I Received an FTC CID. Now What? FTC Investigations and Changes to the Process

Published On July 27, 2017 | By Stacey Brandenburg | FTC

In an effort to provide greater transparency and efficiency and to reduce the burden of its investigations on businesses, especially small businesses, the Federal Trade Commission (“FTC”) announced several internal “reforms” to the Bureau of Consumer Protection’s investigatory process.

The process changes, which appear to be effective immediately, require FTC staff to:

  • Communicate more directly with targets about the information sought and keep them apprised of the investigation’s status;
  • Generally reduce the time period covered by the requests and allow for more response time – extending from 21 days to 30 days for targets and 14 days to 21 days for third parties;
  • Provide more detailed information in the investigatory demand so targets can better understand what information is actually sought; and
  • Communicate the status of an investigation every six months, following a target’s response.

The FTC will also seek to simplify the instructions for providing electronically stored data. As a practical matter, these reforms may be helpful; however, they are not likely to be game changers.

To help explain how these reforms might apply and to address some general questions we receive from companies responding to a Federal Trade Commission investigation, we have provided responses to some frequently asked questions. Of course, each investigation is unique, but here are a number of questions that may be generally applicable. This is not intended to be legal advice for your situation, just general practice pointers. We are happy to discuss any of these issues in more detail with you.

Q:My company received a letter (rather than a Civil Investigative Demand), what should I do?

Regardless of whether you receive a letter or a “CID,” the first step is to assess the information sought. In order to provide a meaningful response, try to understand what the FTC is trying ascertain and what type of case they might be considering. The FTC announced that it will attempt to provide more detailed descriptions of the purpose and scope of its investigations to help companies understand what information is sought. However, those with experience responding to these requests still can be helpful here in reading between the lines. Understanding the Commission’s focus can help you more efficiently provide responsive information and figure out what requests you can narrow or eliminate entirely, at least in the first instance.

Q:The questions are very broad. Responding will be burdensome. What can or should I do?

After you review the requests for what subject matter, issues, or event is likely at the heart of their investigation, identify (1) realistically what you could produce and in what time period; and (2) your sensitivity around providing the requested information. Also, determine if certain requests are truly burdensome, as the FTC will be sensitive to such burdens, especially in light of recent reforms.

Then, consider contacting outside counsel as they can begin negotiating the production scope and timing with the FTC and create a bit of a buffer between you and the agency. If you handle the response yourself, you should propose a “meet and confer” to the contact attorney. During this conversation, try to understand what the FTC wants to learn from their requests and propose ways to narrow the requests so you can reasonably respond. Initial questions are often intentionally broad, and you are allowed to suggest reasonable ways to narrow them. Keep in mind that there is a short time period (14 days) for starting the meet and confer process in the response to a formal CID.

Q:I have tried to narrow the requests but it took several days for the letter to make its way to me so the deadline is only a few days away. What about this looming deadline?

Remain calm. You can request an extension or propose making a production in phases, and you can learn from the FTC attorney which items they would like to receive first. Rarely is any production made in full by the initial deadline. Sometimes, key information can be provided early on in the process, and may give the Commission enough information to allow you to defer or reduce production of some of the originally requested items.

Q:You mentioned earlier that I might receive a letter or a CID.  Is there a practical difference for me here?

If you received an “access letter,” then the FTC’s requests are not legally compulsory. So, technically, you could refuse to comply with their requests. Although it is usually advisable to voluntarily produce at least some information, there may be times when you require the FTC to obtain compulsory process such as if you have promised users that you will not provide information absent such process.

Q:I now have settled on a production list and schedule. What happens next?

You should issue a litigation hold internally, and then proceed in a methodical way to collect and produce the information sought. At a minimum, you would make your productions, and respond to follow up questions that the Commission may have for you. But a more effective way to provide the information is to provide an accompanying letter or explanation with each production that helps put the information you are providing in context, especially to help point out or underscore explanations or background that might not be apparent from the documents themselves.

Q:How long should I expect to wait after production is complete and what exactly am I waiting for?

Usually, it takes a few months for the FTC to review your production, digest it, and decide how to proceed. The FTC stated in its discussion of process reforms that it will communicate with targets every 6 months about the status of the investigation after they comply with the CID. Typically, but not always, the staff attorney will notify you as to the proposed disposition of the investigation. The Commission may close the case – and it will remain non-public; they may close the investigation but publish a “closing letter” in which they acknowledge investigating your company and explain briefly why they decided not to bring an enforcement action, or they may approach you with a draft complaint that they intend to file in federal court or in an administrative proceeding if you do not enter into a settlement with them.

Q:In the first two instances, it does not sound like there is much more for me to do. What about the third, where the Commission threatens to file a complaint?

That is typically a tough situation for the company and is time to evaluate the risks of settlement – which could include payment of fines and years of regulatory oversight – against the risks of litigation. But a proposed complaint does not mean that the opportunity for advocacy has entirely passed. If you have not already, consider retaining experienced FTC counsel to help you evaluate your options and, if appropriate, negotiate a settlement. If you have not retained counsel, this is your last chance to try to influence the outcome in a more favorable way.

Q:Do you recommend one approach over another?

As a practical matter, few companies end up litigating. The question is whether there is a negotiated outcome that you can live with and that the FTC will accept. There is usually some room for negotiating the draft complaint and consent decree. The decision as to whether to settle or litigate turns on a number of factors, including the unique claims alleged, your risk tolerance, and the range of acceptable outcomes for the company.

Q:We know that the FTC generally operates with 5 Commissioners, but currently, there is only one Commissioner and an acting Chairman. Will this affect investigations and/or enforcement actions?

Investigations begin with staff. Neither Bureau nor Commission approval is required to initiate an investigation or send an access letter. So, we may see more access letters rather than CIDs (which require Commissioner approval) under the current arrangement. Additionally, given the Acting Chairman’s public statements, we could see fewer unfairness claims brought under Section 5 and a greater emphasis on the deception theory or other statutes the FTC enforces, although it is a bit soon to fully know. Finally, the Chairman’s announced reforms suggest a greater sensitivity to the impact of investigations on business, which could mean a more streamlined, transparent, and efficient experience.

Check back this fall for registration and details about our webinar discussing lessons learned from recent FTC cases and the potential impact of the FTC’s investigatory process reforms. This webinar builds on Kandi and Stacey’s previous webinar “Understanding the Process of an FTC & State AG Investigation,” which you can listen to here.

 

About The Author

Stacey advises clients on a wide range of privacy and data security issues. A veteran of the Federal Trade Commission’s Division of Privacy and Identity Protection, Stacey assists clients in responding to FTC investigations involving potential violations of Section 5 of the FTC Act, the FTC’s advertising guidelines, and the Children’s Online Privacy Protection Act (COPPA). She also helps clients respond to investigations by State Attorneys General. Stacey helps clients implement sound security and privacy practices and provides compliance training to employees. Stacey is on the faculty at American University’s Washington College of Law, where she teaches on technology and privacy-related issues.

Comments