Source: https://www.wsgrdataadvisor.com/2017/11/ndcal-ftc-d-link-systems/
Timestamp: 2019-04-25 22:50:36+00:00

Document:
The U.S. District Court for the Northern District of California recently issued a mixed ruling on D-Link Systems’ motion to dismiss in FTC v. D-Link Sys., Inc.1 D-Link sells routers and Internet protocol (IP) cameras that it markets as having good data security, including “the latest wireless security features to help prevent unauthorized access” and “the best possible encryption.”2 The Federal Trade Commission (FTC) filed a complaint against D-Link, alleging that the company’s products were in fact subject to “widely known and reasonably foreseeable risks of unauthorized access,” and that, among other things, D-Link failed to deploy “free software, available since at least 2008, to secure users’ mobile app login credentials.”3 The complaint alleges five claims for deceptive marketing practices and one count for unfair practices under Section 5 of the FTC Act.
D-Link moved to dismiss the FTC’s complaint under Federal Rules of Civil Procedure 12(b)(6), 9(b), and 8(a). Judge James Donato denied D-Link’s motion with respect to three of the FTC’s deception counts, and dismissed the other two deception counts and the unfairness count with leave to amend. In so doing, Judge Donato held that deception claims under Section 5 sound in fraud and are therefore subject to the heightened pleading standards of Rule 9(b). Judge Donato also observed that Rule 9(b) might apply to Section 5 unfairness claims in some circumstances, but dismissed that claim separately because the FTC had failed to plead any “substantial injury” to consumers.4 The court’s decision suggests a departure from the injury standard articulated by the FTC in In re LabMD, Inc. At the same time, the court signaled to the FTC how it might amend its unfairness count to state a viable claim going forward.
In reaching its conclusion, the court looked to the Ninth Circuit’s decision in Vess v. Ciba-Geigy Corp. USA.6 In Vess, the Ninth Circuit examined whether claims under the California Unfair Competition Law (UCL), which, like Section 5, prohibits deceptive practices without requiring fraud as an element, must nevertheless satisfy Rule 9(b). It held that any claim that alleges a defendant engaged in fraudulent conduct must indeed satisfy Rule 9(b), even if fraud is not necessarily an element of the claim. Based on Vess and other Ninth Circuit decisions, Judge Donato concluded Rule 9(b) applies to the FTC’s deception claims in this case.
Judge Donato found three of the FTC’s five deception counts adequately stated claims for relief. The court held that those claims, which allege that D-Link misrepresented the data security and protections its devices provide, adequately stated the “‘who, what, when, where and how of the misconduct charged’” as required by Rule 9(b).11 Specifically, it found the FTC’s allegations that D-Link’s routers and IP cameras “do not protect against ‘critical and widespread web application vulnerabilities’ identified since 2007, including ‘“hard-coded” user credentials,’ ‘command injection flaws’ and ‘other backdoors’”12 sufficiently explained why D-Link’s statements about data security were deceptive.
The FTC’s other two deception counts alleged D-Link misrepresented data security features in promotional materials for IP cameras and graphic user interfaces for routers. Although the complaint attached materials in support of those claims, most failed to identify the dates when the misrepresentations were made or seen, and only one of those materials met the standards of Rule 9(b). That document, a brochure for an IP camera, simply advertised a “surveillance camera” and otherwise “contain[ed] no representations at all about digital security.”13 Judge Donato held that the document did not adequately support claims that D-Link misrepresented the data security features of IP cameras and routers, and dismissed those claims with leave to amend.
In light of the insufficiency of the FTC’s allegations regarding actual harm or the likelihood of consumer harm, the Court dismissed the FTC’s unfairness claim. At the same time, Judge Donato pointed out that if the FTC had tied its unfairness claim to the representations that underlie the deception claims, the injury element would be more colorable because purchasing a device that fails to be reasonably secure, or as secure as advertised, “would likely be in the ballpark of a ‘substantial injury.’”23 Judge Donato thus paved a path forward for the FTC to replead its unfairness claim based on a more traditional economic loss theory of consumer harm.
While Judge Donato, like the ALJ in LabMD, emphasized that the FTC had not alleged even a single consumer suffered any kind of injury as a result of D-Link’s data security practices,28 the unfairness claim was ultimately dismissed because the complaint also “lack[ed] . . . facts indicating a likelihood of harm.”29 Although the FTC alleged facts to suggest a “possibility” of harm,30 these allegations in the D-Link complaint were necessarily less detailed and developed at the pleading stage than the facts before the commission in LabMD. By the time the LabMD matter had been appealed to the FTC, the facts had been well-developed to the point they included expert findings. Seeming to acknowledge this, the FTC tried to argue that the degree of likely substantial injury is an issue of fact that the D-Link court should not resolve on a motion to dismiss, but the court rejected that argument. It follows that the court’s decision in D-Link may not depart from the FTC’s standard for substantial injury in LabMD, so much as the federal courts impose higher procedural hurdles than agency adjudication when it comes to developing the facts needed to demonstrate substantial injury. Assuming that the FTC decides to replead, how the court will ultimately rule on the FTC’s unfairness count once the facts are known remains to be seen. For now, the court’s decision suggests, perhaps unsurprisingly, that the FTC’s unfairness claims are likely to fare better through the agency’s administrative channels than in federal courts.
1 No. 3:17-cv-00039-JD, 2017 U.S. Dist. LEXIS 152319 (N.D. Cal. Sept. 19, 2017).
4 Id. at *5-6, *14-17.
5 D-Link, 2017 U.S. Dist. LEXIS 152319, at *5; FTC v. Lights of Am., Inc., 760 F. Supp. 2d 848, 852-55 (C.D. Cal. 2010); FTC v. ELH Consulting, LLC, No. CV 12-02246-PHX-FJM, 2013 U.S. Dist. LEXIS 126110, at *1 (D. Ariz. Sept. 4, 2013); FTC v. Swish Mktg., No. C 09-03814 RS, 2010 U.S. Dist. LEXIS 15016, at *4-10 (N.D. Cal. February 22, 2010).
6 317 F.3d 1097, 1103-04 (9th Cir. 2003).
11 Id. (quoting Ebeid ex rel. United States v. Lungwitz, 616 F.3d 993, 998 (9th Cir. 2010)).
17 Id. at *12 (citing SEC v. Chenery Corp., 332 U.S. 194, 201-02 (1947); NLRB v. Bell Aerospace Co., 416 U.S. 267, 292 (1974)).
18 15 U.S.C. § 45(n).
19 D-Link, 2017 U.S. Dist. LEXIS 152319, at *14; see also id. at *15 (finding the sum total of the FTC’s harm allegations “make out a mere possibility of injury at best”).
22 Id. at *15-16 (citing FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) (where the complaint alleged actual consumer injury resulting from theft of the personal information of hundreds of thousands of consumers and over $10.6 million in fraudulent charges)).
24 LabMD, slip op at 20-25.
26 Id. at 23 (alteration in original) (citation omitted).
28 D-Link, 2017 U.S. Dist. LEXIS 152319, at *15.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 45
 v.