Source: http://updates.mwbllp.com/2015_09_06_archive.html
Timestamp: 2019-04-19 22:37:01+00:00

Document:
FYI: 3rd Cir Holds Defendants Had "Fair Notice" of FTC's Position on Cybersecurity "Unfairness"
The U.S. Court of Appeals for the Third Circuit recently held that the Federal Trade Commission (FTC) has the legal authority under section 45(a) of the Federal Trade Commission Act (FTC Act) to regulate cybersecurity as an "unfair" act or practice affecting interstate commerce.
In so ruling, and among other things, the Court rejected the defendants' argument that the FTC did not provide "fair notice" of the cybersecurity requirements it was seeking to impose, holding that a company is "not entitled to know with ascertainable certainty the FTC's interpretation of what cybersecurity practices are required by § 45(a), … as long as the company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute."
In 2008 and 2009, "hackers" on three occasions gained access to the computer system of a national hospitality company that franchises and manages hotels and sells timeshares. The hackers stole the personal and financial information of hundreds of thousands of consumers, resulting in over ten million dollars in fraudulent charges.
The defendants moved to dismiss both the unfairness and deception claims, which the district court denied. The Third Circuit granted leave to appeal the interlocutory dismissal order in order to clarify whether the FTC has the authority to regulate cybersecurity under the unfairness prong of section 45(a) of the FTC Act, and, if so, whether the company had fair notice that its cybersecurity practices could violate the FTC Act.
The Third Circuit discussed the FTC's regulatory authority under the FTC Act, especially as to "unfair methods of competition in commerce," noting that Congress intentionally refused to limit the concept of "unfairness" by defining exactly what the phrase means, leaving it to the FTC to flesh out its meaning.
The Court explained that in 1994, Congress codified the FTC's 1980 Policy Statement on "unfairness" in section 45(n) of the FTC Act, which "requires substantial injury that is not reasonably avoidable by consumers and that is not outweighed by the benefits to consumers or competition." Thus, the Third Circuit noted, section 45(n) adopted a cost-benefit analysis to determining whether an act or practice is "unfair."
The Court also rejected the defendants' argument that a business does not treat its customers unfairly when it was itself the victim of a criminal attack, in part because defendants offered "no reasoning or authority for this principle," and the Court could think of none, and but also because the text of subsection 45(n) includes the words "likely to cause substantial injury," which the Court found meant that the FTC Act "expressly contemplates the possibility that conduct can be unfair before actual injury occurs." In addition, according to the Third Circuit, under establish principles of tort law, a company can be held liable for foreseeable injury even if the act of a third person was a more proximate cause of the injury.
The Third Circuit then rejected the defendants' argument that the FTC's authority over unfair acts and practices in subsection 45(a) does not extend to cybersecurity, because the federal Fair Credit Reporting Act's direction to the FTC to develop regulations governing the disposal of consumer data, and the Gramm-Leach-Bliley Act's requirement that the FTC develop standards for financial institutions to protect consumers' personal information, for example, would mean little if the FTC already had plenary authority over the field of cybersecurity. The Court reasoned that Congress had independent reasons for passing the aforementioned laws separate and apart from the FTC's regulatory authority over cybersecurity.
The defendants next argued that the FTC's interpretation of subsection 45(a) was wrong because Congress never granted the authority the FTC was trying to exercise, despite repeated attempts by the FTC to obtain it. Rejecting this argument as well, the Third Circuit reasoned that all the FTC has repeatedly maintained that some cybersecurity practices are "unfair" under the FTC Act, and that in the other statements relied upon, from 1999 and 2000, it merely acknowledged that it did not have the power to force companies to adopt "fair information practice policies" because, at the time, they were only collecting consumer information and consumers were not injured as a result. The Court concluded that the fact that "the FTC later brought unfairness actions against companies whose inadequate cybersecurity resulted in consumer harm is not inconsistent with the agency's earlier position."
Turning to the issue of whether the defendants had "fair notice" that their cybersecurity practices were unfair under the FTC Act, the Third Circuit explained, citing Supreme Court precedent, that "[a] conviction or punishment violates the Due Process Clause of our Constitution if the statute or regulation under which it is obtained 'fails to provide a person of ordinary intelligence fair notice of what is prohibited, or is so standardless that it authorizes or encourages seriously discriminatory enforcement.'"
