Federal Trade Commission and Consumer Financial Protection Bureau Remedies FTC section by Katherine Armstrong, Drinker Biddle & Reath LLP CFPB section by Adam Maarec, Davis Wright Tremaine LLP and Nicholas Smyth, Reed Smith LLP The Federal Trade Commission's (“FTC”) remedial powers have evolved over the agency's 100 years, but the core of its authority is found in Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. Amendments to the FTC Act and other statutes have given the Commission additional authority to obtain monetary relief and to bring actions in district court. For example, Section 13(b) of the FTC Act allows the FTC to obtain extraordinary relief such as asset freezes and temporary restraining orders, in proper cases.1 In general, the FTC seeks to prevent the unlawful conduct from occurring in the future and, where appropriate to provide redress to injured consumers, disgorge ill-gotten gains, or pay civil penalties to the U.S. Treasury. The Consumer Financial Protection Bureau’s (“CFPB” or “Bureau”) remedial powers are found in Section 1055 of the Consumer Financial Protection Act ("CFPA").2 The statute permits the CFPB to pursue "any appropriate legal or equitable relief with respect to a violation of Federal consumer financial law" in state or federal court or in an administrative proceeding.3 For the FTC, the remedy is dependent on the facts, the forum, and the specific statute under which the action is brought. The CFPB’s remedial authority is not limited by the forum or statutory violation because the CFPA specifies the relief available for violations of the Federal consumer financial laws. What follows is a brief summary of each agency’s remedial authority. Federal Trade Commission The remedies used by the FTC can be divided into the following categories: prohibition of unlawful conduct, informational or other affirmative obligations, and monetary relief. Prohibition of Unlawful Conduct The purpose of injunctive relief is to enjoin illegal conduct alleged in the complaint and prevent future violations of the law.4 Injunctive relief is a staple of both FTC administrative and district court orders. For example, when a complaint alleges that a particular representation is false, the order will prohibit the respondent from making the false claim in the future. When a representation is alleged to be unsubstantiated, the order will prohibit the claim unless it can be properly substantiated. The proper level of substantiation may also be included in the order such as the requirement that certain health claims be supported by two clinical trials.5 Court's will scrutinize Commission orders to ensure that there is a "reasonable fit" between the order's requirements and the government interest.6 When a complaint alleges a violation of another statute enforced by the FTC, such as the Fair Credit Reporting Act (FCRA),7 the order will prohibit future violations of the statute. 1 15 U.S.C. § 53(b). 2 12 U.S.C. § 5565. 3 12 U.S.C. § 5565(a)(1). 4 U.S. v. Colgate-Palmolive Co., 380 U.S. 374 (1965). 5 Thompson Medical Co., 104 F.T.C. 648, 826 (1984); aff’d, 791 F.2d 189 (D.C. Cir 1986). 6 POM Wonderful, LLC v. FTC, No. 13-1060 at p. 45 (D.C, Cir. January 30, 2015). 7 15 U.S.C. § 1681 et seq. When appropriate an order may also include "fencing-in relief which broadens the coverage of the order beyond the specific prohibitions. For example, if the conduct alleged to be unlawful can be easily transferable to other products that a company sells or within a specific industry, the order's injunctive relief may cover "all products" the company sells. The goal of fencing-in relief is to ensure that the order may not be by-passed with impunity.8 The factors the Commission will consider in determining the appropriate fencing-in relief include the seriousness of the violation, the violator's record with respect to deceptive practices, the deliberativeness of the conduct, and the potential transferability of the illegal practice to other products.9 Informational or Other Affirmative Obligations When the Commission determines that injunctive relief alone may not prevent the recurrence of the unlawful conduct, it may impose additional affirmative obligations. These obligations may include affirmative disclosures, corrective advertising, and in the privacy and data security area, the development and implementation of privacy or data security assessments. Affirmative Disclosures Affirmative disclosures are required when the Commission determines that in order to prevent future deception, consumers need more specific information. For example, specific language may be required to be disclosed when certain claims are triggered or when the claims relate to health, safety, or financial issues. For example, in a case involving the marketing of St. John's Wort, in addition to prohibiting the company from making unsubstantiated claims about the efficacy of the product, a warning was