ABA Section of Antitrust Law Consumer Protection Committee: CONSUMER PROTECTION LAW UPDATE (June 2015)

July 14, 2015 Presented by Womble Carlyle Sandridge & Rice, LLP

FTC & Federal Developments

Start with Security • At the end of June, the FTC released a guide for

businesses regarding lessons learned from the FTC’s 50+ data security enforcement actions

• General standard of care for securing sensitive data: 10 good practices

• https://www.ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf

Start with Security • 1: Start with security • 2: Control access to data • 3: Require secure passwords & authentication • 4: Store sensitive PI securely and protect it

during transmission • 5: Segment your network and monitor who’s

trying to get in or out

Start with Security • 6: Secure remote access to your network • 7: Apply sound security practices when

developing new products • 8: Make sure your service providers implement

reasonable security measures • 9: Put procedures in place to keep your security

current and address vulnerabilities that may arise

• 10:Secure paper, physical media, and devices

“Prized” app may be no prize • App developer settles FTC and New Jersey charges app hijacked

consumers’ phones to mine cryptocurrency • Settlement with Equiliv Investment and Ryan Ramminger regarding “Prized”

app under FTC Act and NJ Consumer Fraud Act • App premise: earn points redeemable for prizes for downloading affiliated

apps, playing games with embedded ads, taking surveys • Allegations: Malware installed that took control to “mine” for virtual

currencies, drained device batteries and data plans • Settlement enjoins creating and distributing malware, requires destruction of

all consumer information collected through marketing and distribution of app, and $50,000 judgment payable to NJ ($44,800 suspended upon payment of $5,200 and compliance with the injunctive provisions of stipulated order)

• https://www.ftc.gov/enforcement/cases-proceedings/142-3144/equiliv-investments-prized

Proposed Gramm-Leach-Bliley rule amendment to allow online privacy notices from auto dealers

that offer financing

• FTC proposes to permit online updates about dealers’ privacy policies rather than mailing yearly updates provided consumers notified yearly of availability online

• Still have to provide hard copy on request, or in connection with changes to policy

• Details: https://www.ftc.gov/system/files/documents/federal_register_notices/2015/06/150623glbfrn.pdf

• Public comment period ends August 31, 2015

Car Talk • FTC approved final consent orders with 2 car title lenders alleged

not to have disclosed important conditions and financing terms • First American Title Lending and Fast Cash Title Pawn prohibited

from failing to disclose all qualifying terms for obtaining loan at advertised rate and what finance charge will be after introductory period & no misrepresentation of material terms of loan agreements. First American also prohibited from stating certain repayment terms without clearly and conspicuously stating all the terms required by the Truth in Lending Act and Regulation Z

• FTC says these were its first two car title loan cases • FTC encourages consumers to shop around for financing

Car Talk Cont’d • Abernathy Motor Company (AK auto dealer) and its owners will pay

a $90,000 civil penalty to settle FTC charges they failed to show “Buyers Guide” on used vehicles (required by FTC Used Car Rule) addressing whether warranty applies and related information

• For sales in Spanish, barred from failing to provide in Spanish • Also barred from misrepresenting material conditions regarding cars

offered for sale (e.g., mechanical condition) • To include in sales contracts: “The information you see on the

window form for this vehicle is part of this contract. Information on the window form overrides any contrary provisions in the contract of sale.”

FTC presents efforts combatting robocolls to Congress

• FTC gave testimony before Senate Special Committee on Aging regarding its efforts protecting consumers from unwanted telemarketing calls and illegal robocalls (prerecorded phone messages), some targeting seniors

• Per the written testimony, FTC has brought 120 Do Not Call enforcement actions against 377 corporations and 298 individuals, of which 37 are robocall enforcement actions against 121 companies and 90 individuals. Of the $100 million collected in Do Not Call cases, $28 million are from cases involving illegal robocalls

• Among enforcement measures, FTC technology contests to help block and trace robocalls

Do Not Track Kids Bill Reprised

• Sen. Markey (D-Mass.) and Rep. Barton (R-Texas) re-introduced bill to update Children’s Online Privacy Protection Act (COPPA); also signing Sens. Kirk (R-Ill.) & Blumenthal (D-Conn.) and Rep. Rush (D-Ill.)

