ramirez to House Comm. on Energy & Commerce, Subcomm. on Commerce, Mfg., and Trade, at 11-12 (June 5, 2011) (http://www.ftc.gov/sites/default/files/documents/public_statements/preparedstatement-federal-trade-commission-datasecurity/110615datasecurityhouse.pdf).

11 See, e.g., Prepared Statement of the FTC, Identity Theft: Innovative Solutions for an Evolving Problem, presented by Bureau Dir. Lydia B. Parnes to Senate Comm. on the Judiciary, Subcomm. on Terrorism, Tech., and VOLUME 157 Interlocutory Orders, Etc.

bringing administrative adjudicatory proceedings and cases in federal court challenging practices that compromised the security of consumers’ data and resulted in improper disclosures of personal information collected from consumers online. For example, on May 1, 2006, the Commission filed a complaint in the U.S. District Court for the District of Wyoming, charging that defendant Accusearch, Inc. and its principal obtained consumers’ private information (specifically, data concerning their telecommunications usage) and caused such data to be disclosed to unauthorized third parties without consumers’ knowledge or consent. FTC v. Accusearch, Inc., Case No. 2:06-cv-0105, Complaint, at ¶¶ 9-13. The Commission alleged that this conduct was “an unfair practice in violation of Section 5(a) of the FTC Act,” id., ¶ 14, because it “caused or [was] likely to cause substantial injury to consumers that [was] not reasonably avoidable by consumers and [was] not outweighed by countervailing benefits to consumers or competition.” Id., ¶ 13. The district court agreed, granting summary judgment to the Commission in 2007, and the Tenth Circuit affirmed in 2009. See Accusearch, supra, 570 F.3d 1187. Since then, the Commission has taken the same position in dozens of other enforcement proceedings, including administrative adjudications,12 as well as Homeland Security, at 5-6 (Mar. 21, 2007) (http://www.ftc.gov/sites/default/files/documents/public_statements/preparedstatement-federal-trade-commission-identity-theft-innovative-solutionsevolving-problem/p065409identitytheftsenate03212007.pdf); FTC Staff Report, Protecting Consumers in the Next Tech-ade, at 29-30 (Spring 2008) (http://www.ftc.gov/sites/default/files/documents/reports/protecting-consumers -next-tech-ade-report-staff-federal-trade-commission/p064101tech.pdf); FTC Report, Security in Numbers, SSNs and ID Theft, at 7 (Dec. 2008) (http://www.ftc.gov/os/2008/12/P075414ssnreport.pdf); Prepared Statement of the FTC, Protecting Social Security Numbers From Identity Theft, presented by Assoc. Bureau Dir. Maneesha Mithal to House Comm. on Ways and Means, Subcomm. on Soc. Security, at 8 (April 13, 2011) (http://ftc.gov/os /testimony/110411ssn-idtheft.pdf); FTC Report, Protecting Consumer Privacy in an Era of Rapid Change, at 14, 73 (March 26, 2012) (http://www.ftc.gov/reports/protecting-consumer-privacy-era-rapid-changerecommendations-businesses-policymakers). See also note 13, infra. 12 See BJ’s Wholesale Club, Inc., 140 F.T.C. 465, 470 (2005); DSW, Inc., 141 F.T.C. 117, 122 (2006); CardSystems Solutions, Inc., Docket No. C-4168, 2006 WL 2709787, *3 (Sept. 5, 2006); Reed Elsevier, Inc., Docket No. C-4226, 2008 WL 3150420, *4 (July 29, 2008); TJX Cos., Inc., Docket No. C-4227, 2008 WL 3150421, *3 (Sept. 29, 2008). In these and similar cases, the Commission LABMD, INC. 1819 Interlocutory Orders, Etc.

complaints filed in federal courts, see CC Opp. at 12-13 n.9 (citing cases). In these cases, the Commission challenged allegedly unreasonable data security measures (or other practices that enabled unauthorized third parties to harm consumers by obtaining access to their confidential personal data) as “unfair acts or practices” in violation of Section 5. And in each case, it clearly reaffirmed its position that it possessed jurisdiction over the allegedly “unfair” data security practices under Section 5. The fact that the Commission initially focused its enforcement efforts primarily on “deceptive” data security practices, and began pursuing “unfair” practices in 2005, does not mean that the Commission lacked jurisdiction over “unfair” practices before then. As then-Commissioner Orson Swindle testified to a House subcommittee in 2004, “To date, the Commission’s security cases have been based on its authority to prevent deceptive practices,” but it “also has authority to challenge practices as unfair if they cause consumers substantial injury that is neither reasonably avoidable nor offset by countervailing benefits. The Commission has used this authority in appropriate cases to challenge a variety of injurious practices, including unauthorized charges in connection with ‘phishing.’”13 Labmd cites Commissioner Swindle’s reference to the Commission’s “deceptiveness” authority over data security practices, see Motion at 16 n.12, but neglects to mention his reference to the Commission’s “unfairness” authority over such practices. issues its final Decisions & Orders only after placing the relevant proposed consent orders on the public record, issuing Notices in the Federal Register that summarize and explain the provisions of the proposed orders and invite public comment, and considering comments filed by interested members of the public. See 16 C.F.R. § 2.34(c) & (e).

