In the Matter of: 

RagingWire Data Centers, Inc., DOCKET NO. 9386 

a corporation. 

ANSWER AND AFFIRMATIVE DEFENSES OF RESPONDENT 

RAGINGWIRE DATA CENTERS, LLC 

Corey W. Roush 

C. Fairley Spillman 

Diana E. Schaffner 

AKIN GUMP STRAUSS HAUER & FELD LLP 

2001 K Street, N.W. 

Washington, D.C. 20006 

(202) 887-4000 

Counsel for Respondent 

UNITED STATES OF AMERICA 

BEFORE THE FEDERAL TRADE COMlVIISSION 

OFFICE OF THE ADMINISTRATIVE LAW JUDGE

Washington, D.C. 

S 

ORIGINAL 
2

PUBLIC

ANSWER AND AFFIRMATIVE DEFENSES OF RESPONDENT

RAGINGWIRE DATA CENTERS, LLC

Respondent RagingWire Data Centers, Inc. (“Respondent” or “RagingWire”) hereby 

answers plaintiff Federal Trade Commission’s (“Plaintiff,” “FTC,” or “Commission”) 

Administrative Complaint, dated November 5, 2019 (the “Complaint”) (Dkt. No. 9386), and 

asserts affirmative and other defenses. Any allegation in the Complaint that is not expressly 

admitted below is denied.

1

PRELIMINARY STATEMENT

This case is a waste of FTC resources, this Court’s time, and RagingWire’s resources. 

No harm has been alleged. There is no assertion that RagingWire is likely to make the alleged 

mistake again, and the requested relief is that RagingWire do what it is already doing. 

Moreover, the claimed brief lapse in technical compliance with the EU-U.S. Privacy Shield 

Framework (“Privacy Shield”) did not violate Section 5 of the Federal Trade Commission Act 

(“FTC Act”), 15 U.S.C. § 45. The FTC has failed to identify or even to plead that there is any 

evidence of materiality or harm in this case. RagingWire, moreover, has rectified the alleged 

past lapse, and there is no evidence that RagingWire poses a recidivist threat. 

Put simply, RagingWire is in the business of providing physical spaces to house servers. 

It is not in the data business. RagingWire provides its customers the physical shell within which 

they can set up and keep their own servers. RagingWire does not have access to data on its 

customers’ servers. RagingWire’s customers care about the physical security of its locations 

(e.g., perimeter fences, locked doors, crash barriers), the resilience and redundancy of its 

electrical and other support systems (e.g., the power will stay on even if there is a power outage), 

 1 The Complaint contains section titles and organizational headings to which no response is required. To 

the extent that the headings may be construed to contain allegations of fact to which a response is required, 

RagingWire denies all such allegations.
3

PUBLIC

and the physical location of its data centers (e.g., how close is the data center to the client’s 

operations center).

For over a decade, RagingWire was fully compliant with Privacy Shield and its 

precursor, the Safe Harbor Certification program. It posted a related Privacy Shield statement on 

its website. Compliance with Privacy Shield was just one of many certifications RagingWire 

maintained. Its other certifications generally incorporate requirements for physical protective 

measures. For a brief period, RagingWire was not technically in compliance with Privacy 

Shield, although it continued to implement the same protections and abide by the core principles 

of the program. RagingWire’s leadership did not realize it was out of compliance, so the Privacy 

Shield statement remained on its website. RagingWire removed the statement and took actions 

to comply with Privacy Shield after it received notice from the Department of Commerce and 

FTC. It later became fully compliant again. 

The Complaint alleges several claims all arising out of the same underlying alleged 

misrepresentation—the Privacy Shield statement that remained posted during the alleged lapse 

period—and all based on the allegation that that misrepresentation was deceptive under Section 5 

of the FTC Act. However, the Commission has not established or even claimed that the alleged 

misrepresentation in this matter (the Privacy Shield statement) was material, and, indeed, 

RagingWire will provide support for a finding of immateriality. Without evidence of materiality, 

there can be no violation. See In re Jerk, LLC, 2015 FTC LEXIS 64, *40 (F.T.C. March 13, 

2015) (“A false or misleading representation will violate Section 5 only if it is also ‘material,’ 

that is, if it is likely to affect a consumer’s conduct with respect to the product or service.”) 