The defendants argued that, even if its conduct was unfair under section 45(a), the FTC did not provide fair notice of the particular cybersecurity standards defendants were required to adhere to.
However, the Third Circuit pointed out that "the level of required notice for a person to be subject to liability varies by circumstance," and that the "fair notice" doctrine applies in civil cases.
The inquiry, however, ultimately boiled down "not whether [defendants] had fair notice of the FTC's interpretation of the statute, but whether [defendants] had fair notice of what the statute itself requires." It then concluded that defendants "were not entitled to know with ascertainable certainty the FTC's interpretation of what cybersecurity practices are required by § 45(a). Instead, the relevant question in this appeal [was] whether [defendants] had fair notice that [their] conduct could fall within the meaning of the statute."
The Court then turned to whether the defendants had fair notice of the meaning of § 45(a). The Third Circuit had little trouble rejecting the defendants' argument that they were entitled to fair notice of what specific cybersecurity measures are required in order to avoid liability, concluding that "[f]air notice is satisfied here as long as the company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute."
The Third Circuit concluded that the defendants' fair notice challenge failed because, after the second attack, it should have been "painfully clear to [defendants] that a court could find its conduct failed the cost-benefit analysis."
In addition, the FTC's complaint "does not allege that [defendants] used weak firewalls, IP address restrictions, encryption software, and passwords. Rather it alleges that [defendants] failed to use any firewall at critical network points, … did not use any encryption for certain customer files, … and did not require some users to change their default or factor-setting passwords at all…."
Finally, the Court, pointing to a 1997 FTC publication entitled "Protecting Personal Information: A Guide to Business," as well as FTC complaints and consent orders involving cybersecurity prior to the first attack in 2008, found these that "could certainly have helped [defendants] determine in advance that its conduct might not survive the cost-benefit analysis."
Accordingly, the district court's decision was affirmed.
CALIFORNIA | FLORIDA | ILLINOIS | INDIANA | MASSACHUSETTS | NEW JERSEY | NEW YORK | OHIO | PENNSYLVANIA | TEXAS | WASHINGTON, D. C.
The U.S. Court of Appeals for the Ninth Circuit recently held that the district court abused its discretion in denying a plaintiff's motion to certify a class of home buyers alleging that a scheme involving a title insurer buying minority interests in title agencies in exchange for referral of future title insurance business violated the federal Real Estate Settlement Procedures act ("RESPA"), affirming in part, vacating in part and remanding for further proceedings.
In so ruling, the Court held that the Consumer Financial Protection Bureau's ("CFPB") position in its amicus brief was not entitled to Chevron deference, because the CFPB was interpreting RESPA's statutory language, rather than the language of its own rule, and was not doing so as part of its formal rule-making authority, and, in addition, because the statute was not ambiguous.
A title insurer alleged conducted business by buying minority ownership interests title insurance agencies in return for the exclusive referral of future title insurance business to the insurer. The lead plaintiff sued, alleging that the arrangement between the title insurer and its "captive title agencies" violated RESPA's "anti-kickback provision, 12 U.S.C. § 2607.
The plaintiff moved to certify a class of home buyers referred by the 180 title agencies that the insurer partially owned to the insurer. The he district court denied the motion for class certification, instead ordering discovery in order to determine whether a smaller class should be certified.
After limited discovery, the plaintiff moved to certify the smaller class, which the district court also denied.
The Ninth Circuit reversed, holding that there existed a single, common fact question: whether the alleged arrangement violated RESPA. It also remanded with directions that nationwide discovery be conducted in order to allow the plaintiff another opportunity at certification of a nationwide class.
The plaintiff moved to certify a nationwide class of all home buyers who closed a federally insured mortgage with 38 title agencies that sold a minority ownership interest to the title insurer, and agreed to refer future title business to the insurer.
The district court again denied the motion, this time because "common issues did not predominate over individual issues for the nationwide class." Specifically, the district court held that: (a) an individual inquiry was required to determine whether the insurer "overpaid for its ownership interest in each title agency;" (b) commonality did not exist on the issues of "reliance and causation for referrals;" and (c) "transaction-specific inquiries as a result of the different types of title agencies will not require common proof related to [the title insurer's] liability. The plaintiff again appealed.
