InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
11th Circuit vacates FTC data security cease and desist order issued against medical testing laboratory
On June 6, the U.S. Court of Appeals for the 11th Circuit vacated an FTC cease and desist order (Order) that directed a Georgia-based medical testing laboratory to overhaul its data security program, ruling that the Order was unenforceable because it lacked specifics on how the overhaul should be accomplished. In 2013, the FTC claimed that the laboratory’s violation of Section 5(a) of the FTC Act constituted an “unfair act or practice” by allegedly failing to implement and provide reasonable and appropriate data security for patient information. The now defunct laboratory argued, among other things, that the FTC did not have the authority under Section 5 to regulate how it handled its data security measures. But the three-judge panel chose not to rule on the broader question about the scope of the FTC’s Section 5 data security authority, choosing to focus its decision on the Order. As previously covered in InfoBytes, in 2016 the FTC reversed an Administrative Law Judge’s Initial Decision to dismiss the 2013 FTC complaint, ordering the laboratory to, among other things, employ reasonable security practices that complied with FTC standards.
After the Order was issued, the laboratory asked the 11th Circuit to decide whether the FTC’s Order was “unenforceable because it does not direct it to cease committing an unfair ‘act or practice’ within the meaning of Section 5(a).” The 11th Circuit agreed to stay enforcement of the Order and ultimately permanently vacated it. “In the case at hand, the cease and desist order contains no prohibitions,” the panel wrote. “It does not instruct [the laboratory] to stop committing a specific act or practice. Rather, it commands [the laboratory] to overhaul and replace its data security program to meet an indeterminable standard of reasonableness. This command is unenforceable.” The court concluded that “[t]his is a scheme that Congress could not have envisioned.”
District Court holds that FTC investigation and initiation of enforcement proceedings do not qualify as final agency actions subject to judicial review
On May 29, the U.S. District Court for the Northern District of California granted the FTC’s motion to dismiss a declaratory-judgment action filed by several California-based companies that provide student loan processing services, along with their CEO/primary shareholder (plaintiffs). In August 2017, having allegedly learned that the FTC “was in the final process of gathering information to file a lawsuit against one or more of [the] [p]laintiffs on the purported and factually unsupportable basis that the [c]ompanies made misrepresentations to consumers” and violated the TSR’s debt relief service provision, the plaintiffs filed for instant declaratory relief under the Declaratory Judgment Act, seeking a declaration that the Telemarketing Sales Rule’s (TSR) debt relief provisions did not apply to them or, alternatively, that they were in compliance with the provisions. In February 2018, the FTC filed an enforcement action against the plaintiffs alleging that their collection of fees in advance of providing services violated the FTC Act and the TSR, and seeking injunctive and equitable relief. The FTC also moved to dismiss the plaintiffs’ declaratory judgment for lack of subject-matter jurisdiction.
According to the order granting the FTC’s motion, the court agreed with the FTC that the Administrative Procedure Act (APA)—not the Declaratory Judgment Act—is the exclusive, proper vehicle to obtain judicial review of a federal agency’s action. The court then held that the plaintiffs failed to satisfy the two prerequisites for judicial review under the APA, that (i) the agency’s actions constitute as a “final” agency action, and (ii) there exists no other adequate remedy in court. Specifically, the court found that the plaintiffs failed to demonstrate that the FTC’s “investigation into the lawfulness of the [plaintiffs’] actions and initiation of enforcement proceedings” qualified as a “final” agency action subject, and that the plaintiffs’ alternative “adequate remedy” was to be had in the enforcement action brought against them by the FTC, where they would be able to present all of the same defenses and arguments they sought to advance in their declaratory judgment action.
District Court holds that a debt buyer qualifies as a debt collector under the FDCPA
On May 25, the U.S. District Court for the Eastern District of Pennsylvania held that a debt buyer of time-barred debt qualified as a “debt collector” under the Federal Debt Collection Practices Act (FDCPA). The consumer (plaintiff) sued a debt collector and a debt buyer after receiving collection letters from the collector requesting she contact it to discuss settlement. The plaintiff alleged both companies violated the FDCPA by implying the debts were legally enforceable when, in fact, the statute of limitations had run. In rejecting the defendants’ motion to dismiss, the court found that the debt buyer’s “principal purpose of business is debt collection, either directly or through another collector” and therefore it is a debt collector under the FDCPA. The court also rejected the defendants’ arguments that the consumer did not adequately plead a violation of the FDCPA, holding that the collection letter—even though it did not threaten litigation or include a payoff amount—could mislead “the least sophisticated debtor” into believing she had a legal obligation to pay a time-barred debt because it called on plaintiff to contact it to discuss “settlement options” and specifically noted that the collector was not obligated to accept any payment proposal. The court also found that the letter may leave the least sophisticated debtor “uncertain as to her dispute rights under the [FDCPA]” and should have contained a “reconciling statement.”