(internal quotation omitted). Materiality would only exist here if the alleged misrepresentation 

was a material factor in customers’ decisions to utilize RagingWire’s services during the short 
4

PUBLIC

lapse period. See American Home Products Corp., 98 F.T.C. 136, 368 (1981), aff'd, 695 F.2d 

681 (3d Cir. 1982) (“A misleading claim or omission in advertising will violate Section 5 . . ., 

only if the omitted information would be a material factor in the consumer’s decision to purchase 

the product.”). There is no evidence that it was. In fact, the evidence will show that the alleged 

misrepresentation did not play such a role. 

The Complaint also fails to recognize the key underlying fact that differentiates 

RagingWire from other respondents in Privacy Shield matters—it has no access to relevant data. 

Privacy Shield is “a mechanism to comply with data protection requirements when transferring 

personal data from the European Union . . . to the United States.”2

 RagingWire has no locations 

in Europe; some of its customers do. RagingWire does not access, let alone transfer, its 

customers’ data (regardless of where those customers are based). Nor do customers use 

RagingWire to transfer data into (or out of) the United States. They do not and cannot because 

RagingWire simply provides physical locations to house servers. If a customer needs a company 

to physically protect its servers, that customer can turn to RagingWire with its best-in-class 

physical protections. If a customer wants to do something with the data on those servers, that 

customer must go elsewhere because RagingWire is not a data company. 

RESPONDENT’S ANSWER AND AFFIRMATIVE DEFENSES

1. Respondent admits Paragraph 1 of the Complaint.3

2. Respondent is without knowledge or information sufficient to form a belief as to 

the meaning of “specialized storage facilities” or “data colocation services” and denies that it 

 2 Privacy Shield, “Welcome to The Privacy Shield,” https://www.privacyshield.gov/welcome (last accessed 

Nov. 16, 2019). 3 References to paragraph numbers in the Complaint correlate to the numbered paragraphs in the 

Complaint.
5

PUBLIC

stores any data. Respondent avers that it provides data center services and admits to the 

remainder of Paragraph 2. 

3. Respondent does not dispute the FTC’s jurisdiction in this matter, but otherwise 

denies the allegations in Paragraph 3. 

4. Respondent denies Paragraph 4 of the Complaint.

Personal Data Transfers Under European Union Law

5. Respondent admits the first sentence of Paragraph 5. Respondent avers that the 

EU Data Protection Directive speaks for itself, and Respondent is without knowledge or 

information sufficient to form a belief as to the truth of the remainder of Paragraph 5. 

6. Respondent admits that the EU has enacted a data protection regime called the 

“General Data Protection Regulation” (“GDPR”). Respondent otherwise denies the remainder of 

the allegations in the first sentence in Paragraph 6. Respondent avers that the GDPR speaks for 

itself, and Respondent is without knowledge or information sufficient to form a belief as to the 

truth of the remainder of Paragraph 6. 

7. Respondent is without knowledge or information sufficient to form a belief as to 

the meaning of “certain commercial transfers” as used in Paragraph 7. Respondent otherwise 

admits Paragraph 7. 

8. Respondent is without knowledge or information sufficient to form a belief as to 

the lawfulness of the Safe Harbor Framework after October 2015. Respondent otherwise admits 

Paragraph 8. 

9. Respondent is without knowledge or information sufficient to form a belief as to 

the meaning of “related requirements that have been deemed to meet the EU’s adequacy 
6

PUBLIC

standard” as used in Paragraph 9. Respondent otherwise admits that companies must self-certify 

their compliance with the requirements of the EU-U.S. Privacy Shield. 

10. Respondent avers that to the extent Paragraph 10 of the Complaint states legal 

conclusions, no response is required. Respondent otherwise admits that the EU-U.S. Privacy 

Shield contains the text quoted in Paragraph 10 (without the emphasis), but avers that the 

Commission’s selective quotation is misleading as framed. 

11. Respondent avers that to the extent Paragraph 11 of the Complaint states legal 

conclusions, no response is required. Respondent is without knowledge or information sufficient 

to form a belief as to the meaning of “third-party agents” and “agent” in Paragraph 11. 

