Opinion ID: 2829975
Heading Depth: 2
Heading Rank: 2

Heading: Plain Meaning of Unfairness

Text: Wyndham argues (for the first time on appeal) that the three requirements of 15 U.S.C. § 45(n) are necessary but insufficient conditions of an unfair practice and that the plain meaning of the word “unfair” imposes independent requirements that are not met here. Arguably, § 45(n) may not identify all of the requirements for an unfairness claim. (While the provision forbids the FTC from declaring an act unfair “unless” the act satisfies the three specified requirements, it does not answer whether these are the only requirements for a finding of unfairness.) Even if so, some of Wyndham’s proposed requirements are unpersuasive, and the rest are satisfied by the allegations in the FTC’s complaint. First, citing FTC v. R.F. Keppel & Brother, Inc., 291 U.S. 304 (1934), Wyndham argues that conduct is only unfair when it injures consumers “through unscrupulous or unethical behavior.” Wyndham Br. at 20–21. But Keppel nowhere says that unfair conduct must be unscrupulous or unethical. Moreover, in Sperry the Supreme Court rejected the view that the FTC’s 1964 policy statement required unfair conduct to be “unscrupulous” or “unethical.” 405 U.S. at 244 n.5.3 3 Id. (“[Petitioner] argues that . . . [the 1964 statement] commits the FTC to the view that misconduct in respect of the third of these criteria is not subject to constraint as ‘unfair’ absent a concomitant showing of misconduct according to the first or second of these criteria. But all the FTC said in the [1964] statement . . . was that ‘[t]he wide variety of decisions interpreting the elusive concept of unfairness at least makes clear that a method of selling violates Section 5 if it is exploitive or inequitable and if, in addition to being morally objectionable, it is seriously 16 Wyndham points to no subsequent FTC policy statements, adjudications, judicial opinions, or statutes that would suggest any change since Sperry. Next, citing one dictionary, Wyndham argues that a practice is only “unfair” if it is “not equitable” or is “marked by injustice, partiality, or deception.” Wyndham Br. at 18–19 (citing Webster’s Ninth New Collegiate Dictionary (1988)). Whether these are requirements of an unfairness claim makes little difference here. A company does not act equitably when it publishes a privacy policy to attract customers who are concerned about data privacy, fails to make good on that promise by investing inadequate resources in cybersecurity, exposes its unsuspecting customers to substantial financial injury, and retains the profits of their business. We recognize this analysis of unfairness encompasses some facts relevant to the FTC’s deceptive practices claim. But facts relevant to unfairness and deception claims frequently overlap. See, e.g., Am. Fin. Servs. Ass’n v. FTC, 767 F.2d 957, 980 n.27 (D.C. Cir. 1985) (“The FTC has determined that . . . making unsubstantiated advertising claims may be both an unfair and a deceptive practice.”); Orkin Exterminating Co. v. FTC, 849 F.2d 1354, 1367 (11th Cir. 1988) (“[A] practice may be both deceptive and unfair . . . .”).4 We cannot completely disentangle the two detrimental to consumers or others.’” (emphasis and some alterations in original, citation omitted)). 4 The FTC has on occasion described deception as a subset of unfairness. See Int’l Harvester Co., 104 F.T.C. at 1060 (“The Commission’s unfairness jurisdiction provides a more general basis for action against acts or practices which cause significant consumer injury. This part of our jurisdiction is 17 theories here. The FTC argued in the District Court that consumers could not reasonably avoid injury by booking with another hotel chain because Wyndham had published a broader than that involving deception, and the standards for its exercise are correspondingly more stringent . . . . [U]nfairness is the set of general principles of which deception is a particularly well-established and streamlined subset.”); Figgie Int’l, 107 F.T.C. 313, 373 n.5 (1986) (“[U]nfair practices are not always deceptive but deceptive practices are always unfair.”); Orkin Exterminating Co., 108 F.T.C. 263, 363 n.78 (1986). So have several FTC staff members. See, e.g., J. Howard Beales, Director of the Bureau of Consumer Protection, FTC, Marketing and Public Policy Conference, The FTC’s Use of Unfairness Authority: Its Rise, Fall, and Resurrection (May 30, 2003) (“Although, in the past, they have sometimes been viewed as mutually exclusive legal theories, Commission precedent incorporated in the statutory codification makes clear that deception is properly viewed as a subset of unfairness.”); Neil W. Averitt, The Meaning of “Unfair Acts or Practices” in Section 5 of the Federal Trade Commission Act, 70 Geo. L.J. 225, 265–66 (1981) (“Although deception is generally regarded as a separate aspect of section 5, in its underlying rationale it is really just one specific form of unfair consumer practice . . . . [For example, the] Commission has held that it is deceptive for a merchant to make an advertising claim for which he lacks a reasonable basis, regardless of whether the claim is eventually proven true or false . . . . Precisely because unsubstantiated ads are deceptive in this manner, . . . they also affect the exercise of consumer sovereignty and thus constitute an unfair act or practice.”). 