13 Prepared Statement of the FTC, Protecting Information Security and Preventing Identity Theft, presented by Commissioner Orson Swindle to House Comm. on Govt Reform, Subcomm. on Tech., Info. Policy, Intergovernmental Relations, and the Census, at 7, 14 n.24 (Sept. 22, 2004) (http://www.ftc.gov/sites/default/files/documents/public_statements/preparedstatement-federal-trade-commission-protecting-information-security-andpreventing-identity/040922infosecidthefttest.pdf) (“Comm’r Swindle’s 2004 Information Security Testimony”).

VOLUME 157 Interlocutory Orders, Etc.

Labmd also misinterprets the Commission’s expressions of support for legislation relating to data security as requests for authority to fill regulatory “gaps” that it could not fill without such legislation. Id. at 17 & nn.13, 14. Labmd refers to three data security-related laws that the Commission supported, and that Congress ultimately enacted – i.e., the GLB Act,14 the Children’s Online Privacy Protection Act (“COPPA”),15 and the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”).16 But these laws recognized the Commission’s existing enforcement authority, expanded that authority in particular respects, and affirmatively directed the Commission to take particular actions to protect consumer interests in specified contexts. For example, in COPPA, Congress authorized the Commission to sue for civil penalties in addition to the equitable monetary relief available under existing law, and authorized and directed the Commission to promulgate rules to protect children’s online privacy pursuant to the streamlined procedures of the Administrative Procedure Act (“APA”), rather than using the more time-consuming procedures mandated by Section 18 of the FTC Act, 15 U.S.C. § 57a. Similarly, in both FACTA and the GLB Act, Congress directed the Commission to adopt rules addressing specified topics using streamlined APA procedures; and in FACTA, Congress also expanded the range of remedies available in Commission enforcement actions.

Finally, even if they were otherwise plausible, LabMD’s arguments about the intended meaning of the past statements of the Commission or its members or staff would still be immaterial to the ultimate question of the Commission’s statutory authority. “An agency’s initial interpretation of a statute that it is charged with administering is not ‘carved in stone,’” and agencies “must be given ample latitude to ‘adapt their rules and policies to the demands of changing circumstances.” Brown & Williamson, 529 U.S. at 156-57 (quoting Chevron U.S.A. Inc. v. Natural Resources 14 Pub. L. 106-102 (1999) (codified in pertinent part at 15 U.S.C. § 6804(a)(1)). 15 Pub. L. 105-277 (1998) (codified in pertinent part at 15 U.S.C. §§ 6502(b), 6505(d)).

16 Pub. L. 108-159 (2003) (codified in pertinent part at 15 U.S.C. § 1681s(a)). LABMD, INC. 1821 Interlocutory Orders, Etc.

Defense Council, Inc., 467 U.S. 837, 863 (1984); Smiley v. Citibank (S.D.), 517 U.S. 735, 742 (1996); Motor Vehicle Mfrs. Assn v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 42 (1983); and Permian Basin Area Rate Cases, 390 U.S. 747, 784 (1968)); see also Verizon v. FCC, supra note 5, at 19-20. Presented with the concrete circumstances of this case, the Commission concludes that it can and should address whether or not LabMD’s data security procedures constitute “unfair . . . acts or practices” within the meaning of the FTC Act. To conclude otherwise would disregard Congress’s instruction to the Commission to protect consumers from harmful practices in evolving technological and marketplace environments. C. HIPAA and Other Statutes Do Not Shield Labmd from the Obligation to Refrain from Committing Unfair Data Security Practices that Violate the FTC Act.

Contrary to LabMD’s contention, Congress has never enacted any legislation that, expressly or by implication, forecloses the Commission from challenging data security measures that it has reason to believe are “unfair . . . acts or practices.” Labmd relies on numerous “targeted statutes” that Congress has enacted in recent years “specifically delegating” to the Commission or to other agencies “statutory authority over data-security” in certain narrower fields. Motion at 15. But Labmd has not identified a single provision in any of these statutes that expressly withdraws any authority from the Commission. Thus, its argument that these more specific statutes implicitly repeal the FTC’s preexisting authority is unpersuasive. “The cardinal rule is that repeals by implication are not favored. Where there are two acts upon the same subject, effect should be given to both if possible.” Posadas v. Natl City Bank of N.Y., 296 U.S. 497, 503 (1936). Thus, one cannot conclude that Congress implicitly repealed or narrowed the scope of an existing statute (i.e., Section 5) by subsequently enacting a new law unless “the intention of the legislature to repeal [is] clear and manifest; otherwise, at least as a general thing, the later act is to be construed as a continuation of, and not a substitute for, the first act . . . .” Id.; see also Branch v. Smith, 538 U.S. 254, 273 (2003) (“An implied repeal will only be found where provisions in two statutes are in ‘irreconcilable conflict,’ or VOLUME 157 Interlocutory Orders, Etc.