• Extends protections to teens 13 to 15 [up from 12 and under, under COPPA], prohibiting Internet companies from collecting personal and location information from teens without their consent

• “Eraser button" … if technologically feasible • “Digital Marketing Bill of Rights for Teens” • Parental or teen consent prior to targeted advertising • Bill text: http://www.markey.senate.gov/imo/media/doc/2015-06-11-

DoNotTrackKids-BillText.pdf (last visited July 5, 2015)

State AG Developments

Apple E-Book Price-Fixing Case

• 33 state AGs and the Department of Justice brought a lawsuit against Apple and 5 major publishers in 2012.

• The lawsuit alleged that Apple had conspired with the publishers to raise prices across the e-book market.

• In 2013, a U.S. District Court concluded that Apple violated the Sherman Antitrust Act and issued an injunctive order preventing, among other things, Apple from signing agreements with the publishers.

• On June 30th, 2015, a divided 2nd Circuit Court of Appeals upheld the District Court’s verdict.

• The 2nd Circuit found that Apple “orchestrated a conspiracy among publishers to raise e-books prices.” The conspiracy “unreasonably restrained trade” in violation of the Sherman Act, and the injunction was proper in order to protect the public from future anticompetitive harms.

• Apple had previously negotiated a settlement with the 33 state AGs (and private counsel in a related class action) but the settlement was contingent upon the 2nd Circuit’s finding of liability.

• Consumers are expected to receive approximately $450 million. • Publishers settled with the DOJ prior to trial. • One judge dissented. Apple stated that it is assessing its next steps. United States v. Apple, Inc., U.S. Court of Appeals for 2nd Circuit, Case No. 13‐3741‐cv (June 30 2015). http://www.ca2.uscourts.gov/decisions/isysquery/855159e5-6b93-4d51-b298-1a92a952f9e5/1/doc/13-3741_complete_opn.pdf#xml=http://www.ca2.uscourts.gov/decisions/isysquery/855159e5-6b93-4d51-b298-1a92a952f9e5/1/hilite/

Robocalls • 39 state AGs wrote a letter to the FCC requesting the FCC to allow phone

carriers to offer consumers technology to block robocalls. • FCC voted on June 18th, 2015 to allow. • Changes to the telecom statutes will:

– allow call-blocking technologies like NoMoRobo, Call Control and Telemarketing Guard;

– Give consumers the right to more easily revoke consent to get robocalls and robotexts; and

– Close legal loopholes for autodialers. • On June 29th, 2015, the New York AG and PayPal announced that unless a

consumer explicitly consents, PayPal will not robocall for marketing purposes.

• On June 30th, 2015, the FTC and the Florida AG filed a complaint against Lifewatch, charging the company with using illegal and deceptive robocalls to trick older consumers in North America into signing up for medical alert systems with monthly monitoring fees ranging from $29.95 to $39.95.

http://www.ncdoj.gov/News-and-Alerts/News-Releases-and-Advisories/Press-Releases/NC-consumers-can-soon-block-unwanted-robocalls,-AG.aspx

FTC/Florida AG Joint Actions to Protect Seniors

• In addition to the robocall case just mentioned, the FTC and the Florida AG filed a complaint against several companies alleging that the defendants engaged in a debt relief telemarketing scam.

• The companies promised to reduce credit card debt in exchange for an upfront fee.

• The FTC and Florida AG charge that the defendants’ conduct was particularly egregious because it systematically targeted elderly consumers.

• In the complaint, the plaintiffs seek permanent injunctive relief, consumer redress, including rescission or reformation of contracts, restitution, refunds and disgorgment, and civil penalties under FDUTPA.

• A growing number of AG offices are prosecuting and focusing on initiatives to protect the elderly, including asking financial institutions, banks and other organizations to have elder abuse prevention policies in place.

http://myfloridalegal.com/webfiles.nsf/WF/JMAR-9Y7KR9/$file/EM+system.pdf

Negative Option Marketing • Negative option marketing is a sales practice where a seller treats a customer’s failure to

take an affirmative action, such as to reject an offer or to cancel an agreement, as assent to be charged for products or services. This practice often includes consent for automatic renewals without further disclosure.

• 22 state AG offices entered into 2 multistate settlements with Classmates, Inc., FTD.com, Inc., and Florists’ Transworld Delivery, Inc.