Respondent otherwise admits that the EU-U.S. Privacy Shield contains a requirement with regard 

to onward transfers, but avers that the Commission’s selective reference is misleading as framed. 

12. Respondent admits the first sentence of Paragraph 12. Respondent admits that the 

EU-U.S. Privacy Shield contains the text quoted in the second sentence of Paragraph 12, but 

avers that the Commission’s selective quotation is misleading as framed. 

13. Respondent avers that to the extent Paragraph 13 of the Complaint states legal 

conclusions, no response is required. Respondent admits that the European Commission’s 

adequacy decision contains the text quoted in the first sentence of Paragraph 13, but avers that 

the Commission’s selective quotation is misleading as framed. Respondent admits that 

Commerce maintains the referenced web page. Respondent is without knowledge or information 

sufficient to form a belief as to the last sentence in Paragraph 13.

14. Respondent is without knowledge or information sufficient to form a belief as to 

the allegation that applicable fines under GDPR Article 83 would be imposed on “the 

transferor.” Respondent admits that Article 83 of the GDPR provides for administrative fines of 
7

PUBLIC

up to 20,000,000 EUR or, under certain circumstances, up to 4% of the total worldwide annual 

turnover for the preceding financial year, for violation of Articles 44 to 49, which cover transfers 

of personal data outside of the European Economic Area (“EAA”). 

15. Respondent admits Paragraph 15. 

RagingWire’s Business Practices

16. Respondent avers that to the extent Paragraph 16 of the Complaint states legal 

conclusions, no response is required. Respondent admits that it owns and operates ten “data 

centers” located in the United States and that it offers colocation services, but it denies that it 

“store[s] customer data.” Respondent is without knowledge or information sufficient to form a 

belief as to the allegations in the second sentence of Paragraph 16, and denies the allegations to 

the extent that they suggest that RagingWire receives, facilitates or actually undertakes any data 

transfers. 

17. Respondent admits Paragraph 17. 

18. Respondent admits Paragraph 18. 

19. Respondent avers that to the extent Paragraph 19 of the Complaint states legal 

conclusions, no response is required. Respondent admits that its Privacy Shield certification 

lapsed in January 2018. 

20. Respondent admits that Paragraph 20 provides the correct web address for 

Respondent’s privacy policy and that the text quoted in Paragraph 20 appeared in its online 

privacy policy between January 2017 and October 2018, but avers that the Commission’s 

selective quotation is misleading as framed. Respondent denies the remainder of the allegations 

in Paragraph 20. 
8

PUBLIC

21. Respondent denies the allegations in the first sentence of Paragraph 21. 

Respondent admits that the non-final materials attached as Exhibit A reference Respondent’s 

participation in Safe Harbor, but otherwise denies the allegations in the second sentence of 

Paragraph 21. Respondent denies the remainder of the allegations in Paragraph 21. 

22. Respondent denies that “Commerce warned the company in February 2018 . . . to 

take down its claims that it participated in Privacy Shield unless and until such time as it

completed the steps necessary to renew its participation in the EU-U.S. Privacy Shield 

Framework.” Respondent admits that it received a communication from Commerce in 

February 2018 regarding its Privacy Shield compliance. Respondent further admits that it 

received a communication from Commerce in May 2018 regarding its Privacy Shield compliance 

that directed Respondent to take down its Privacy Shield Statement until such time as it was back 

in compliance with Privacy Shield.

23. Respondent admits that it removed its Privacy Shield Statement from its online 

privacy policy in October 2018. 

24. In response to Paragraph 24, Respondent avers that it regained its Privacy Shield 

certification in May 2019. 

RagingWire’s Privacy Shield Non-Compliance 

25. Respondent avers that to the extent Paragraph 25 of the Complaint states legal 

conclusions, no response is required. Respondent otherwise denies the allegations in 

Paragraph 25 to the extent that they suggest Respondent failed to comply with all Privacy Shield 

Principles.
9

PUBLIC

RagingWire’s Failure to Verify Compliance

26. Respondent avers that Supplemental Principle 7 speaks for itself and that the 

Commission’s selective references are misleading as framed. 