where the [later] Act covers the whole subject of the earlier one and ‘is clearly intended as a substitute.’”); Morton v. Moncari, 417 U.S. 535, 551 (1974) (“when two statutes are capable of coexistence, it is the duty of the courts, absent a clearly expressed congressional intention to the contrary, to regard each as effective”).

Nothing in HIPAA, HITECH,17 or any of the other statutes Labmd cites reflects a “clear and manifest” intent of Congress to restrict the Commission’s authority over allegedly “unfair” data security practices such as those at issue in this case. Labmd identifies no provision that creates a “clear repugnancy” with the FTC Act, nor any requirement in HIPAA or HITECH that is “clearly incompatible” with LabMD’s obligations under Section 5. See Motion at 13. To the contrary, the patient-information protection requirements of HIPAA are largely consistent with the data security duties that the Commission has enforced pursuant to the FTC Act. Indeed, the FTC and the Department of Health and Human Services (“HHS”) have worked together “to coordinate enforcement actions for violations that implicate both HIPAA and the FTC Act.” HHS, Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, Final Rule, 78 Fed. Reg. 5566, 5579 (Jan. 25, 2013). And the two agencies have obtained favorable results by jointly investigating the data security practices of companies that may have violated each of these statutes.18 17 See Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub. L. 104-191 (1996) (codified in pertinent part at 42 U.S.C. §§ 1320d et seq.); American Recovery and Reinvestment Act of 2009, Pub. L. 111-5, Div. A, Title XIII, and Div. B, Title IV (“Health Information Technology for Economic and Clinical Health Act”) (“HITECH”) (codified at 42 U.S.C. §§ 1320d-5 et seq.).

18 For example, in 2009, CVS Caremark simultaneously settled HHS charges of HIPAA violations and FTC charges of FTC Act violations, stemming from the two agencies’ coordinated investigations of the company’s failure to securely dispose of documents containing consumers’ sensitive financial and medical information. See FTC Press Release: CVS Caremark Settles FTC Charges: Failed to Protect Medical and Financial Privacy of Customers and Employees; CVS Pharmacy Also Pays $2.25 Million to Settle Allegations of HIPAA Violations (Feb. 18, 2009) (http://www.ftc.gov/news-events/pressreleases/2009/02/cvs-caremark-settles-ftc-chargesfailed-protect-medicalfinancial); CVS Caremark Corp., Consent Order, FTC Docket No. C-4259, LABMD, INC. 1823 Interlocutory Orders, Etc.

Labmd further argues that HIPAA’s comprehensive framework governing “patient-information data-security practices” by HIPAA-regulated entities somehow trumps the application of the FTC Act to that category of practices. Motion at 11-12. But HIPAA evinces no congressional intent to preserve anyone’s ability to engage in inadequate data security practices that unreasonably injure consumers in violation of the FTC Act, and enforcement of that Act thus fully comports with congressional intent under HIPAA. Labmd similarly contends that, by enacting HIPAA, Congress vested HHS with “exclusive administrative and enforcement authority with respect to HIPAAcovered entities under these laws.” Id. at 11. That argument is also without merit. To be sure, the Commission cannot enforce HIPAA and does not seek to do so.19 But nothing in HIPAA or in HHS’s rules negates the Commission’s authority to enforce the FTC Act.20 2009 WL 1892185 (June 18, 2009). See also HHS Press Release: CVS Pays $2.25 Million and Toughens Practices to Settle HIPAA Privacy Case (Feb. 18, 2009) (http://www.hhs.gov/news/press/2009pres/02/20090218a.html). Similarly, in 2010, Rite Aid entered consent decrees to settle both FTC charges of FTC Act violations and HHS charges of HIPAA violations, which the two agencies had jointly investigated. See Rite Aid Corp., Consent Order, 150 F.T.C. 694 (2010); HHS Press Release: Rite Aid Agrees to Pay $1 Million to Settle HIPAA Privacy Case (July 27, 2010) (http://www.hhs.gov/news/press/ 2010pres/07/20100727a.html).