• The settlements totaled $11 million and settle allegations that the companies engaged in misleading advertising and billing practices.

• The companies collaborated with third-party marketers to sell online membership programs separate from the companies’ products/services.

• The companies agreed to make changes to their business practices, including: – more clear disclosure about automatic renewals; – easier methods for cancellation; – offers must be made after the consumers have concluded their transactions with the

companies so that its clear that it is a separate and distinct offer; – Consumers must consent to the transfer to another site before being transferred to a

marketing partner to receive the trial offer; and – The parties cannot state that an offer is free or risk-free if it will convert into a paid

subscription.

Transportation Services • New York AG announced a settlement with LYFT

– Lyft violated NY laws by failing to require its drivers to hold commercial licenses, carry adequate insurance or comply with local for-hire licensing rules.

– Lyft is required to pay $300k in penalties. – One of the largest penalties against a “sharing economy”

company to date. • New York AG announced $14 million settlement with a

number of car dealerships – Dealerships participated in “jamming” which is unlawfully

charging consumers hidden purchases (worthless after-sale items). Most of the time, they sold items consumers did not need, ask for or know about.

Donor Transparency Reforms Minnesota AG

• Minnesota AG entered into settlement agreement with Savers, a retail thrift store chain.

• The AG filed a lawsuit against Savers claiming it misled donors and shoppers.

• Minnesota AG states that it is the first state to put in place donor transparency reforms.

• The settlement agreement provides for the following: – Savers will disclose that it is a for-profit organization. – Savers will track and segregate donations. – Savers will not solicit donations for which it does not compensate the charity on whose

behalf the donation was made. – Savers will prominently display in each store and disclose in written solicitations the

actual amount it pays charities for donations. – Before soliciting donations, Savers must register as a professional fundraiser with the

AG office for each charity on whose behalf it intends to solicit donations. – Savers will not distribute tax receipts to donors for one charity when the consumer

intended to donate to another. – Savers will pay $1.8 million to certain charities.

http://www.ag.state.mn.us/Office/PressRelease/20150625SaversRegulatoryAgreement.asp

State Developments Cases and Legislation

Pleadings in False Advertising Claims

• The Court of Appeals for the 4th Circuit dismissed a false advertising claim against GNC and Rite Aid.

• Consumers alleged that defendants violated consumer protection laws of various states when they marketed supplements (containing glucosamine, chondroitin and other ingredients) as promoting joint health, even though many scientific studies have shown that glucosamine and chondroitin are no more effective than a placebo.

• The Court affirmed the lower court’s dismissal of the suit, stating that the plaintiffs failed to state a claim.

• The district court in Maryland held that a manufacturer couldn’t be liable for false advertising so long as at least one qualified expert could reasonably conclude that the ingredients were effective for joint treatment.

• The Court of Appeals agreed and stated that the plaintiffs had conceded that some reasonable experts believed that glucosamine and chondroitin could provide the relief promised by the supplements.

• Plaintiffs must allege that “all reasonable experts in the field agree that the representations are false. If plaintiffs cannot do so because the scientific evidence is equivocal, they have failed to plead that the representations based on this dispute scientific evidence are false.”

• The Court also ruled that the proposed class action was defective because it did not allege that all the ingredients in the supplements couldn’t provide the represented benefits, focusing on just two ingredients.

In Re: GNC Corp.; Triflex Products Marketing and Sales Practices Litigation, case number 14-1724, in the U.S. Court of Appeals for the Fourth Circuit (June 19, 2015).

Opposition to National Data Breach Law

• 47 state AGs signed a letter to U.S. Congress in response to recent efforts by Congress to pass a national law on data breach notification.

• The AGs cautioned against federal preemption of state data breach and security laws.

• The letter states that “preempting state law would make consumers less protected than they are right now.”

http://www.oag.state.md.us/Press/NAAG_Data_Breach.pdf (Copy of the letter)

Trend: Amendments to States’ Breach Notification Laws

• A large number of states are updating their breach notification laws. A few recent examples: • Nevada: Effective July 1, 2015, the amendment adds driver authorization card, medical or

health ID number, and a user name/unique identifier or email address in combination with a password to the definition of PI.

• Wyoming: Effective July 1, 2015, the amendment, among other things, expands the definition of PII to include medical information, biometrics, and online account information.

