In the latest twist in the FTC v. LabMD matter, the Eleventh Circuit Court of Appeals recently issued a stay of the FTC’s final order pending appeal. As previously reported by FTCLaw.com, the FTC in late July issued an Opinion and Final Order reversing an ALJ’s initial decision to dismiss Commission’s case against LabMD. The FTC said at the time, “In reversing the ALJ ruling, the Commission concludes that LabMD’s data security practices were unreasonable and constitute an unfair act or practice that violated Section 5 of the Federal Trade Commission Act.” LabMD thereafter sought a stay of the FTC’s final order, but to no avail. As a result, LabMD filed a petition for review with the Eleventh Circuit, seeking a stay pending LabMD’s appeal of the FTC’s decision.
LabMD Seeks a Stay of FTC’s Final Order from Entire Commission
LabMD’s application argued that the case met the necessary factors listed in 16 C.F.R. § 3.56(c). First, LabMD stated that “the factual record is voluminous, complex, and spans a period of at least ten years,” and that the case “involves several novel bases for decision, all of which invite alternative conclusions—as demonstrated by the divergent conclusions reached by Chief Administrative Law Judge D. Michael Chappell.” LabMD said it “is likely to succeed on the merits because, inter alia, the Commission Opinion and Order are ultra vires, violate due process, are unsupported by substantial evidence, and are otherwise contrary to law.”
Second, LabMD said, if it was required to comply with the FTC’s order, it would suffer irreparable harm. LabMD is currently required to incur expenses that it “has no ability to pay” under the FTC’s order. The application also states that LabMD will be irreparably harmed by the final order to the extent it violated LabMD’s “constitutional rights, harm[s] its reputation, and irreparably and irredeemably causes direct and indirect harm, prejudice, and damage to LabMD’s appeal rights.”
Third, LabMD stated that a stay would not harm anyone because “[t]here is no danger that LabMD’s alleged computer data-security practices between 2005 and 2010 will harm anyone or reoccur, as LabMD is no longer operational and its computers are not even turned on, let alone connected to the Internet.” Finally, LabMD explained that “it is always in the public interest to ensure that the Commission Opinion and Final Order comply with the United States Constitution and other federal law.”
FTC Claims LabMD Failed to Meet Its Burden
The FTC’s response claimed that LabMD “failed to meet its burden to show that a stay … is warranted.” The FTC argued that LabMD “failed to show that is likely to succeed on appeal with its recycled arguments. And Respondent has also failed to substantiate its claims of the harm it will suffer if the Commission does not grant a stay.” As a result, and “[i]n light of the overwhelming interest of consumers in the relief provided by the Final Order,” the FTC’s counsel requested that the Commission deny the application for a stay.
Commission Denies Application for Stay
The Commission, agreeing with the position of the FTC’s counsel, denied the application for a stay. The FTC’s denial concluded:
Although the case raises important legal questions, none of LabMD’s arguments suggests that it is likely to prevail on appeal. Moreover, LabMD has not shown that it will suffer substantial irreparable harm absent a stay. On the other hand, there is potential risk of harm to hundreds of thousands of consumers if the protections provided in the Final Order are stayed during the pendency of LabMD’s appeal. The equities thus cut strongly against granting the stay.
LabMD Petitions 11th Cir. for Review
LabMD thereafter filed a petition for review with the Eleventh Circuit. In conjunction with its petition for review, LabMD filed a time sensitive motion requesting the Eleventh Circuit to issue a stay of the FTC’s final order pending appeal. According to LabMD:
LabMD has a substantial likelihood of success, most notably because the Order rests on interpretations of Section 5 of the FTC Act that (i) run directly counter to the plain language and/or the FTC’s own longstanding written interpretations of Section 5; (ii) have never before been articulated by the FTC or adopted by any court of appeals; and (iii) if allowed to stand would effectuate a breathtaking expansion of the FTC’s authority that the legal community and members of Congress have already called into serious question. Second, the equities weigh heavily in favor of the requested stay.
11th Cir. Agrees with LabMD, Enters Stay
The Eleventh Circuit granted LabMD’s motion for a stay by unanimous decision. The main issue on appeal is whether the FTC’s own interpretation of the FTC Act is reasonable. “There are compelling reasons why the FTC’s interpretation may not be reasonable,” the court said. LabMD established the requisite likelihood of success on the merits, according to the court. The court said that it doubted whether the FTC Act governs intangible harms like those involved in the LabMD matter, and that the FTC’s interpretation of “likely to cause” substantial injury to consumers to mean “significant risk,” as opposed to “probable,” was not reasonable.
Addressing the other elements necessary to secure a stay pending appeal, the Eleventh Circuit agreed that complying with the FTC’s final order would irreparably harm LabMD given its paltry financial position. Conversely, the court explained that there would be no substantial injury to other parties given that LabMD is no longer operating. Lastly, the Eleventh Circuit stated that the public interest factor was neutral.
Whose Interpretation of the FTC Act is Correct?
LabMD’s appeal will now proceed on the merits, and any resulting decision is likely to send shock waves through the data security industry. If the Eleventh Circuit accepts the FTC’s interpretation of the FTC Act, then it will allow the FTC to further tighten its grip on data security practices. Additionally, a decision in favor of the FTC would effectively allow the FTC to govern “intangible harms,” as opposed to substantial injuries involving monetary harm or unwarranted health and safety risks. Conversely, if the eleventh Circuit sides with LabMD, then it may spell trouble for the FTC going forward as it relates to data security or data breaches. Because most data breaches cases often involve the threat of consumer injury, and not actual consumer injury, then a decision rejecting the FTC’s intangible harm theory would cast doubt on the FTC’s ability to govern such harms.
Photo Cred.: bloomberg.com