19 Labmd repeatedly – but incorrectly – asserts that “the FTC agrees that Labmd has not violated HIPAA or HITECH.” See, e.g., Motion at 13; see also Reply at 4 (“a company FTC admits complied with HIPAA/HITECH in all respects”) (emphasis in original); id. at 5 (“FTC admits Labmd has always complied with all applicable data-security regulations”); id. at 12 (“FTC admits that Labmd, a HIPAA-covered entity, always complied with HIPAA/HITECH regulations”) (emphasis in original). The Commission does not enforce HIPAA or HITECH, and has never expressed any view on whether Labmd has, or has not, violated those statutes. 20 Both HHS (pursuant to HIPAA and HITECH) and the FTC (pursuant to the American Recovery and Reinvestment Act of 2009) have promulgated regulations establishing largely congruent requirements concerning notification of data breaches involving consumers’ private health information, but they are applicable to two different categories of firms. Compare 16 C.F.R. Part 318 (FTC rule) with 45 C.F.R. Part 164, Subparts D & E (HHS rule). Labmd correctly notes that this FTC rule does not apply to HIPAA-covered entities, see Motion at 12 & n.9, but the conclusion it draws from this fact is unfounded. Significantly, the Complaint in the present proceeding alleges only statutory VOLUME 157 Interlocutory Orders, Etc.

Indeed, the FTC Act makes clear that, when Congress wants to exempt a particular category of entities or activities from the Commission’s authority, it knows how to do so explicitly – further undermining LabMD’s claim to an implicit “carve-out” from the Commission’s jurisdiction over HIPAA-covered entities or their “patient-information data security practices.” Section 5(a)(2) specifically lists categories of businesses whose acts and practices are not subject to the Commission’s authority under the FTC Act. These include banks, savings and loans, credit unions, common carriers subject to the Acts to regulate commerce, air carriers, and entities subject to certain provisions in the Packers and Stockyards Act of 1921. 15 U.S.C. § 45(a)(2). Congress could have added “HIPAA-covered entities” to that list, but it did not. Similarly, the statute identifies certain types of practices that the Commission may not address, such as commerce with foreign nations in certain circumstances. Id. § 45(a)(3). But it provides no carve-out for data security practices relating to patient information, to which HIPAA may apply.

Labmd relies on Credit Suisse Securities, LLC v. Billing, 551 U.S. 264 (2007), for the proposition that industry-specific requirements in other statutes may trump more general laws such as the FTC Act. See Motion at 13. Credit Suisse is clearly distinguishable. As Labmd concedes, there was a “possible conflict between the [securities and antitrust] laws,” creating a “risk that the specific securities and general antitrust laws, if both applicable, would produce conflicting guidance, requirements, . . . or standards of conduct.” Id. By contrast, nothing in the FTC Act compels Labmd to engage in practices forbidden by HIPAA, or vice versa. It is not unusual for a party’s conduct to be governed by more than one statute at the same time, as “we live in ‘an age of overlapping and concurrent regulatory jurisdiction[.]’” FTC v. Ken Roberts Co., 276 F.3d 583, 593 (D.C. Cir. 2001) (quoting Thompson Med. Co. v. FTC, 791 F.2d 189, 192 (D.C. Cir. 1996)). Labmd and other companies may well be obligated to ensure their data security practices comply with both HIPAA and the FTC Act. But so long as the requirements of those statutes do not conflict with one another, a party cannot plausibly assert that, violations; it does not allege violations of the FTC’s Health Breach Notification Rule.

LABMD, INC. 1825 Interlocutory Orders, Etc.

because it complies with one of these laws, it is free to violate the other. Indeed, courts have consistently ruled that “the FTC may proceed against unfair practices even if those practices [also] violate some other statute that the FTC lacks authority to administer.” Accusearch, 570 F.3d at 1194-95 (concluding that conduct may be an unlawful “unfair . . . act or practice” under the FTC Act even if it also violates the Telecommunications Act of 1996). See also Orkin Exterminating Co., 849 F.2d at 1353 (rejecting proposition that a “mere breach of contract . . . is outside the ambit of [the “unfairness” prohibition in] section 5”); Am. Fin. Servs. Assn, 767 F.2d at 982-83 (FTC may ban certain creditor remedies, such as wage assignments and repossession of consumers’ household goods, as “unfair . . . acts or practices” under the FTC Act, even where such conduct also ran counter to state laws against enforcing unconscionable contracts of adhesion).

Finally, Labmd argues that Congress’ enactment of three new statutes addressing the Commission’s authority over certain data protection matters in discrete contexts implies that Congress must have believed that, in other respects, the Commission lacked statutory authority to address data protection matters under the FTC Act. That argument, too, is without merit. First, as discussed above, in each of these statutes Congress expanded the enforcement and rulemaking tools that the Commission already possessed for addressing data security problems in discrete areas. See supra at 8 n.10, 9-10. Labmd identifies nothing in any of those bills or their legislative histories indicating that the Commission’s authority to enforce Section 5’s prohibition of “unfair . . . acts or practices” was limited in any way. Moreover, these statutes affirmatively directed the Commission to take particular actions to protect consumer interests in specified contexts.21 Of course, by compelling the Commission to take particular steps in those contexts, Congress did not somehow divest the Commission of its preexisting and much broader authority to protect consumers against “unfair” practices. 21 For example, in COPPA, Congress directed the Commission to promulgate rules addressing the specific duties of child-directed website operators to provide specific notices and obtain parental consent before collecting or disclosing children’s personal information. See 15 U.S.C. § 6502(b). VOLUME 157 Interlocutory Orders, Etc.