• Washington: Effective July 23, 2015, businesses must notify the AG within 45 calendar days of discovering a breach affecting more than 500 individuals; the law has also been expanded to cover non-computerized data breaches as well as computerized data.

• North Dakota: Effective August 1, 2015, organizations that experience a breach affecting more than 250 individuals are required to disclose such breach to the AG. The definition of PI adds an access code/password combination requirement to employer identification numbers.

• Rhode Island: Effective June 26, 2016, Rhode Island has repealed its current breach notification law and replaced it with a new version, requiring notification to consumers within 45 days of confirming the breach and to the AG and consumer reporting agencies for breaches affecting more than 500 state residents. The law requires entities to put in place a risk-based information security program, including a retention requirement to only keep PI for as long as required to provide the requested services.

• Oregon: Effective January 1, 2016, the definition of PI is expanded to include biometrics, health insurance identifiers, and medical information; notification must also be provided to the AG if the number of consumers who must be notified exceeds 250.

Nevada: http://www.leg.state.nv.us/Session/78th2015/Bills/AB/AB179_EN.pdf Wyoming: http://legisweb.state.wy.us/2015/Enroll/SF0035.pdf Washington: http://lawfilesext.leg.wa.gov/biennium/2015-16/Pdf/Bills/House%20Passed%20Legislature/1078-S.PL.pdf North Dakota: http://www.legis.nd.gov/assembly/64-2015/documents/15-8181-04000.pdf?20150415122056 Rhode Island: http://webserver.rilin.state.ri.us/BillText/BillText15/HouseText15/H5220A.pdf Oregon: https://olis.leg.state.or.us/liz/2015R1/Downloads/MeasureDocument/SB601/Enrolled

Standing Under FDUTPA • Caribbean Cruise Line, Inc. v. Better Bus. Bureau of Palm Beach Cnty., Inc., No. 4D13-

3916, 2015 WL 3480114 (Fla. 4th DCA June 3, 2015). – The Florida District Court of Appeal reversed in part a trial court’s order granting Better Business

Bureau’s motion to dismiss Caribbean Cruse Line’s complaint. The complaint alleged defamation and violation of FDUPTA, arising out of BBB’s “F” rating of Caribbean Cruise Line.

– BBB sought dismissal arguing that FDUTPA does not allow actions for damages by non-consumers. The court reversed the dismissal, holding that Caribbean Cruise Line did not have to be a consumer to seek relief.

– Any person, consumer or not, can bring an action for damages under FDUTPA after the 2001 amendments to the statute, which removed the word “consumer” and added the word “person” in the section allowing for a private right of action.

• Democratic Rep. of the Congo v. Air Capital Group, LLC, No. 14-11243, 2015 WL 3619452 (11th Cir. June 11, 2015).

– The U.S. Court of Appeals for the 11th Circuit affirmed a judgment based on a jury verdict holding that Air Capital Group, among other things, violated FDUTPA.

– DRC entered into an agreement with Air Capital Group to service and repair the president’s aircraft, but the services were not performed.

– The defendant appealed on the basis that DRC lacked standing to bring an FDUTPA claim because only “consumers” qualify for FDUPTA protection and DRC was a government entity.

– The 11th Circuit noted that courts have not interpreted the 2001 amendments consistently with some conservative courts only extending protection to persons who bought or sold goods and services, and other courts extending FDUTPA protection to any person.

– The Court did not agree with the restrictive reading of FRUTPA, but said that even under a conservative approach, the DRC can sue. The DRC was acting as a private airline when it contracted with the defendants. Furthermore, the legislature did not intend to deny private suits by public entities.

Lanham Act Cases

Blue Buffalo Co. Ltd. v. Nestle Purina Petcare Co., 2015 WL 3645262 (E.D. Mo. June 10, 2015)

• Among other claims, Blue Buffalo sued Purina Petcare under Lanham Act claiming false advertising that main ingredients in many of its pet foods are various meats and seafood when the amount of such ingredients are very small in comparison to other ingredients.

• Court ruled that false advertising claims were sufficiently alleged by BB, but not sufficiently plead under federal standards.

• Ruling based on standard of determining what a reasonable consumer would believe and whether they would be misled by claims at issue – based on extrinsic evidence from both sides. Whether advertising is deceptive and misleading is an Issue of fact; can’t be resolved through motion to dismiss.

