On August 21, 2019, the U.S. Court of Appeals for the Seventh Circuit held in FTC v. Credit Bureau Center, LLC, 2019 WL 3940917 (7th Cir. 2019) that the Federal Trade Commission (“FTC”) lacks authority to obtain monetary relief under Section 13(b) of the FTC Act. The FTC has relied on Section 13(b) to seek money relief in consumer protection enforcement actions, including privacy and cybersecurity matters, and had, prior to the Credit Bureau decision, suggested an intent to do so more frequently in the future.
Under Section 13(b), in certain circumstances the FTC is empowered to bring actions in federal court to seek temporary restraining orders and injunctions for violations of the FTC Act. According to the FTC, this provision also authorizes the agency to seek equitable money relief for such violations, even though the provision makes no mention of money relief.
In Credit Bureau, the FTC relied on this interpretation of Section 13(b) when it brought suit against the owner and operator of a credit-monitoring company that, according to FTC allegations, failed to make adequate disclosures. The District Court found for the FTC, entered a permanent injunction, and ordered the defendant to pay more than $5 million in restitution.
On appeal, the Seventh Circuit affirmed the injunction but, in a decision that overruled its own precedent and created a circuit split, the court overturned the monetary award. The Seventh Circuit rejected the FTC’s position that Section 13(b) authorizes monetary relief on the ground that an implied equitable monetary remedy would be incompatible with the Act’s express remedial scheme. Most notably, the court observed that the FTC Act has two detailed remedial provisions expressly authorizing equitable money relief if the FTC follows certain procedures. The FTC’s broad reading of Section 13(b) would allow the agency to circumvent these conditions on obtaining equitable money relief, contrary to the intent of Congress.
As we noted in a previous post, the FTC’s use of Section 13(b) recently came under scrutiny by the U.S. Court of Appeals for the Third Circuit in FTC v. Shire Viropharma, Inc. In Shire, the court held that Section 13(b) does not provide the FTC with authority to seek relief in federal court for every violation of the FTC Act. Instead, the court stated, Section 13(b) actions are limited to those cases where, among other things, the FTC can plead that a defendant “is violating or is about to violate” the law. The Seventh Circuit’s decision in Credit Bureau now recognizes an additional hurdle for the FTC’s use of Section 13(b)—one that is specific to equitable money relief—by holding that Section 13(b) does not provide for that type of relief under any circumstances. It remains to be seen whether the government will ask the U.S. Supreme Court to review the case.
As we’ve explained previously, the FTC takes the position that a failure to implement “reasonable” cybersecurity or privacy practices and/or making false or misleading statements about such practices can violate the FTC Act. The FTC has relied on Section 13(b) to seek money relief in privacy & cybersecurity cases and had, prior to the Credit Bureau decision, suggested an intent to do so more frequently in the future. To discuss the Credit Bureau decision in more detail as it relates to the FTC’s privacy and cybersecurity enforcement program, please feel free to contact any member of our privacy & cybersecurity litigation team, which has immense experience in this area.