required for all advertising and promotional materials.10 Any disclosure required by an order must be made in a clear and conspicuous manner, which incorporates the concepts of placement, prominence, and proximity. A fine print disclosure at the bottom of a page or screen would not be clear and conspicuous. What is clear and conspicuous is contextual and Commission orders often specify how disclosures are made in marketing online and on smaller screens and devices. In the TALX settlement, the Commission required that in electronic media certain disclosures required by the FCRA be provided in a "clear and prominent" manner which was defined to be: ... (a) unavoidable; (b) of a size and shade, and shall appear on the screen for a duration, sufficient for an ordinary consumer to read and comprehend it; (c) easily printable; and (d) presented on the principal screen or landing page where the disclosure is relevant.11 The FTC provides important guidance on how to communicate effective online disclosures through its business education materials. Corrective Advertising Corrective advertising is a remedy that goes beyond the prohibition of unsubstantiated or false claims and requires that affirmative statements be included in advertising and marketing for a set period of time. It is used as a remedy when the Commission has determined that the challenged ads have “substantially created or reinforced a misbelief and the misbelief is likely to linger into the future without the dissemination of a truthful message to counteract the beliefs created by the deceptive claims."12 In 2000, the Commission ordered Novartis, the maker of Doan's Pills, to run ads to correct misbeliefs resulting from their unsubstantiated claim that Doan's Pills are superior to other over-the-counter analgesics for treating back pain. Specifically, the Commission's order required advertising and packaging to carry the message, "Although Doan's is an effective pain reliever; there is no evidence that Doan's is more effective than other pain relievers for back pain.”13 While the Commission's authority to order corrective advertising has been upheld on 8 FTC v. Ruberoid Co., 343 U.S. 470, 473 (1952). 9 Sears, Roebuck & Co. v. FTC, 676 F.2d 385, 391 (9th Cir. 1982). 10 Panda Herbal Int’l, Inc. 132 F.T.C 125 (2001). 11 U.S. v. TALX Corp., No. 4:09-cv-01171 (E.D. Mo. July 9, 2009). 12 FTC v. Novartis Corp, 127 F.T.C. 580, 697 (1999); aff’d 223 F.3d 783 (D.C. Cir. 2000). 13 Id. The Commission’s order was issued after an Administrative Law Judge upheld the complaint allegations that the claims were unsubstantiated appeal, it is not a remedy that is frequently used. Direct Notifications Direct notification to consumers or others of a particular Commission action is a remedy used when the purchasers of products or services are known and the alleged misrepresentation concerns a health or safety risk. For example, the manufacturer of a fitness device was required to notify purchasers that the device posed a safety hazard.14 Biennial Reports and assessments Many of the Commission's data security' and privacy settlements require the establishment and maintenance of a comprehensive privacy or data security program.15 Such a program must include, among other things: the designation of employees to coordinate and be accountable for the program; procedures for identifying risks that could result in the unauthorized collection, use or disclosure of consumer information; design and implementation of reasonable privacy controls and procedures; the development and use of reasonable steps to select and retain service providers; and processes to evaluate and adjust the program through testing and monitoring. Most data security and privacy orders also require biennial audits for up to 20 years from an independent third party professional approved by the Commission.16 Deletion of Consumer Information Another remedy in the privacy area is the deletion of consumer information. This remedy is used when the Commission has alleged that certain consumer information has been obtained improperly. The order will require that all information within the respondent's possession, custody, or control and which was acquired prior to the date of the order be deleted.17 Bans and Bonds On occasion, individuals have been banned from certain industries or have been required to post bonds before engaging in business in order to ensure compliance with the orders. Generally these actions have involved fraud and have been filed in district court. Trade name excision Another example of the FTC's broad remedial authority is the use of excision of trademarks or trade names. Such a remedy is used when the marks or names are considered to be inherently deceptive. One example is the Commission's action against Thompson Medical Company and its “Aspercreme" product.18 Monetary Relief Redress and Disgorgement In the mid-1970's the Commission was given statutory