Congress commonly authorizes agencies to oversee entire fields while specifying, in a few areas, what minimum steps those agencies must take in exercising that authority, and the enumeration of those minimum steps does not cast doubt on the agencies’ broader authority. See, e.g., Cablevision Sys. Corp. v. FCC, 649 F.3d 695, 705-06 (D.C. Cir. 2011). And LabMD’s reliance on data security-related bills that ultimately were not enacted into law (see Motion at 17-18 & n.15; Reply at 9) contradicts basic principles of statutory interpretation.22 In sum, we reject LabMD’s contention that the Commission lacks authority to apply the FTC Act’s prohibition of “unfair . . . acts or practices” to data security practices, in the field of patient information or in other contexts; and we decline to dismiss the Complaint on that basis.

22 The fact that a proposed bill was not enacted into law does not mean that Congress consciously “rejected” it. Enacting a bill into law is a notoriously difficult and time-consuming process, given the procedural and political hurdles to be overcome before obtaining majority votes of both Houses of Congress, reconciliation of any differences between the two Houses’ versions, and signature by the President. Thus, “the fact that Congress has considered, but failed to enact, several bills” typically sheds little, if any, light on what Congress believed or intended; and the adjudicator’s “task . . . is not to construe bills that Congress has failed to enact, but to construe statutes that Congress has enacted.” Wright v. West, 505 U.S. 277, 294 n.9 (1992) (Thomas, J.) (plurality op.); see also Verizon v. FCC, supra note 5, at 25 (“pieces of subsequent failed legislation tell us little if anything about the original meaning” of a statute, and thus such later, unenacted legislative proposals provide “an unreliable guide to legislative intent”) (citations omitted).

LABMD, INC. 1827 Interlocutory Orders, Etc.

II. THE COMMISSION HAS AUTHORITY TO ENFORCE THE STATUTE BY ADJUDICATING ALLEGED VIOLATIONS, DESPITE THE ABSENCE OF REGULATIONS, WITHOUT INFRINGING LABMD’S DUE PROCESS RIGHTS.

A. Administrative Agencies May Interpret and Enforce Statutory Requirements in Case-by-Case Adjudications, as Well as By Rulemaking. Labmd argues that the Commission may not adjudicate whether the alleged conduct violated Section 5 of the FTC Act because the Commission “has not prescribed regulations or legislative rules under Section 5 establishing patient-information (or any other) data-security standards that have the force of law.” Motion at 23. Labmd asserts that “[t]he FTC’s refusal to issue regulations is wrongful and makes no sense.” Id. at 24. LabMD’s position conflicts with longstanding case law confirming that administrative agencies may – indeed, must – enforce statutes that Congress has directed them to implement, regardless whether they have issued regulations addressing the specific conduct at issue. Thus, in the leading case of SEC v. Chenery, the Supreme Court recognized that the SEC had not exercised its statutory rulemaking authority with regard to the matter at issue, and squarely rejected the contention “that the failure of the Commission to anticipate this problem and to promulgate a general rule withdrew all power from that agency to perform its statutory duty in this case.” 332 U.S. 194, 201-02 (1947). To the contrary: “the Commission had a statutory duty to decide the issue at hand in light of the proper standards[,] and . . . this duty remained ‘regardless of whether those standards previously had been spelled out in a general rule or regulation.’” NLRB v. Bell Aerospace Co., 416 U.S. 267, 292 (1974) (quoting Chenery, 332 U.S. at 201).

The Commission has long recognized that “information security is an ongoing process of assessing risks and vulnerabilities: no one static standard can assure appropriate security, as security threats and technology constantly evolve.” See Comm’r Swindle’s 2004 Information Security Testimony at 3. Such complex questions relating to data security practices in an VOLUME 157 Interlocutory Orders, Etc.

online environment are particularly well-suited to case-by-case development in administrative adjudications or enforcement proceedings, given the difficulty of drafting generally applicable regulations that fully anticipate the concerns that arise over emerging business arrangements in this rapidly changing area. As the Supreme Court has explained, [P]roblems may arise . . . [that] must be solved despite the absence of a relevant general rule. Or the agency may not have had sufficient experience with a particular problem to warrant rigidifying its tentative judgment into a hard and fast rule. Or the problem may be so specialized and varying in nature as to be impossible of capture within the boundaries of a general rule. In those situations, the agency must retain power to deal with the problems on a case-to-case basis if the administrative process is to be effective. There is thus a very definite place for the case-by-case evolution of statutory standards. And the choice made between proceeding by general rule or by individual, ad hoc litigation is one that lies primarily in the informed discretion of the administrative agency.