On appeal, the Ninth Circuit began its analysis applying the abuse of discretion standard of review to whether the district court correctly applied Federal Rule of Civil Procedure 23, and the de novo standard to the "underlying legal questions … [with] any error of law on which a certification order rests [being] deemed a per se abuse of discretion."
The Ninth Circuit recited that the party seeking class certification bears the burden of establishing that the proposed class satisfies "all requirements in Rule 23(a) [numerosity, commonality, typicality and adequacy of representation] and at least one of the requirements in Rule 23(b)" [here, subsection (b)(3), which requires that a class action is superior to other methods of litigation and] "that questions of law or fact common to class members predominate over any question affecting only individual members."
The Court then discussed the legislative history of RESPA, noting that one of its main purposes is to protect consumers from unnecessary closing costs caused by abusive practices such as kickbacks and referral fees. It then looked to the text of § 2607, which prohibits the giving of anything of value as part of an agreement "that business incident to or a part of a real estate settlement service involving a federally related mortgage loan shall be referred to any person."
The Court explained that subsection 2607(c)(2) provides a "statutory safe harbor" that exempts payments made in return for a referral if the payment was "for goods or facilities actually furnished or for services actually performed."
The Court then addressed whether an individual inquiry was required for each transaction in light of the safe harbor in subsection 2607(c)(2) and the version of Regulation X in place at the relevant time, 24 C.F.R. 3500.14(g)(2).
The Consumer Financial Protection Bureau ("CFPB"),which now enforces RESPA, filed an amicus brief interpreting RESPA and Regulation X, arguing that the safe harbor does not apply to the transactions at issue because the title insurer did not pay for goods, facilities, or services, but for equity interests in the title agencies.
The Court first had to determine how much deference to give the CFPB's argument. It reasoned that, because the CFPB was interpreting RESPA's statutory language, rather than the language of its own rule, and was not doing so as part of its formal rule-making authority, and, in addition, because the statute was not ambiguous, the CFPB was not entitled to any deference under the U.S. Supreme Court's decision in Chevron, U.S.A., Inc. v. Nat'l Res. Def. Council, Inc.
Nonetheless, the Court agreed with the CFPB's interpretation, which it found was consistent with RESPA's language.
Accordingly, the Ninth Circuit held that the safe harbor under 12 U.S.C. 2607(c)(2) did not apply at all, and the district court erred by relying on the safe harbor provision to determine whether to certify the class.
The Court then turned to "whether individual inquiries are required because of § 2607(a)." It disagreed with the district court because the cases relied upon interpreted the safe harbor provision of subsection 2607(c)(2), which the Court held did not apply to the purchase transactions at issue because "no services were provided by the title agencies to [the title insurer]."
The Court held that "the district court abused its discretion in denying class certification based on an erroneous interpretation of § 2607(a) … and that cases alleging illegal kickbacks in violation of § 2607(a) are not necessarily unfit for class adjudication."
However, the Ninth Circuit's work was not finished, because it still had to decide whether there existed "individual issues here that could predominate over common issues such that class action certification is inappropriate" under Rule 23(b)(3). The Court held that the answer was "no."
The Ninth Circuit held that RESPA does not require the plaintiff "to pinpoint how much money [the title insurer] paid for the referral agreement as opposed to the equity interest." Instead, the plaintiff "can state a claim under RESPA [§ 2607(a)] by alleging that [the title insurer] paid a lump sum of money to each captive title agency (the thing of value), and — in exchange for that money — each title agency agreed to refer [the title insurer] future insurance (business agreement)." The Court reasoned that both RESPA and its implementing regulation define "thing of value" broadly, and the transfer of money need not be only in return for a kickback, but can also be in return for future insurance business, as in case at bar.
The Court stressed that its conclusion is consistent with contract law, under which there exists a "presumption that when parties enter into a contract, each and every term and condition is in consideration of all the others, unless otherwise stated." The Ninth Circuit noted that, even though the contracts at issue were silent on how much the title insurer paid for referrals of future business, "the law does not require every term of the contract to have a separately stated consideration," and the "undivided monetary consideration paid by [the title insurer] must be treated in law as consideration for both the equity interests and referrals."
According to the Ninth Circuit, because the plaintiff only needed to prove "the existence of an exchange involving a referral agreement, … [s]uch proof does not require inquiry into individual facts across all thirty-eight captive title agencies."