authority to seek redress pursuant to Sections 13(b) and 19(b) of the FTC Act.19 While the initial focus of Section 13(b) was on anticompetitive merger cases, the FTC began using this authority in in the 1980's to challenge fraudulent conduct. The remedies available pursuant to an action brought under Section 13(b) rely on the court's equitable powers and upon a proper showing allow the district court to issue injunctive relief and allows for ancillary relief necessary to accomplish complete justice including monetary relief in the form of redress to injured consumers.20 and false, but did not impose a corrective advertising remedy sought by complaint counsel. On appeal to the Commission, the Commission imposed the corrective advertising remedy. The D.C. Circuit Court of Appeals upheld the Commission’s order. 14 Consumer Direct, Inc., 113 F.T.C. 923 (1990). 15 See, Snapchat, Inc., File No. 132 3078 (December 31, 2014) and Goldenshores Technologies, LLC, and Erik M. Geidl, File No. 132 3087 (April 9, 2014). 16 Id. 17 See, Goldenshores Technologies, LLC, and Erik M. Geidl, File No. 132 3087 (April 9, 2014). 18 Thompson Medical Co., 104 F.T.C. 648 at 837-39 (1984). 19 15 U.S.C. §§ 53(b), 57b(b). 20 FTC v. Pantron I Corp., 33 F.3d 1088, 1102 (9th Cir. 1994). Section 19(b) redress is confined to administrative actions and was added as part of the Magnuson-Moss Act to improve the FTC's consumer redress powers. Section 19 requires there final administrative cease and desist order where the conduct was found to be 'dishonest or fraudulent" and then a separate action in district court where the court determines the appropriate redress for consumers.21 Restitution is generally not viewed as a prospective remedy and therefore not available in administrative settlements.22 However, respondents often consent to paying restitution in administrative settlements without establishing that the conduct was "dishonest or fraudulent." Disgorgement is used when redress is impracticable, but monetary relief is deemed appropriate.23 Civil Penalties Civil penalties can only be obtained under specific statutory provisions. For example, the Commission can recover up to $16,000 per violation for violations of administrative orders.24 Civil penalties are also available for violations of certain trade regulation rules25 or specific statutes, such as the FCRA.26 Section 5(m) allows the Commission to bring an action against a non-respondent for knowing violations of a previous administrative cease and desist order to which it was not a party and which defines an act or practice to be deceptive.27 This third avenue for obtaining civil penalties has not been widely used and has proven to be somewhat cumbersome because it requires ensuring that non-respondents have knowledge of the specific conduct that the Commission has found to be unfair or deceptive. The civil penalty amount depends on a variety of factors including the extent of the violations, the history and duration of the conduct, as well as the respondent's ability to pay.28 The Commission will also rely on its own precedent when in terms of what has been obtained in other actions when arriving at the appropriate amount. Other statutes enforced by the FTC, such as the FCRA have specific sections relating to civil penalties. For example, the FCRA requires that that the court consider the degree of culpability, any history of such prior conduct, ability to pay, effect on ability to continue to do business, and such other matters as justice may require.29 Civil penalty actions are referred to the Department of Justice for filing and if the Department chooses not to file the action, the Commission has authority to file the matter in its own name. 30 Civil penalties are paid to the U.S. Treasury. Consumer Financial Protection Bureau Remedies The CFPA identifies various types of relief for violations of Federal consumer financial law,31 including, "without limitation": • Rescission or reformation of contracts; • Refund of moneys or return of real property; • Restitution; • Disgorgement or compensation for unjust enrichment; • Payment of damages or other monetary relief; • Public notification regarding the violation. including the costs of notification; • Limits on the activities or functions of the person; and 21 FTC v. Figgie Inc., 994 F.2d 595 (9th Cir. 1993). 22 Heater v. FTC, 503 F.2d 321 (9th Cir. 1974) (Injunctive relief under Section 5 of the FTC Act is prospective and does not include restitution.) 23 See, Equifax Information Services LLC, File No. 132 3252 (March 15, 2013). 24 15 U.S.C. § 45(l). 25 15 U.S.C. § 45(m). 26 15 U.S.C. § 1681s. 27 15 U.S.C. § 45(m)(1)(B)(1). 28 See, U.S. v. J.B. Williams Co., 498 F.2d 414, 438 (2nd. Cir. 1974). 29 15 U.S.C. §1681s(a)(2)(B). 30 15 U.S.C. § 56. 