Chenery, 332 U.S. at 202-03. Accordingly, “agency discretion is at its peak in deciding such matters as whether to address an issue by rulemaking or adjudication[,] [and] [t]he Commission seems on especially solid ground in choosing an individualized process where important factors may vary radically from case to case.” American Gas Assn v. FERC, 912 F.2d 1496, 1519 (D.C. Cir. 1990). See also FTC v. Colgate-Palmolive Co., 380 U.S. 374, 384-85 (1965) (“the proscriptions [of unfair or deceptive acts and practices] in Section 5 are flexible, to be defined with particularity by the myriad of cases from the field of business,” which “necessarily give[] the Commission an influential role in interpreting Section 5 and in applying it to the facts of particular cases arising out of unprecedented situations.”) (emphasis added).

LABMD, INC. 1829 Interlocutory Orders, Etc.

The Commission has enforced Section 5’s prohibition of “unfair . . . acts or practices” primarily through case-by-case adjudication and litigation from the time the statute was enacted. Indeed, numerous recent cases have condemned conduct that facilitated identity theft or involved misuse of confidential consumer information as unlawful “unfair . . . acts or practices,” although the practices were unprecedented and not covered by any preexisting rules. Thus, even though the Commission had never promulgated any regulations governing the creation of online checks or bank drafts without adequate verification procedures, the Ninth Circuit, in Neovi, easily affirmed both the district court’s holding that the defendants had committed “unfair acts or practices,” 604 F.3d at 1155-58, and its requirement that the defendants disgorge all revenue from the unlawful conduct. Id. at 1159-60. Similarly, despite the absence of any regulation prohibiting online data brokers from gathering and selling consumers’ confidential information gleaned from telephone records, the Tenth Circuit affirmed a district court decision finding that the defendants’ conduct constituted “unfair acts and practices” and imposing an equitable disgorgement remedy. See generally Accusearch, 570 F.3d 1187.

B. This Proceeding Respects LabMD’s Due Process Rights The Commission’s decision to proceed through adjudication without first conducting a rulemaking also does not violate LabMD’s constitutional due process rights. The courts have rejected such due process challenges to agency adjudications on numerous occasions. For example, in Gonzalez v. Reno, 212 F.3d 1338 (11th Cir. 2000), the court held that the agency did not violate due process in interpreting and implementing the immigration statute in an enforcement proceeding, even though its “policy was developed in the course of an informal adjudication, rather than during formal rulemaking.” 212 F.3d at 1350. See also Taylor v. Huerta, 723 F.3d 210, 215 (D.C. Cir. 2013) (statute enabling agency to revoke pilot’s license following administrative adjudicatory proceeding “represented nothing more than an ordinary exercise of Congress’ power to decide the proper division of regulatory, enforcement, and adjudicatory functions between agencies in a split-enforcement regime . . . . [Petitioner] VOLUME 157 Interlocutory Orders, Etc.

cites no authority, and presents no persuasive rationale, to support his claim that due process requires more.”); RTC Transp., Inc. v. ICC, 731 F.2d 1502, 1505 (11th Cir. 1984) (rejecting contention that agency’s “application of its policy . . . denied them due process because the policy was announced in adjudicatory proceedings, . . . rather than being promulgated in rulemaking proceedings with notice and opportunity for comment”); Shell Oil Co. v. FERC, 707 F.2d 230, 235-36 (5th Cir. 1983) (noting that parties in administrative adjudicatory proceedings are not denied due process even when agencies establish new, binding standards of general application in such proceedings, so long as affected parties are given meaningful opportunities to address the factual predicates for imposing liability).

To be sure, constitutional due process concerns may arise if the government imposes criminal punishment or civil penalties for past conduct (or unduly restricts expression protected by the First Amendment) pursuant to a law that “fails to provide a person of ordinary intelligence fair notice of what is prohibited, or is so standardless that it authorizes or encourages seriously discriminatory enforcement.” FCC v. Fox Television Stations, Inc., 132 S. Ct. 2307, 2317 (2012) (quoting United States v. Williams, 553 U.S. 285, 304 (2008)). But, as the D.C. Circuit held in rejecting a constitutional due process challenge to the Commission’s implementation of the Fair Credit Reporting Act, [E]economic regulation is subject to a less strict vagueness test because its subject matter is often more narrow, and because businesses, which face economic demands to plan behavior carefully, can be expected to consult relevant legislation in advance of action. The regulated enterprise . . . may have the ability to clarify the meaning of the regulation by its own inquiry, or by resort to an administrative process. Finally, the consequences of imprecision are qualitatively less severe when laws have . . . civil rather than criminal penalties. Trans Union Corp. v. FTC, 245 F.3d 809, 817 (D.C. Cir. 2001) (quoting Village of Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 498-99 (1982)).

