FTC Investigations Gain Speed: What You Need to Know About FTC IDs | Orrick, Herrington & Sutcliffe LLP | Media Pyro

In 2022, the Federal Trade Commission (FTC) continued to increase its investigations and enforcement efforts to uncover unfair or deceptive acts or practices in the areas of privacy, cybersecurity, and consumer protection. With FTC Chairwoman Lina M. Hahn leading the agency, all indications are that this trend will continue in 2023.

How the FTC uses CID

The FTC has many investigative tools in its arsenal, but the most common mandatory investigative tool is the civil investigative demand (CID). A CID is a type of administrative subpoena that allows the FTC to request documents, written reports, answers to interrogatories, and even oral testimony. Generally, the FTC first conducts an initial investigation of a company or industry to gather facts and data from available sources, voluntary investigative processes, and/or internal review by FTC staff. The FTC can then issue a CID to a company it believes has engaged in “unfair or deceptive” business practices in violation of Section 5 of the FTC Act. However, the FTC does not have an evidentiary threshold it must meet before issuing a CID, so the FTC may issue a CID only to help FTC investigators determine whether evidence of infringement exists. The FTC may also issue a company’s CID to obtain information about other companies or the industry it is investigating.

CID and not only

A CID is often the first formal step in an investigation into a company’s privacy, cybersecurity, or consumer protection practices. In addition to the initial CID, the FTC may ask additional questions about the company’s responses and issue additional CIDs to compel investigative hearings or produce additional records. If the FTC determines that the investigation did not reveal a violation of law or regulation sufficient to warrant enforcement action, the FTC may close the investigation without further action. If FTC staff determines that a violation has likely occurred, they may recommend the case for further administrative or judicial review and/or may offer the company an opportunity to resolve the issue through a negotiated settlement.

What to do if you receive a CID

1. Don’t panic, but don’t ignore the CID

Receiving a CID should not cause panic as long as the company does not allow the CID response to languish. A CID is only the first formal step in an investigation; it doesn’t mean the FTC has decided to file a complaint or impose civil penalties (yet).

However, CID should be taken seriously and should not be ignored. CID is a form of mandatory process. If a company does not comply with the CID, the FTC can go to court to enforce compliance with the CID. In short, a company must respond to CID, and that response must be thoughtful and strategic.

2. Read and understand the CID

Before doing anything else, it is important to read the CID carefully and understand the nature of the FTC’s request and the information sought. This can help the company prepare a response that is appropriately tailored to the FTC’s investigation. Important information in the CID will include:

The Nature and Scope of the FTC’s Investigation:

• Nature and scope of research – The CID will state (1) the nature of the conduct that the FTC is investigating and (2) the law or rule that the FTC believes may have been violated. For example, the CID may explain that the FTC is investigating whether the company engaged in “unfair or deceptive” practices in violation of Section 5 of the FTC Act, and if the FTC is investigating any other possible violations of the law or agency rules, such as the Children’s Privacy Protection Act in of the Internet (COPPA) or the Restoring Online Consumer Confidence Act (ROSCA).
• Applicable time period – CID will indicate the appropriate time period for the requested information. For example, CID may search for documents from “January 1, 2018 to present,” or CID may specify different time frames for different requests.
• Definition and language – The CID definition section also provides clarity on the FTC’s investigation, as certain terms may be defined for a specific commercial activity. Companies should also pay particular attention to the wording of each CID request—for example, some may be worded broadly to require the provision of “all” relevant documents, while others may only require the provision of documents “sufficient” to answer the question.

Deadlines:

• Return date (time may vary) – This is the date by which documents or written responses must be provided to the FTC. The return date is usually 30 days after service, but this time frame can often be extended by negotiating with the FTC during a “meet and discuss.”
• Meeting and meeting (14 days after providing services) – This is a period of time during which a company can meet and communicate with the FTC to discuss questions or concerns about CIDs, such as the burden or volume of CID requests or the response time to CIDs. This session can often be used to clarify or narrow the scope of requests or to agree on the current production schedule.
• Petition for restriction or cancellation (20 days after service) – The company has the option to file a petition to limit or cancel the CID within 20 days after the services are rendered. Through this process, a company can try to narrow down the CID or even remove it entirely. While this may seem like an attractive strategy, a company should think very carefully before filing a petition to limit or revoke, because the petition and the FTC’s decision on the petition become part of the FTC’s public record and publicize the fact and scope of the investigation. .

Analyzing the CID, understanding the nature of the business practices and allegations involved, and determining the overall response time frame at the outset are critical.

3. Keep the documents

Once a company receives a CID, it is required to retain all relevant documents that it owns, maintains or controls. This obligation applies to documents that may be in the possession of third parties or agents of the company and applies even if the documents may be protected from disclosure by privilege. The Company must promptly send retention notices to applicable employees, suppliers, and other agents who retain documents potentially related to the FTC’s investigation and inform them of their obligation to retain those documents and to cease any planned destruction practices. The company can use this as an opportunity to identify employees who can help with the response and relevant document repositories.

4. Conduct a privileged internal investigation

Companies should quickly hire counsel to conduct a privileged internal investigation into business practices that fall within the scope of the FTC’s investigation. Counsel can help a company identify possible defenses and liabilities at an early stage, and identify CID requests that may be particularly burdensome or require additional time to respond. In addition, engaging a lawyer to conduct an internal investigation helps protect the results of the investigation and related legal analysis from disclosure under attorney-client privilege and the protection of the work product doctrine.

It is critical to act quickly, as this initial internal investigation and strategic planning can lead to a more productive meeting with the FTC and set the tone for the company’s long-term CID response strategy.

5. Meet and talk with the FTC

Companies should take full advantage of the opportunity to meet and discuss the CID’s response with the FTC. A company may want to be candid with the FTC about challenges the company has faced as a result of the pandemic, such as layoffs or financial difficulties, that may affect the company’s ability to respond in a timely manner. Engaging with FTC staff attorneys early in the process helps demonstrate a company’s good faith efforts to comply and cooperate, and gives the company an opportunity to ask the FTC for additional information about the investigation and to agree with the FTC on the scope of the CID’s requests and the timeframe for the company’s response. The meeting and meeting can be used to prioritize certain responses and create a response schedule that will reduce additional stress on the company.

6. Respond, defend and resolve

Once the response schedule has been agreed upon with the FTC and the CID requests have been narrowed where necessary, it is time to respond to the substance of the CID. From painstakingly gathering and reviewing documents to painstakingly drafting responses, responding to a CID often requires a significant amount of time, energy and financial resources from a company, which can divert from other pressing business needs and strain employees. However, working with an experienced consultant can help optimize the response and production process and reduce disruptions to daily business operations.

In addition, working with an experienced consultant can help the company protect its interests. While the Company is required to respond to each inquiry with accuracy and candor, experienced counsel will recognize where it is appropriate and beneficial to present the Company’s responses within the broader context of the Company’s good faith practices, industry norms, and utmost reasonableness. The most effective submissions not only answer the FTC’s questions, but also acknowledge that there is room for advocacy. The ultimate goal is to convince the FTC to drop its investigation without seeking any remedy or relief.