18 misleading privacy policy that overstated its cybersecurity. Plaintiff’s Response in Opposition to the Motion to Dismiss by Defendant at 5, FTC v. Wyndham Worldwide Corp., 10 F. Supp. 3d 602 (D.N.J. 2014) (No. 13-1887) (“Consumers could not take steps to avoid Wyndham’s unreasonable data security [before providing their personal information] because Wyndham falsely told consumers that it followed ‘industry standard practices.’”); see JA 203 (“On the reasonabl[y] avoidable part, . . . consumers certainly would not have known that Wyndham had unreasonable data security practices in this case . . . . We also allege that in [Wyndham’s] privacy policy they deceive consumers by saying we do have reasonable security data practices. That is one way consumers couldn’t possibly have avoided providing a credit card to a company.”). Wyndham did not challenge this argument in the District Court nor does it do so now. If Wyndham’s conduct satisfies the reasonably avoidable requirement at least partially because of its privacy policy— an inference we find plausible at this stage of the litigation— then the policy is directly relevant to whether Wyndham’s conduct was unfair.5 Continuing on, Wyndham asserts that a business “does not treat its customers in an ‘unfair’ manner when the business itself is victimized by criminals.” Wyndham Br. at 5 No doubt there is an argument that consumers could not reasonably avoid injury even absent the misleading privacy policy. See, e.g., James P. Nehf, Shopping for Privacy Online: Consumer Decision-Making Strategies and the Emerging Market for Information Privacy, 2005 U. Ill. J.L. Tech. & Pol’y. 1 (arguing that consumers may care about data privacy, but be unable to consider it when making credit card purchases). We have no occasion to reach this question, as the parties have not raised it. 19 21 (emphasis in original). It offers no reasoning or authority for this principle, and we can think of none ourselves. Although unfairness claims “usually involve actual and completed harms,” Int’l Harvester, 104 F.T.C. at 1061, “they may also be brought on the basis of likely rather than actual injury,” id. at 1061 n.45. And the FTC Act expressly contemplates the possibility that conduct can be unfair before actual injury occurs. 15 U.S.C. § 45(n) (“[An unfair act or practice] causes or is likely to cause substantial injury” (emphasis added)). More importantly, that a company’s conduct was not the most proximate cause of an injury generally does not immunize liability from foreseeable harms. See Restatement (Second) of Torts § 449 (1965) (“If the likelihood that a third person may act in a particular manner is the hazard or one of the hazards which makes the actor negligent, such an act[,] whether innocent, negligent, intentionally tortious, or criminal[,] does not prevent the actor from being liable for harm caused thereby.”); Westfarm Assocs. v. Wash. Suburban Sanitary Comm’n, 66 F.3d 669, 688 (4th Cir. 1995) (“Proximate cause may be found even where the conduct of the third party is . . . criminal, so long as the conduct was facilitated by the first party and reasonably foreseeable, and some ultimate harm was reasonably foreseeable.”). For good reason, Wyndham does not argue that the cybersecurity intrusions were unforeseeable. That would be particularly implausible as to the second and third attacks. Finally, Wyndham posits a reductio ad absurdum, arguing that if the FTC’s unfairness authority extends to Wyndham’s conduct, then the FTC also has the authority to “regulate the locks on hotel room doors, . . . to require every store in the land to post an armed guard at the door,” Wyndham Br. at 23, and to sue supermarkets that are “sloppy about sweeping up banana peels,” Wyndham Reply Br. at 6. The argument is alarmist to say the least. And it invites the 20 tart retort that, were Wyndham a supermarket, leaving so many banana peels all over the place that 619,000 customers fall hardly suggests it should be immune from liability under § 45(a). We are therefore not persuaded by Wyndham’s arguments that the alleged conduct falls outside the plain meaning of “unfair.”