31 The CFPA defines “Federal consumer financial law” to include the CFPA itself, the 18 “enumerated consumer law[s], the laws for which authorities are transferred under subtitles F and H, and any rule or order prescribed by the Bureau under this title, an enumerated consumer law,” or one of such transferred authorities. 12 U.S.C. § 5481(14). • Civil money penalties ("CMPs") of: o Up to $5,000 for each day of a violation of a law, rule, or final order or condition imposed in writing by the CFPB; o Up to $25,000 for each day of a reckless violation of a Federal consumer financial law; or o Up to $1,000,000 for each day of a knowing violation of a Federal consumer financial law.32 The CFPA does not empower the CFPB to impose exemplary or punitive damages.33 Any civil money penalty sought by the Bureau must take into account "mitigating factors" including "the size of financial resources and good faith of the person charged; the gravity of the violation or failure to pay; the severity of the risks to or losses of the consumer, which may take into account the number of products or services sold or provided; the history of previous violations; and such other matters as justice may require."34 Credit for Responsible Business Conduct In addition, the CFPB issued a bulletin in 2013 identifying specific features of "responsible business conduct" that the Bureau "may favorably consider in exercising its enforcement discretion." 35 The bulletin identified four categories of responsible business conduct, which it emphasized were "not exhaustive": • Self-policing — the implementation of compliance management systems that promote the prompt identification and correction of potential violations, which can be reflected in a "culture of compliance" set by the "tone at the top" of the organization. • Self-reporting — special emphasis is placed on prompt and complete reporting to the Bureau of significant violations and potential violations before discovery of the issue through supervisory or other actions becomes imminent. • Remediation — prompt correction of errors including "full redress" to consumers for any injuries, taking steps to prevent violations from recurring including sanctions on individuals responsible for misconduct, and changing practices to protect or benefit consumers. • Cooperation — when an investigation of a potential violation occurs, "substantial and material steps above and beyond what the law requires" should be taken to provide information identifying the problem and the company's response. If a company faced with an enforcement investigation for a potential violation of law engages in "responsible business conduct" as described above, the Bureau has discretion to favorably alter its approach. Examples of favorable courses of action include a non-public enforcement action, treating the conduct as a "less severe type of violation", reducing the number of violations pursued, or reducing the amount of sanctions or penalties. Application of the CFPB's Remedial Powers The majority of the CFPB' s enforcement actions have been in the form of administrative or judicial settlements whereby the remedial provisions are executed upon agreement of the parties and without an admission from the settling party that violation of law occurred.36 Since the CFPA requires the CFPB to take into account the "mitigating factors" described above, the three tiers of CMPs serve as upper bounds for any settlement negotiation between the CFPB and an 32 12 U.S.C. § 5565(a)(2). 33 12 U.S.C. § 5565(a)(3). 34 12 U.S.C. § 5565(c)(3). 35 CFPB Bulletin 2013-06, Responsible Business Conduct: Self-policing, Self-Reporting, Remediation, and Cooperation (June 25, 2013), available at http://files.consumerfinance.gove/f/201306_cfpb_bulletin_responsible-conduct.pdf . 36 When the CFPB believes its case merits enforcement action and it cannot reach a negotiated settlement, the agency typically files a complaint in federal district court. The CFPB has approximately 19 cases pending in courts around the country (as of December 1, 2015) and it has resolved several other litigated cases through settlements. By comparison, the CFPB has filed only two contested actions in its administrative proceeding: In Re: PHH Corp., which is on appeal before the D.C. Circuit Court of Appeals, and In Re: Integrity Advance, LLC, which it filed on November 18, 2015. entity under investigation. In the course of negotiations, the CFPB's Office of Enforcement may mention the theoretical maximum penalty amount that it could impose for a particular violation, and it may use this amount as leverage in persuading defendants to settle. But the final CMP amount in most settlements is well below the theoretical limit. This is one reason defendants have generally been reluctant to challenge the CFPB in court or administrative proceeding; a court or administrative law judge could order much higher CMPs in a litigated judgment. The public record does not provide much guidance on how the Bureau applies the CMP tiers and the mitigating factors in agreeing to CMP numbers below the