8 minute read | November.15.2022
The Federal Trade Commission (FTC) has continued to ramp up its investigation and enforcement efforts in 2022 to address unfair or deceptive acts or practices in the privacy, cybersecurity and consumer protection space. With FTC Chair Lina M. Khan at the helm of the agency, all indications are that this trend will continue in 2023.
The FTC has many investigative tools in its arsenal but its most widely used compulsory investigative tool is the Civil Investigative Demand (CID). A CID is a type of administrative subpoena that allows the FTC to demand the production of documents, written reports, responses to interrogatory questions, and even oral testimony. Typically, the FTC first conducts an initial investigation into the company or industry to gather facts and data from existing sources, voluntary investigative processes and/or internal review by FTC staff. The FTC may then issue a CID to a company it believes may have engaged in “unfair or deceptive” business practices in violation of Section 5 of the FTC Act. There is no evidentiary threshold the FTC needs to meet before issuing a CID, however, so the FTC may issue a CID merely to aid FTC investigators in determining whether evidence of a violation exists. The FTC may also issue a CID to a company to obtain information about other companies or an industry it is investigating.
The CID is often the first formal step of an investigation into a company’s privacy, cybersecurity or consumer protection practices. In addition to the initial CID, the FTC may issue follow-up questions to the company’s responses and issue additional CIDs to compel investigational hearings or the production of additional records. If the FTC determines that the investigation does not reveal a violation of law or regulation sufficient to justify an enforcement action, the FTC may close the investigation with no further action. If FTC staff determines that a violation has likely occurred, it may recommend the matter for further administrative or judicial enforcement proceedings, and/or may offer the company the opportunity to resolve the matter through a negotiated consent decree.
1. Do Not Panic, but Do Not Ignore a CID
Receiving a CID should not trigger panic so long as a company does not let the CID response languish. A CID marks only the first formal step in an investigation; it does not mean that the FTC has decided to file a complaint or impose civil penalties (yet).
A CID must be taken seriously, however, and should not be ignored. A CID is a form of compulsory process. If a company fails to comply with a CID, the FTC can petition a court to order compliance with the CID. In short, a company must respond to a CID, and that response should be thoughtful and strategic.
2. Read and Understand the CID
Before doing anything else, it is important to read the CID carefully and understand the nature of the FTC’s inquiry and the information sought. Doing so can help a company prepare a response that is appropriately tailored to the FTC’s investigation. Critical information within the CID will include:
The Nature and Scope of the FTC’s Investigation:
Analyzing the CID, understanding the nature of the business practices and allegations involved, and getting a handle on the overall response timeline at the outset is critical.
3. Preserve Documents
Once a company receives a CID, it is obligated to preserve all relevant documents in its possession, custody or control. This obligation applies to documents that may be held by third parties or company agents, and applies even if the documents may be protected from discovery by privilege. A company should promptly distribute a document preservation notice to relevant employees, vendors and other agents that maintain documents potentially relevant to the FTC’s investigation and inform them of their duty to preserve those documents and cease any scheduled destruction practices. A company can use this as an opportunity to identify employees who may be able to assist with its response and relevant document repositories.
4. Conduct a Privileged, Internal Investigation
A company should quickly retain counsel to direct a privileged, internal investigation into the business practices relevant to the scope of the FTC’s investigation. Counsel can help a company identify potential defenses and liabilities early on, as well as identify CID requests that may be particularly burdensome or require additional time to respond to. Furthermore, retaining counsel to conduct the internal investigation helps protect the investigation’s findings and related legal analysis from discovery under attorney-client privilege and work-product doctrine protections.
It is imperative to act quickly as this initial internal investigation and strategic planning can lead to a more productive “meet-and-confer” session with the FTC and will set the tone for the company’s longer-term CID response strategy.
5. Meet and Confer With the FTC
A company should take full advantage of the opportunity to meet and confer with the FTC regarding its CID response. A company may wish to be open with the FTC about challenges facing the company as a result of the pandemic, such as staffing reductions or financial hardship, that may impact the company’s ability to respond in a timely manner. Engagement with FTC staff attorneys early on in the process helps demonstrate a company’s good-faith effort to comply and cooperate, and also provides a company the chance to ask the FTC to provide additional background on the investigation and negotiate with the FTC regarding the scope of the CID’s requests and timing for the company’s response. The meet and confer can be used to prioritize certain responses and craft a response schedule that alleviates additional stress on the company.
6. Respond, Advocate and Resolve
Once a response schedule has been agreed to with the FTC and CID requests have been narrowed where necessary, it is time to respond to the substance of the CID. From extensive document collection and review to meticulous drafting of responses, responding to a CID often requires significant time, energy and financial resources from a company, which can distract from other pressing business needs and stretch employees thin. Working with experienced counsel, however, can help streamline the response and production process and reduce disruption on daily business operations.
In addition, working with experienced counsel can help a company advocate for itself. While it is incumbent upon the company to respond to each request with accuracy and candor, experienced counsel recognize where it is appropriate and beneficial to present the company’s responses within the broader context of the company’s good-faith actions, industry norms and abject reasonableness. The most effective submissions not only reply to the FTC’s questions but also recognize there is room for advocacy. The ultimate goal is to persuade the FTC to terminate its investigation without seeking any remedy or relief.
Orrick’s team of experienced FTC advisors, litigators and advocates have defended clients in dozens of FTC investigations and enforcement matters, many of which have been successfully (and nonpublicly) resolved without further action. Combining deep substantive knowledge of FTC regulations, jurisprudence and operations with practical experience, we stand ready to advise companies through the entire CID response process from receipt to resolution, to proactively engage with the FTC, and to relentlessly advocate for our clients to reduce their burden and legal risk. Please contact the authors with any questions about FTC investigations, or other privacy, security or consumer protection matters.