In re LabMD
, Briefing Book Page 2
Te FC Violates Due Process Fair-Notice Requirements when it Punishes Companies without Defining “Unreasonable” and “Unfair” Data-Security Practices.
Even though Section 5 never mentions data security, the FC claims the statute’s text alone provides air notice. FC reuses to establish rules or regulations explaining what data-security practices it thinks Section 5 orbids or requires and reuses to issue advisory opinions or endorse industry standards. Instead, the FC apparently thinks it can regulate through afer-the-act enorcement actions, “uncodified standards o care,” and “unwritten rules.” Even during an enorcement proceeding, the FC claims “standards used to enorce Section 5 are outside the scope o discovery.”
Te FC’s Administrative Process—Where FC Commissioners Act as Prosecutors, Legislators, and Judges at the Same ime—Is Rigged and Violates Due Process.
FC Commissioner Joshua Wright’s empirical research demonstrates that LabMD’s ate is already sealed. FC enorcement staff have won literally 100% o FC administrative cases or a period o nearly twenty years. Commissioner Wright told Congress that, in light o “the agency’s admin-istrative process advantages and the vague nature o the Section 5 authority[,] . . . firms typically preer to settle Section 5 claims rather than go through the lengthy and costly administrative litigation in which they are both shooting at a moving target and may have the chips stacked against them.”
Te FC Relied Upon “False,” “Incomplete,” and “Inaccurate” Information to Launch Its Investigation into LabMD. Congress is Now Prodding Both the FC and iversa, the Source of that Information
On June 11, 2014 Congress’s chie watchdog, the House Committee on Oversight and Government Reorm, advised the Federal rade Commission (FC) that the inormation the FC obtained rom iversa, Inc. is “alse,” “incomplete” and “inaccurate.” Te Committee also said that it expected the FC to “cooperate ully” with any subsequent document requests or tran-scribed interviews with FC employees.Te FC obtained confidential LabMD patient inormation rom iversa in 2009 by way o a sham corporation located in the home o iversa’s CEO’s uncle. Although iversa had a strong commercial interest in the FC’s commencement o enorcement proceedings, there is no evidence that the FC took any steps to authenticate iversa’s claim that LabMD patient files had been ound in multiple places on a peer-to-peer network. As the FC and iversa were both aware, the unauthorized taking o patient files rom a Georgia workstation, by peer-to-peer sofware or by any other means, is a crime under Georgia law. o date, the FC has reused to make public the
“
Tis has grown from a classic David-vs-Goliath battle into a dispute that could shape the future of federal health privacy regulation.
”
—
LabMD CEO Michael Daugherty