District Court rules South Dakota banking regulator exceeded authority in revoking payday lender’s license
On May 29, the U.S. District Court for the District of South Dakota denied a motion to dismiss filed by the director of the South Dakota Division of Banking (defendant), ruling that the defendant exceeded his authority when he revoked a payday lender’s (plaintiff) operating license instead of initiating a cease and desist order, and that he failed to provide sufficient opportunities for the plaintiff to respond. According to the court, the defendant “had good cause to revoke [the plaintiff’s] money lending licenses,” having determined that late fees on the plaintiff’s loan product violated the 36 percent finance charge cap in the state’s 2017 payday lending law. But the court also held that the defendant committed a “procedural error” when he chose to “revoke the licenses rather than afford[] a hearing or [give the plaintiff] an opportunity to bring its practices into compliance. . . .”
The court further granted the plaintiff’s motion for partial summary judgment “on the violation of procedural due process” for a period from September 13 through September 28, 2017—the date that the defendant issued a limited stay on the license revocation allowing the company to collect on loans issued before the South Dakota payday lending law went into effect. “In short, [the defendant’s] Order did not meaningfully advance the interests of the state (and indeed contravened state law), and the ‘substitute procedures’ sought by [the plaintiff] (and required under state law) would have accommodated the competing interests, provided due process, and not needlessly compromised the private interests of [the plaintiff],” the court wrote.
4th Circuit affirms sanctions for attorneys in payday lawsuit
On May 31, the U.S. Court of Appeals for the 4th Circuit affirmed sanctions against three attorneys for challenging the authenticity of a loan document for two years without revealing they had obtained a copy of the document from their client before filing the original complaint. The action results from a now closed case in which a consumer alleged he received loans at predatory interest rates (annual interest rate of about 139 percent) from a tribal lender and sought to impose liability on the non-lenders, including a credit union, which processed the debit transactions under the loan agreement. In response to a motion to dismiss, the attorneys for the consumer challenged the authenticity of the loan agreement provided by the credit union. After years of litigation, the credit union discovered the consumer had provided his attorneys with the loan agreement prior to the original complaint filing and moved for sanctions against the attorneys. The attorneys argued that they had no affirmative duty to disclose documents before the opening of discovery.
The lower court disagreed, determining that each attorney had “acted in bad faith and vexatiously and violated their duty of candor by hiding a relevant and potentially dispositive document from the Court in connection with a long-running dispute over arbitrability.” In February 2017, the lower court ordered two attorneys and their respective law firms jointly liable for $150,000 in attorneys’ fees and a third associate attorney jointly liable for $100,000. Upon appeal, the 4th Circuit held that the lower court did not abuse its discretion in awarding the compensatory sanctions, stating “without losing the forest for the trees, we conclude that the district court reasonably described sanctioned counsels’ conduct as evincing a multi-year crusade to suppress the truth to gain a tactical litigation advantage.”
Superior Court rules phone calls, email are not alternatives to an ADA-compliant website
On May 21, a California Superior Court granted summary judgment to a visually-impaired plaintiff, ruling that “auxiliary aids” in the form of phone calls or email replies do not meet the Americans with Disabilities Act’s (ADA) burden of providing “full and equal enjoyment of…any place of public accommodation.” According to the order, the defendants, who operate a restaurant and website, argued in part that the plaintiff could have called or emailed the restaurant to obtain information from the website. However, the judge ruled that “email and telephone options do not provide effective communication ‘in a timely manner’ nor do they protect the independence of the visually impaired” because they force a wait for a call back or reply email. As to whether the defendants’ website qualified as a “place of public accommodation within the meaning of the ADA,” the judge ruled that—while courts are split about whether “public accommodations” are limited to physical spaces—the defendants’ restaurant website fell within the category of a public accommodation under a “plain reading” of the statute, and the DOJ’s interpretation of websites under Title III of the ADA. In addition to awarding $4,000 in statutory damages, the court issued an injunction to the defendants, ordering them to comply with Web Content Accessibility Guidelines 2.0 AA to ensure their website is ADA compliant.
