Opinion ID: 2829975
Heading Depth: 2
Heading Rank: 3

Heading: Subsequent Congressional Action

Text: Wyndham next argues that, even if cybersecurity were covered by § 45(a) as initially enacted, three legislative acts since the subsection was amended in 1938 have reshaped the provision’s meaning to exclude cybersecurity. A recent amendment to the Fair Credit Reporting Act directed the FTC and other agencies to develop regulations for the proper disposal of consumer data. See Pub. L. No. 108-159, § 216(a), 117 Stat. 1952, 1985–86 (2003) (codified as amended at 15 U.S.C. § 1681w). The Gramm-Leach-Bliley Act required the FTC to establish standards for financial institutions to protect consumers’ personal information. See Pub. L. No. 106-102, § 501(b), 113 Stat. 1338, 1436–37 (1999) (codified as amended at 15 U.S.C. § 6801(b)). And the Children’s Online Privacy Protection Act ordered the FTC to promulgate regulations requiring children’s websites, among other things, to provide notice of “what information is collected from children . . . , how the operator uses such information, and the operator’s disclosure practices for such information.” Pub. L. No. 105-277, § 1303, 112 Stat. 2681, 2681-730–732 (1998) (codified as amended at 15 U.S.C. § 6502).6 Wyndham contends these “tailored grants of 6 Wyndham also points to a variety of cybersecurity bills that Congress has considered and not passed. “[S]ubsequent legislative history . . . is particularly dangerous ground on 21 substantive authority to the FTC in the cybersecurity field would be inexplicable if the Commission already had general substantive authority over this field.” Wyndham Br. at 25. Citing FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 143 (2000), Wyndham concludes that Congress excluded cybersecurity from the FTC’s unfairness authority by enacting these measures. We are not persuaded. The inference to congressional intent based on post-enactment legislative activity in Brown & Williamson was far stronger. There, the Food and Drug Administration had repeatedly disclaimed regulatory authority over tobacco products for decades. Id. at 144. During that period, Congress enacted six statutes regulating tobacco. Id. at 143–44. The FDA later shifted its position, claiming authority over tobacco products. The Supreme Court held that Congress excluded tobacco-related products from the FDA’s authority in enacting the statutes. As tobacco products would necessarily be banned if subject to the FDA’s regulatory authority, any interpretation to the contrary would contradict congressional intent to regulate rather than ban tobacco products outright. Id. 137–39; Massachusetts v. EPA, 549 U.S. 497, 530–31 (2007). Wyndham does not argue that recent privacy laws contradict reading corporate cybersecurity into § 45(a). Instead, it merely asserts that Congress had no reason to enact them if the FTC could already regulate cybersecurity through that provision. Wyndham Br. at 25–26. We disagree that Congress lacked reason to pass the recent legislation if the FTC already had regulatory authority over some cybersecurity issues. The Fair Credit Reporting which to rest an interpretation of a prior statute when it concerns . . . a proposal that does not become law.” Pension Benefit Guar. Corp. v. LTV Corp., 496 U.S. 633, 650 (1990). 22 Act requires (rather than authorizes) the FTC to issue regulations, 15 U.S.C. § 1681w (“The Federal Trade Commission . . . shall issue final regulations requiring . . . .” (emphasis added)); id. § 1681m(e)(1)(B) (“The [FTC and other agencies] shall jointly . . . prescribe regulations requiring each financial institution . . . .” (emphasis added)), and expands the scope of the FTC’s authority, id. § 1681s(a)(1) (“[A] violation of any requirement or prohibition imposed under this subchapter shall constitute an unfair or deceptive act or practice in commerce . . . and shall be subject to enforcement by the [FTC] . . . irrespective of whether that person is engaged in commerce or meets any other jurisdictional tests under the [FTC] Act.”). The Gramm-Leach-Bliley Act similarly requires the FTC to promulgate regulations, id. § 6801(b) (“[The FTC] shall establish appropriate standards for the financial institutions subject to [its] jurisdiction . . . .”), and relieves some of the burdensome § 45(n) requirements for declaring acts unfair, id. § 6801(b) (“[The FTC] shall establish appropriate standards . . . to protect against unauthorized access to or use of . . . records . . . which could result in substantial harm or inconvenience to any customer.” (emphasis added)). And the Children’s Online Privacy Protection Act required the FTC to issue regulations and empowered it to do so under the procedures of the Administrative Procedure Act, id. § 6502(b) (citing 5 U.S.C. § 553), rather than the more burdensome Magnuson-Moss procedures under which the FTC must usually issue regulations, 15 U.S.C. § 57a. Thus none of the recent privacy legislation was “inexplicable” if the FTC already had some authority to regulate corporate cybersecurity through § 45(a). Next, Wyndham claims that the FTC’s interpretation of § 45(a) is “inconsistent with its repeated efforts to obtain from Congress the very authority it purports to wield here.” Wyndham Br. at 28. Yet again we disagree. In two of the 23 statements cited by Wyndham, the FTC clearly said that some cybersecurity practices are “unfair” under the statute. See Consumer Data Protection: Hearing Before the Subcomm. on Commerce, Mfg. & Trade of the H. Comm. on Energy & Commerce, 2011 WL 2358081, at  (June 15, 2011) (statement of Edith Ramirez, Comm’r, FTC) (“[T]he Commission enforces the FTC Act’s proscription against unfair . . . acts . . . in cases where a business[’s] . . . failure to employ reasonable security measures causes or is likely to cause substantial consumer injury.”); Data Theft Issues: Hearing Before the Subcomm. on Commerce, Mfg. & Trade of the H. Comm. on Energy & Commerce, 2011 WL 1971214, at  (May 4, 2011) (statement of David C. Vladeck, Director, FTC Bureau of Consumer Protection) (same). In the two other cited statements, given in 1998 and 2000, the FTC only acknowledged that it cannot require companies to adopt “fair information practice policies.” See FTC, Privacy Online: Fair Information Practices in the Electronic Marketplace—A Report to Congress 34 (2000) [hereinafter Privacy Online]; Privacy in Cyberspace: Hearing Before the Subcomm. on Telecomms., Trade & Consumer Prot. of the H. Comm. on Commerce, 1998 WL 546441 (July 21, 1998) (statement of Robert Pitofsky, Chairman, FTC). These policies would protect consumers from far more than the kind of “substantial injury” typically covered by § 45(a). In addition to imposing some cybersecurity requirements, they would require companies to give notice about what data they collect from consumers, to permit those consumers to decide how the data is used, and to permit them to review and correct inaccuracies. Privacy Online, supra at 36–37. As the FTC explained in the District Court, the primary concern driving the adoption of these policies in the late 1990s was that “companies . . . were capable of collecting enormous amounts of information about consumers, and people were suddenly realizing this.” JA 106 (emphasis added). The FTC 24 thus could not require companies to adopt broad fair information practice policies because they were “just collecting th[e] information, and consumers [were not] injured.” Id.; see also Order Denying Respondent LabMD’s Motion to Dismiss, No. 9357, slip op. at 7 (Jan. 16, 2014) [hereinafter LabMD Order or LabMD] (“[T]he sentences from the 1998 and 2000 reports . . . simply recognize that the Commission’s existing authority may not be sufficient to effectively protect consumers with regard to all data privacy issues of potential concern (such as aspects of children’s online privacy) . . . .” (emphasis in original)). Our conclusion is this: that the FTC later brought unfairness actions against companies whose inadequate cybersecurity resulted in consumer harm is not inconsistent with the agency’s earlier position. Having rejected Wyndham’s arguments that its conduct cannot be unfair, we assume for the remainder of this opinion that it was.