27. To the extent that Paragraph 27 purports to be describing the Privacy Shield 

Principles and/or Supplemental Principles, Respondent avers that they speak for themselves and 

that the Commission’s selective reference is misleading as framed. 

28. Respondent denies Paragraph 28 insofar as it suggests that RagingWire was 

required to verify its implementation of certain privacy practices during the entire 2017-18 

period and the implication that RagingWire did not maintain such privacy practices in the 

absence of verification. Respondent otherwise admits Paragraph 28. 

29. Respondent denies Paragraph 29 insofar as it suggests that RagingWire was 

required to verify its implementation of certain privacy practices during the entire 2017-18 

period; Respondent otherwise admits Paragraph 29. 

RagingWire’s Failure to Verify Compliance 

30. Respondent admits that Principle 7(a)(i) of the Privacy Shield Principles and 

Supplemental Principle 11(a) contain the text quoted in Paragraph 30, but avers that the 

Commission’s selective quotation and reference is misleading as framed. 

31. Respondent denies the allegations in Paragraph 31 to the extent that they suggest 

TRUSTe is a subsidiary of TrustArc and not the new name of the entity; Respondent otherwise 

admits Paragraph 31. 

32. Respondent admits Paragraph 32 to the extent that it asserts that Respondent 

contracted with TRUSTe to provide dispute resolution services before TRUSTe changed its 

name to TrustArc.
10

PUBLIC

33. Respondent admits that Respondent’s Privacy Shield statement contained the 

material quoted in Paragraph 33, but avers that the Commission’s selective quotation is 

misleading as framed. 

34. Respondent admits Paragraph 34, except that it renewed its dispute resolution 

subscription with TrustArc in June 2018. 

RagingWire’s Failure to Properly Withdraw and Affirm Its Ongoing Compliance 

35. Respondent avers that Supplemental Principle 6(f) and Supplemental Principle 7 

speak for themselves and that the Commission’s selective reference is misleading as framed. 

36. Respondent admits Paragraph 36, but avers that the Commission’s selective 

reference is misleading as framed. 

37. Respondent admits Paragraph 37, but avers that the Commission’s selective 

reference is misleading as framed. 

COUNT 1

Privacy Shield Participation Misrepresentation

38. Respondent incorporates its responses to Paragraphs 20-21 and avers that to the 

extent Paragraph 38 of the Complaint states legal conclusions, no response is required. 

39. Respondent incorporates its responses to Paragraphs 17 and 19 and avers that to 

the extent Paragraph 39 of the Complaint states legal conclusions, no response is required. 

Respondent otherwise denies Paragraph 39. 

COUNT 2

Misrepresentation Regarding Verification

40. Respondent incorporates its responses to Paragraphs 20-21 and avers that to the 

extent Paragraph 40 of the Complaint states legal conclusions, no response is required.
11

PUBLIC

41. Respondent incorporates its responses to Paragraphs 26-29 and avers that to the 

extent Paragraph 41 of the Complaint states legal conclusions, no response is required. 

Respondent otherwise denies Paragraph 41. 

COUNT 3

Misrepresentation Regarding Dispute Resolution

42. Respondent incorporates its responses to Paragraphs 20-21 and avers that to the 

extent Paragraph 42 of the Complaint states legal conclusions, no response is required. 

43. Respondent incorporates its responses to Paragraphs 30-34 and avers that to the 

extent Paragraph 43 of the Complaint states legal conclusions, no response is required. 

Respondent otherwise denies Paragraph 43. 

COUNT 4

Misrepresentation Regarding Continuing Obligations

44. Respondent incorporates its responses to Paragraphs 20-21 and avers that to the 

extent Paragraph 44 of the Complaint states legal conclusions, no response is required. 

45. Respondent incorporates its responses to Paragraphs 35-37 and avers that to the 

extent Paragraph 45 of the Complaint states legal conclusions, no response is required. 

Respondent otherwise denies Paragraph 45. 