The Court then considered whether "commonality" existed under Rule 23(a)(2), i.e., "whether the proposed class members share a common question of law or fact, the answer to which 'will resolve an issue that is central to the validity of each one of the [class members'] claims.'" The Ninth Circuit concluded that a common question of fact existed: whether [the title insurer's] pattern of conduct in entering into similar transaction with the title agencies violates RESPA."
The Court then ruled that "the district court erred in concluding that the common issue does not predominate over individual issues for the proposed class members" vacating the district court's denial of class certification in part as to the transactions that were presented for approval to the title insurer's board of directors.
The Ninth Circuit also disagreed with the district court that because, on some occasions, a third party such as a lender, mortgage broker or realtor had a hand in deciding which title insurer to use, their involvement required individual inquiries rendering class adjudication improper, reasoning that "[o]ther sources of referral do not defeat the predominant common question of fact, i.e., whether the title agencies have contractual obligations to refer their customers to [the title insurer]."
Finally, the Court addressed the district court's denial of class certification on the basis that "the different types of title agencies will require individual, case-by-case proof on [the title insurer's] liability."
The title insurer argued that "its transactions with twelve of the thirty-eight title agencies are affiliated business arrangements ('ABA') that are exempt from RESPA violations under § 2607(c)(4)."
However, the Ninth Circuit rejected this argument as invalid as a matter of law because subsection 2607(c)(4) applies "when a person who partially owns a settlement service provider refers business to the service provider, and the owner receives nothing other than a return of the service provider's shares," but in the case at bar, the title insurer "— the partial owner of the title agencies — did not refer business to the title agencies." Instead the title agencies referred business to the part-owner, the title insurer. The Court concluded that no individual inquiries as to the "affiliated business arrangement" status of the twelve title agencies was needed because subsection 2607(c)(4) did not apply to these transactions as a matter of law.
The title insurer also argued that it was the majority owner of some of the title agencies and it "cannot refer business to itself," citing Freeman v. Quicken Loans, Inc., 132 S. Ct. 2034 (2012), a U.S. Supreme Court decision holding that "to establish a violation of § 2607(b), a plaintiff must demonstrate that a charge for settlement services was divided between at least two persons."
The Court disagreed, finding the cited decision inapplicable because: (a) "[the title insurer] and its majority-owned title agencies are not the same person, but separate legal entities;" and, (b) "[n]o separate inquiries are necessary merely because [the title insurer] is the majority owner of certain captive title agencies."
The Court agreed, however, with the district court's conclusion that [the title insurer's] "transactions with the newly-formed title agencies do not raise common issues sufficient for class action adjudication," affirming the district court's denial of denial of certification as to this subclass because twelve of the thirty-eight title agencies did not exist when the title insurer decided to purchase ownership interests, but were formed jointly with third-party investors.
These particular arrangements presented a different set of facts from the alleged nationwide scheme involving the purchasing of ownership interests in return for future referral of title business.
Because the district court did not address "the remaining prerequisites of class certification, including whether a class action is a superior method of adjudication, whether [the lead plaintiff] and her counsel are adequate, and whether the putative class is ascertainable," the Court declined to do so in the first instance and remanded the case to the district court to do so.
The district court's denial of class certification was affirmed "as to the newly-formed title agencies," its denial of class certification was reversed and vacated in part as to the remaining title agencies, and the case remanded for further proceedings.
The U.S. District Court for the Northern District of California recently held that a web-based platform used to send text messages was not an automatic telephone dialing system ("ATDS") under the federal Telephone Consumer Protection Act ("TCPA"), 47 U.S.C. § 227, because it required "human intervention…in several stages of the process" for sending the text messages.
The plaintiff customer, who was a patron of a Las Vegas gentlemen's club (the "Club") sued the Club and a third-party mobile marketing company (the "Marketing Company") for sending him an allegedly "unwanted" text message. The Club had hired the Marketing Company to provide a web-based platform for sending promotion texts to its customers, including the plaintiff customer.
Sending text messages through the web-based platform involved multiple steps. First, one of the Club's employees would input phone numbers into the platform either by manually typing them in or cutting and pasting from an existing list. Also, the Club's customers could add themselves to the platform by sending their own text message to the system.
Second, a Club employee would designate specific phone numbers to which a message would be sent. The employee would then "click 'send' on the website…to transmit the message" to the Club's customers, including the Client. The employee could either transmit the texts in real time or preschedule them to be sent at a later time.