9th Circuit affirms credit reporting agency’s code data did not violate the FCRA
On May 29, the U.S. Court of Appeals for the 9th Circuit affirmed summary judgment for a national credit reporting agency, holding that the company did not violate the Fair Credit Reporting Act (FCRA) in its reporting of short sales executed by the plaintiffs. The decision results from a proposed class action suit alleging that the credit reporting agency violated the FCRA by reporting short sales executed between 2010 and 2011 with code numbers that misreported the data as foreclosures. In September 2016, the lower court found that the credit reporting agency provided creditors with clear instructions on how to interpret the code system and Fannie Mae’s Desktop Underwriter program misinterpreted the “settled” code number “9” as a foreclosure, which was not the credit reporting agency’s fault. In affirming the lower court’s decision, the 9th Circuit held that the credit reporting agency “clearly and accurately disclosed to [consumers] all information that [the company] recorded and retained that might be reflected in a consumer report.” Additionally, the panel noted that the credit reporting agency was not required to report that Fannie Mae mishandled the code data when it became aware of it.
Court orders Department of Education to cease collection efforts on student loans used for defunct for-profit school
On May 25, the U.S. District Court for the Northern District of California granted in part a preliminary injunction barring the U.S. Department of Education (Department) from continuing collection efforts on student loans used for programs at a now defunct for-profit college. The for-profit school closed in 2015 after a federal fraud investigation by the Department. The decision results from a December 2017 putative class action filed by former students of the school against the Department. The complaint alleged the Department violated the Administrative Procedures Act (APA) and the Privacy Act of 1974 by its December 2017 announcement that it would use an “average earnings” metric to determine what to charge students for the value of the education they received at the college. According to the former students, the previous policy—which measured the job placement rate of graduates—would have provided full loan forgiveness for the federal student loans used for the defunct school. In response to the students’ motion for a preliminary injunction, the court granted the students’ request to prevent the Department from using the “average earnings” metric, but denied the motion to require the Department to use the previous job placement metric. Additionally, among other things, the judge denied the students’ request to order the Department to remove all negative credit reporting but did order the Department to cease collection efforts on the loans.
Colorado Court of Appeals holds attorney fees award is a non-dischargeable civil penalty
On May 17, the Colorado Court of Appeals held that an attorney fees award imposed under the Colorado Consumer Protection Act (CCPA) is a civil penalty and is not dischargeable under the Bankruptcy Code. According to the opinion, the State of Colorado sued a law firm, its owners, and affiliated companies for allegedly violating the CCPA and the Colorado Federal Debt Collection Practices Act (CFDCPA) by fraudulently billing mortgage servicers for full costs associated with title insurance premium charges even though not all the costs were incurred. The district court agreed with the State and awarded attorney fees and costs for the violations. In the appeal, one of the defendants argued, among other things, that the district court was precluded from awarding attorney fees because his debts had previously been discharged in bankruptcy. In affirming the district court’s decision, the appeals court concluded that attorney fees awards made under the CCPA and the CFDCPA are not dischargeable because the award “made under the CCPA’s mandatory provision was sufficiently penal to constitute a ‘fine, penalty or forfeiture’ under § 523(a)(7) [of the Bankruptcy Code] and was not dischargeable.”
District court sanctions banker for violating consent order issued by CFPB and Maryland Attorney General
On May 21, the U.S. District Court for the District of Maryland granted in part and denied in part a motion for sanctions brought by the CFPB and the Consumer Protection Division of the Maryland Attorney General’s Office (plaintiffs) against a banker (defendant) previously held in civil contempt for violating a final judgment order prohibiting him from participating in the mortgage industry. As previously covered in InfoBytes, in April 2015, a joint enforcement action alleging participation in a mortgage-kickback scheme in violation of RESPA and state law was bought against the defendant, five other individuals, and a Maryland title company. According to the 2018 sanctions order, a stipulated final judgment and order between the parties was approved in November 2015, which, among other things, limited the defendant—who neither admitted nor denied the allegations—from participating in the mortgage industry for two years but did not prohibit him “from acting solely as a personnel or human-resources manager for a mortgage business operated by a FDIC insured banking institution. . . .”
However, in August 2017, the court held the defendant in civil contempt for failing to comply with the order when it was discovered that the defendant (i) owned and operated mortgage businesses in violation of the order, while claiming to be employed as a human resources professional at one of the businesses; (ii) operated bank branches in Maryland and California; (iii) failed to upload the final judgment and order into the Nationwide Mortgage Licensing System and Registry (NMLSR); and (iv) failed to comply with stipulated reporting requirements. The plaintiffs’ proposed sanctions sought to disgorge all of the defendant’s income from 2015 until the date of compliance and impose a lifetime ban from the industry. In issuing the sanctions, the court ordered that all contemptuous income since the final judgment should be disgorged and extended the original two-year ban another two years—minus the exemption for employment as an HR professional. The defendant is further required to post the sanctions order on the NMLSR within 60 days.