Violations of Section 5 of the FTC Act 

46. Respondent avers that to the extent Paragraph 46 of the Complaint states legal 

conclusions, no response is required. Respondent otherwise denies the allegations in 

Paragraph 46. 
12

PUBLIC

RESPONDENT’S AFFIRMATIVE DEFENSES

Respondent asserts the following defenses, without assuming the burden of proof on such 

defenses that would otherwise rest with the Plaintiff:

FIRST DEFENSE

The Complaint fails to state a claim on which relief can be granted under Section 5 of the 

FTC Act, 15 U.S.C. § 45. 

SECOND DEFENSE

The alleged misrepresentation was not material.

THIRD DEFENSE

Granting the relief sought is contrary to the public interest. Respondent has rectified all 

alleged violations, implemented additional compliance procedures, and there is no recidivist risk. 

FOURTH DEFENSE

Respondent has acted in good faith in all of its practices, including in the initial posting 

of the Privacy Shield statement. Respondent took affirmative steps to comply with Privacy 

Shield and took down the statement once it learned of the issue. Any delay in action was the 

result of understandable personnel issues that will not happen again in light of Respondent’s 

since-adopted compliance procedures. 

FIFTH DEFENSE

There is no danger of recurrence of alleged similar violations and the Commission’s 

requested relief is not reasonably related to Respondent’s alleged violations. 

SIXTH DEFENSE

The alleged violation arose out of the actions of an employee who failed to follow the 

explicit instructions of an officer of the company to comply with Privacy Shield requirements. 
13

PUBLIC

SEVENTH DEFENSE

The Complaint seeks overlapping and duplicative relief as the various claims all arise out 

of an alleged single wrongdoing. All asserted claims arise out of the same alleged 

misrepresentation—the posting of the Privacy Shield statement during the short lapse period. 

ADDITIONAL DEFENSES

Respondent reserves the right to assert any other defenses as they become known to 

Respondent. 

NOTICE OF CONTEMPLATED RELIEF

WHEREFORE, Respondent requests that the Administrative Law Judge deny the 

Commission’s requested relief and dismiss the Complaint in its entirety with prejudice, or 

alternatively without prejudice. 

Dated: November 25, 2019 Respectfully submitted,

/s/ Corey W. Roush 

Corey W. Roush 

C. Fairley Spillman

Diana E. Schaffner 

AKIN GUMP STRAUSS HAUER & FELD LLP

2001 K Street, N.W.

Washington, D.C. 20006 

(202) 887-4000 

Counsel for Respondent 
20

PUBLIC

CERTIFICATE OF SERVICE

I certify that on November 25, 2019, a copy of the foregoing, Answer and Affirmative 

Defenses of Respondent RagingWire Data Centers, LLC, was electronically filed using the 

Commission’s Electronic Filing System and was sent by that system and by certified mail to the 

following: 

Federal Trade Commission

 600 Pennsylvania Avenue, N.W. 

 Washington, D.C. 20580 

Dated: November 25, 2019 By: /s/ Corey W. Roush 
Notice of Electronic Service 

I hereby certify that on November 25, 2019, I filed an electronic copy of the foregoing ANSWER AND 

AFFIRMATIVE DEFENSES OF RESPONDENT RAGINGWIRE DATA CENTERS, LLC, with: 

D. Michael Chappell 

Chief Administrative Law Judge 

600 Pennsylvania Ave., NW 

Suite 110 

Washington, DC, 20580 

Donald Clark 

600 Pennsylvania Ave., NW 

Suite 172 

Washington, DC, 20580 

I hereby certify that on November 25, 2019, I served via E-Service an electronic copy of the foregoing 

ANSWER AND AFFIRMATIVE DEFENSES OF RESPONDENT RAGINGWIRE DATA CENTERS, LLC, 

upon: 

Linda Kopp 

Federal Trade Commission 

lkopp@ftc.gov 

Complaint 

Robin Wetherill 

Federal Trade Commission 

rwetherill@ftc.gov 

Complaint 

Corey Roush 

Partner 

Akin Gump Strauss Hauer & Feld LLP 

croush@akingump.com 

Respondent 

C. Fairley Spillman 

Partner 

Akin Gump Strauss Hauer & Feld LLP 

fspillman@akingump.com 

Respondent 

Diana Schaffner 

Akin Gump Strauss Hauer & Feld LLP 

dschaffner@akingump.com 

Respondent 

Corey Roush 

Attorney