As a result of this process, an allegedly unwanted text was sent to the plaintiff customer.
He sued the Marketing Company and the Club for a one count violation of the TCPA. Essentially, he argued that the Club and Marketing Company violated the TCPA because the text message was sent using an ATDS.
Early in the case, the plaintiff customer accepted an offer of judgment from the Marketing Company and that defendant was dismissed. Later, the Club moved for summary judgment.
As you may recall, under the TCPA, it is "unlawful for any person within the United States…(A) to make a call (other than a call made for emergency purposes or made with the prior express consent of the called party) using [an ATDS]…(iii) to any telephone number assigned to a…cellular telephone service…or any service for which the called party is charged for the call." 47 U.S.C. § 227(b)(1).
Furthermore, an ATDS is defined as "equipment which has the capacity---(A) to store or produce telephone numbers to be called using a random or sequential number generator; and (B) to dial such numbers." Id. at § 227(a)(1).
The Club argued that the statutory definition of an ATDS was "clear and unambiguous" and that because of this the interpretation "begins and ends with the statutory text" above, without regard for any Federal Communications Commission ("FCC") interpretation.
The Club also argued that, to be an ATDS, the "equipment must have the capacity to store or produce telephone numbers to be called using a random or sequential number generator."
However, the Court held that because Congress had expressly conferred authority on the FCC to "issue interpretive rules pertaining the TCPA," any rules or regulations interpreting or expanding the definition of ATDS were to be applied to this case.
Additionally, the Court noted that the Hobbs Act, 28 U.S.C. § 2342(1) and the Federal Communications Act, 47 U.S.C. § 402(a), "operate together to restrict district courts from invalidating certain actions by the FCC." In particular, the Hobbs Act "jurisdictionally divests district courts from ignoring FCC rules interpreting the TCPA."
Accordingly, the Court held that the language of the TCPA alone was not dispositive of whether the web-based platform the Club used was an ATDS.
Turning to the FCC's definition of ATDS, the Court noted a number of FCC regulations that expanded the definition of ATDS beyond the plain statutory language in the TCPA.
The Court noted that, based upon a 2003 FCC ruling, in addition to automatic dialers, "predictive dialers" (i.e. systems that dial numbers from customer calling lists), also fall "within the meaning and statutory definition of…" ATDS.
The Court also noted that the FCC affirmed this expanded definition in 2008, and reaffirmed it again in 2012. In particular, in 2012, the FCC stated that ATDS systems include systems that have the "capacity to store or produce and dial those numbers at random, in sequential order, or from a database of numbers." 27 FCC Rcd. 15391, 15392 n.5 (2012).
In addition, according to the FCC, this definition was not limited to "predictive dialers" but also included "web-based text messaging platforms."
Accordingly, the Court held that the fact that the Club's "system has the ability to send text message from preprogrammed lists, rather than randomly or sequentially, does not disqualify it as an ATDS."
Second, the Club argued that even if FCC regulations applied, the web-based platform used to send the text messages at issue was still not within the definition of an ATDS because it required "human intervention" to send message.
The Court agreed, holding that the web-based platform was not an ATDS because the text messages that it sent were the "result of human intervention."
As you may recall, in a 2008 ruling, reiterated in its ruling earlier this year, the FCC stated that the "defining characteristic of an autodialer is 'the capacity to dial numbers without human intervention.'" 23 FCC Rcd. At 566.
The Court held that, therefore, the "capacity to dial numbers without human intervention is required for TCPA liability."
Applying these TCPA definitions to the Club's web-based platform, the Court held that it was not an ATDS.
It held that "human intervention was involved in several stages of the process" prior to the client receiving the text messages. This included, among other things, transferring the numbers into the database, determining when to send the message, and actually clicking "send" to transmit the message.
The Court held that the web-based platform did not have the capacity to send texts automatically without any human intervention. Indeed, it could not send text messages without human intervention, and thus was not an ATDS.
Therefore, the Court held that the Club was not liable under the TCPA and granted summary judgment in favor of the Club.

References: § 45
 § 45
 § 45
 § 2607
 § 2607
 v. 
 § 2607
 § 2607
 § 2607
 § 2607
 v. 
 § 2607
 § 227
 § 227
 § 227
 § 2342
 § 402