LABMD, INC. 1831 Interlocutory Orders, Etc.

Here, the three-part statutory standard governing whether an act or practice is “unfair,” set forth in Section 5(n), should dispel LabMD’s concern about whether the statutory prohibition of “unfair . . . acts or practices” is sufficient to give fair notice of what conduct is prohibited. In enacting Section 5(n), Congress endorsed the Commission’s conclusion that “the unfairness standard is the result of an evolutionary process . . . . [that] must be arrived at by . . . a gradual process of judicial inclusion and exclusion.” Policy Statement on Unfairness, 104 F.T.C. at 1072. This is analogous to the manner in which courts in our commonlaw system routinely develop or refine the rules of tort or contract law when applying established precedents to new factual situations. As the Supreme Court has recognized, “[b]roadly worded constitutional and statutory provisions necessarily have been given concrete meaning and application by a process of case-by-case judicial decision in the common-law tradition.” Northwest Airlines, Inc. v. Transp. Workers Union of Am., 451 U.S. 77, 95 (1981).

LabMD’s due process claim is particularly untenable when viewed against the backdrop of the common law of negligence. Every day, courts and juries subject companies to tort liability for violating uncodified standards of care, and the contexts in which they make those fact-specific judgments are as varied and fastchanging as the world of commerce and technology itself. The imposition of such tort liability under the common law of 50 states raises the same types of “predictability” issues that Labmd raises here in connection with the imposition of liability under the standards set forth in Section 5(n) of the FTC Act. In addition, when factfinders in the tort context find that corporate defendants have violated an unwritten rule of conduct, they – unlike the FTC – can normally impose compensatory and even punitive damages. Even so, it is well-established that the common law of negligence does not violate due process simply because the standards of care are uncodified. There is similarly no basis to conclude that the FTC’s application of the Section 5(n) cost-benefit analysis violates due process, particularly where, as here, the complaint does not even seek to impose damages, let alone retrospective penalties.

VOLUME 157 Interlocutory Orders, Etc.

III. LABMD’S ALLEGED PRACTICES ARE “IN OR AFFECTING COMMERCE” UNDER THE FTC ACT In Section III of the Motion to Dismiss, Labmd contends that the acts and practices alleged in the Complaint do not satisfy the statutory definition of “commerce” set forth in Section 4 of the FTC Act – i.e., “commerce ‘among’ or ‘between’ states.” See Motion at 28 (citing and paraphrasing 15 U.S.C. § 44, and asserting that LabMD’s principal place of business is in Georgia; the alleged acts or practices were committed in Georgia; and its servers and computer network are located in Georgia). This argument is frivolous. The Complaint plainly alleges that Labmd “tests samples from consumers located throughout the United States.” Complaint, ¶ 5; see also ¶ 2. Indeed, Labmd concedes in its Answer to the Complaint that it “tests samples . . . which may be sent from six states outside of Georgia: Alabama, Mississippi, Florida, Missouri, Louisiana, and Arizona.” Answer, ¶ 5. Thus, the complaint unquestionably alleges that LabMD’s acts and practices “have been in or affecting commerce, as ‘commerce’ is defined in Section 4[.]” Complaint, ¶ 2. IV. THE ALLEGATIONS IN THE COMPLAINT STATE A PLAUSIBLE CLAIM THAT LABMD ENGAGED IN “UNFAIR . . . ACTS OR PRACTICES”

We turn next to LabMD’s contention that “the Complaint does not state a plausible claim for relief” on the ground that the “Complaint’s allegations are nothing more than inadequate ‘legal conclusions couched as factual allegations.’” Motion at 28-29 (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 554, 555 (2007)).

That is incorrect. The Complaint quite clearly sets forth specific allegations concerning LabMD’s conduct and other elements of the charged violation. In particular, it includes plausible allegations that satisfy each element of the statutory standard for unfairness: that (1) the alleged conduct caused, or was likely to cause, substantial injury to consumers; (2) such injury could not reasonably have been avoided by consumers themselves; and (3) such injury was not outweighed by benefits to consumers or competition. 15 U.S.C. § 45(n). We emphasize LABMD, INC. 1833 Interlocutory Orders, Etc.

that, for purposes of addressing LabMD’s Motion to Dismiss, we presume – without deciding – that these allegations are true. But the Commission’s ultimate decision on LabMD’s liability will depend on the factual evidence to be adduced in this administrative proceeding.

A. Causation or Likely Causation of Substantial Injury to Consumers The Complaint contains sufficient allegations to satisfy the criterion that the respondent’s acts or practices “cause[d], or [were] likely to cause, substantial injury to consumers.” Id. First, the Complaint alleges that Labmd collected and stored on its computer system highly sensitive information on consumers’ identities (e.g., names linked with addresses, dates of birth, Social Security numbers, and other information), their medical diagnoses and health status, and their financial transactions with banks, insurance companies, and health care providers. See Complaint, ¶¶ 6-9, 19, 21.