• BB’s insufficient claims dismissed with leave to amend by BB.

Design Resources, Inc. v. Leather Industries of America, 2015 WL 3775712 (4th Cir. June 18,

2015) • Plaintiff/Appellant DR alleged false advertising claims under Lanham

Act by Defendant/Appellee LIA based on ad placed by LIA in trade magazine alerting consumers about companies misrepresenting products made from leather scraps as “leather products” and use of the term “bonded leather.”

• 4th Cir rejected DR’s literal falsity argument (namely, that claims of ad in dispute were literally false by implication in that readers of the ad would infer the misleading conclusion based on reading OTHER articles in the magazine where the ad was placed that DR was the only one selling the sort of product at issue).

• Court also held that the DR’s claim that the phrase “bonded leather” was “bound to confuse consumers” wasn’t a factual representation and was instead DR’s expressed opinion, and rejected this argument, as well. Not an actionable Lanham Act claim.

NAD Case Updates

Xenex Ultraviolet Disinfection Device • Xenex Disinfection Services LLC; NAD Case No. 5813C (June 10,

2015); NAD Compliance Report for underlying NAD Case No. 5813 from February, 2015; Challenger – The Clorox Company

• Xenex agreed to voluntarily and permanently discontinue express claims at issue in underlying NAD decision regarding its “Xenex Germ-Zapping Robots”

• Xenex indicated that its express claims and any implied claims derived from those express claims “ran their course” and, for reasons unrelated to the challenge, “will be permanently discontinued.”

• Clorox initiated compliance proceeding in May, 2015, arguing that Xenex continues to make the same claims (on its website) it promised to discontinue – its devices are faster, more effective and easier to use than mercury-based systems, and “toxic mercury” can be found in competing devices

• NAD found that Xenex did, in fact, comply with underlying decision

Alleviate Dietary Supplement • Institute For Vibrant Living; NAD Case No. 5852 (June 10, 2015);

Challenger – Council for Responsible Nutrition • IVL advertised numerous express claims and testimonials regarding

relief of joint pain and improvement of joint function and cardiovascular health from use of its Alleviate dietary supplement

• IVL said its claims were, indeed, substantiated by competent and reliable evidence: randomized, placebo-controlled human trials, animal studies, and in vitro studies, on the ingredients in its product

• Challenger: IVL’s studies didn’t match dosage, formulation and administrative route found in the product itself

• NAD: some (very few) of IVL’s claims had a reasonable basis and were supported by its studies, but most must be modified or discontinued

TriCalm Itch Reliever • Cosmederm Biosciences, Inc.; NAD Case No. 5853 (June 10,

2015); Challenger – Chattem, Inc. • CB makes an OTC anti-itch product called TriCalm • CB advertised that most OTC topical itch relief products don’t give

relief and that its product is 5 times more effective than hydrocortisone 1% at reducing itch

• Also, CB’s ads featured older individuals, but none of its studies were on such populations, and none of its studies were conducted in the winter (i.e., drier months)

• NAD: CB’s evidence didn’t support its claims – the product was not tested according to consumer use instructions, and was only tested on induced itches, rather than naturally-occurring ones

• NAD recommendation that CB discontinue claims • CB indicated it will appeal to NARB

Vamousse Lice Treatment and Protection

• TyraTech, Inc.; NAD Case No. 5854 (June17, 2015); Challenger – Sanofil Pasteur, Inc.

• TT makes homeopathic lice preventative and treatment products • TT’s ads included performance and efficacy claims, including that its

product “kills 100% of lice and eggs in 15 minutes” and “kills lice and eggs with 1 application”

• Challenger said they were health claims; TT said they were not, because product acts upon lice

• TT based its performance claims only on in-vitro lab testing • NAD: TT’s health-related performance claims should be held to

same substantiation standards as other health claims – requires human clinical trials, not just in-vitro lab tests

• NAD recommended TT cease performance claims based on lab tests

EP Henry Concrete Landscaping Pavers

• NAD reported on June 25 that EP Henry violated NAD procedures

• NAD says EP Henry promoted the outcome of a case decided by the NAD directly to EP Henry’s customers, and in doing so, mischaracterized the NAD’s findings

• NAD procedures: parties to an NAD case are prohibited from utilizing NAD decisions for promotional purposes

Questions or comments?

Thank you!