theoretical limits. But it is clear that the CFPB weighs the statute's mitigating factors and the responsible conduct factors. In some public settlements, where the factors weighed strongly enough in favor of the defendant, the CFPB has agreed to take no CMPs at all.37 Moreover, application of the CFPB's remedial powers has been hard to predict over the short course of the CFPB's tenure. By way of example, the CFPB has issued enthrcement actions against nine banks and two service providers for allegedly unfair and deceptive acts in connection with the sale of credit card add-on products during telemarketing calls. See chart below. The allegations in each of these actions revolved around similar allegedly deceptive telemarketing practices and unfair billing practices, but the civil penalties and restitution amounts were significantly different in each case. Based on the public aspects of these enforcement actions, it is difficult to determine how or why the civil money penalty and restitution amounts were determined. CFPB Credit Card Add-On Product Enforcement Actions Date Filed Company Product/Service Civil Penalties Restitution Notes 07/17/12 Capital One Bank, N.A. Credit card debt protection and credit monitoring $25 million $140 million Coordinated action with OCC 09/24/12 Discover Bank Credit card debt protection, identity theft monitoring, and credit score tracking $14 million $200 million Joint Consent Order with FDIC 09/18/13 JPMorgan Chase Bank, N.A.; Chase Bank USA, N.A, Credit card identity theft monitoring $20 million $309 million Coordinated action with OCC 12/24/13 American Express Travel Related Services Company Credit card debt protection and identity theft monitoring $4 million None 12/24/13 American Express Centurion Bank Credit card debt protection and identity theft monitoring $3.6 million $40.9 million Coordinated action with FDIC 12/24/13 American Express Bank, FSB Credit card debt protection and identity theft monitoring $2 million $18.6 million Coordinated action with OCC 04/09/14 Bank of America, N.A.; and FIA Card Services, N .A. Credit card debt protection and identity theft monitoring $20 million $727 million Coordinated action with OCC 37 See In Re: Dealers Financial Services, LLC, Consent Order, File No. 2013-CFPB-0004, available at http://files.consumerfinance.gove/f/201306_cfpb_enforcement-order_2013-0589-02.pdf . 06/19/14 GE Capital/Synchrony Bank Credit card add-on products $3.5 million $56 million 09/25/14 US Bank, N.A. Credit card identity theft monitoring $5 million $48 million with a $25.5 million floor Coordinated action with OCC 07/01/15 Affinion Group Holdings, Inc. Credit monitoring $1.9 ninon $6.76 million 07/01/15 Intersections Inc. Credit monitoring $1.2 million $55,000 07/21/15 Citibank, N.A., Department Stores National Bank, and Citicorp Credit Services, Inc. Credit card debt protection and credit monitoring; expedited payments $35 million $675 million 09/28/15 Fifth Third Bank Credit card debt protection $500,000 $3 million Total $180.7 million $2.2 billion Civil Penalty Fund In contrast to the FTC, which returns any money collected in civil penalties to the U.S. Department of the Treasury, the CFPB is required by the CFPA to deposit any CMPs into a civil penalty fund, the proceeds of which may be used only to 1) Pay compensation to consumers harmed by violations of a law for which the CFPB is authorized to obtain relief and who have not yet been compensated through restitution or another form of redress, or 2) If all victims in settlements that fall in a given time period have been compensated, the CFPB may allocate funds for consumer education or financial literacy purposes.38 The CFPB promulgated a rule in 2013 that implements the fund, and it updated this rule in 2015.39 Conclusion The civil penalty authority is the biggest difference between the FTC and the CFPB. It is likely that in drafting the CFPA Congress took advantage of some lessons learned from the FTC’s enforcement history which is evidenced in the streamlined remedy approach of Section 5565. There is rising concern that companies that could be subject to the jurisdiction of either agency will pay larger penalties if the CFPB brings the action. That is likely true both in light of Section 5565, but also because the FTC is constrained somewhat by its past precedent when negotiating civil penalties, though it appears that the FTC is getting more aggressive. While monetary relief is important to the FTC injunctive relief has almost always been included in FTC consumer protection orders whether the matter is filed administratively or in district court. Perhaps because monetary relief was not the original remedy of the FTC Act, over the years the FTC has ordered other informational or affirmative obligations when injunctive relief will not completely remedy the unlawful conduct. These remedies are not insignificant. 38 12 U.S.C. § 5497(d). 39 12 CFR Part 1075.