Second, the Complaint contains allegations that Labmd implemented unreasonable data security measures. These measures allegedly included (i) “acts of commission,” such as installing Limewire, a peer-to-peer file sharing application, on a billing manager’s computer, see id., ¶¶ 13-19, as well as (ii) “acts of omission,” such as failing to institute any of a range of readilyavailable safeguards that could have helped prevent data breaches. See id., ¶¶ 10(a)-(g)).

Third, the Complaint alleges that LabMD’s actions and failures to act, collectively, directly caused “substantial injury” resulting from both (i) actual data breaches, enabling unauthorized persons to obtain sensitive consumer information, id., ¶¶ 17-21, as well as (ii) increased risks of other potential breaches. Id., ¶¶ 11-12, 22. Notably, the Complaint’s allegations that LabMD’s data security failures led to actual security breaches, if proven, would lend support to the claim that the firm’s data security procedures caused, or were likely to cause, harms to consumers – but the mere fact that such breaches occurred, standing alone, would not necessarily establish that Labmd engaged in “unfair . . . acts or practices.” The VOLUME 157 Interlocutory Orders, Etc.

Commission has long recognized that “the occurrence of a breach does not necessarily show that a company failed to have reasonable security measures. There is no such thing as perfect security, and breaches can happen even when a company has taken every reasonable precaution.” See Comm’r Swindle’s 2004 Information Security Testimony at 4.23 Accordingly, we will need to determine whether the “substantial injury” element is satisfied by considering not only whether the facts alleged in the Complaint actually occurred, but also whether LabMD’s data security procedures were “unreasonable” in light of the circumstances. Whether LabMD’s security practices were unreasonable is a factual question that can be addressed only on the basis of evidence to be adduced in this proceeding. Fourth, the Complaint alleges that the actual and potential data breaches it attributes to LabMD’s data security practices caused or were likely to cause cognizable, “substantial injury” to consumers, including increased risks of “identity theft, medical identity theft,” and “disclosure of sensitive private medical information.” See Complaint, ¶ 12; see also id., ¶¶ 11, 21-22. These allegations clearly refute LabMD’s contentions that the Complaint contains “no allegations of monetary loss or other actual harm” nor “any actual, completed economic harms or threats to health or safety.” Motion at 28-29. Moreover, occurrences of actual data security breaches or “actual, completed economic harms” (id. at 29) are not necessary to substantiate that the firm’s data security activities caused or likely caused consumer injury, and thus constituted “unfair . . . acts or practices.” Accord Policy Statement on Unfairness, 104 F.T.C. at 949 n.12 (act or practice may cause “substantial injury” if it causes a “small harm to a large number of people” or “raises a significant risk of concrete harm”) (emphasis added); accord 23 See also In re Settlementone Credit Corp., File No. 082 3209, Letter to Stuart K. Pratt, Consumer Data Industry Association, from Donald S. Clark, Secretary, by Direction of the Commission, at 2 (Aug. 17, 2011) (http://www.ftc.gov/sites/default/files/documents/cases/2011/08/110819lettercd ia_1.pdf) (affirming, in resolving three cases concerning data security practices alleged to violate the Fair Credit Reporting Act, that it had “applied the standard that is consistent with its other data security cases – that of reasonable security. This reasonableness standard is flexible and recognizes that there is no such thing as perfect security.”) LABMD, INC. 1835 Interlocutory Orders, Etc.

Neovi, 604 F.3d at 1157 (quoting Am. Fin. Servs., 767 F.2d at 972).

B. Avoidability The Complaint contains plausible allegations that these harms could not reasonably be avoided by consumers. Consumers allegedly did not have any “way of independently knowing about respondent’s security failures,” let alone taking any action to remedy them or avoid the resulting harm. Complaint, ¶ 12. C. Countervailing Benefits to Consumers or Competition Finally, the Complaint alleges that the alleged conduct did not even benefit Labmd, much less anyone else (id., ¶ 20), and that Labmd could have remedied the risks of data breaches “at relatively low cost” (id., ¶ 11). These allegations provide a plausible basis for finding that the harms to consumers were not outweighed by other benefits to consumers or competition. Again, Complaint Counsel will need to prove these allegations, and Labmd will have the opportunity to refute them, on the basis of factual evidence presented at the upcoming hearing. * * * * * For the reasons discussed above, we deny LabMD’s Motion to Dismiss.

Accordingly, IT IS ORDERED THAT Respondent Labmd, Inc.’s Motion to Dismiss Complaint with Prejudice IS DENIED. By the Commission, Commissioner Brill recused. VOLUME 157 Interlocutory Orders, Etc.