REI PFAS Consumer Fraud Lawsuit Continues Trend of Similar Lawsuits

On October 28, 2022, a PFAS consumer fraud class action lawsuit was filed in Washington against REI over alleged PFAS content in various articles of waterproof clothing sold by the company. The REI PFAS consumer fraud lawsuit is but the latest in a growing line of PFAS lawsuits that allege that certain consumer goods contain PFAS, that the products or company’s values were marketed as healthy or environmentally friendly, and that consumers would not have purchased the products if they knew that the products contained PFAS.

As we predicted in early 2021, the increased attention on PFAS content in consumer goods in the scientific community and media presented significant risks to various industries, including the apparel and cosmetics industry, and our prediction was that the developments would lead to a significant number of lawsuits alleging consumer fraud. Consumer goods industries, insurers, and investment companies interested in the consumer goods vertical with niche interest in cosmetics companies must pay careful attention to the cosmetics lawsuits and the increasing trend of lawsuits targeting the industry.

REI PFAS Consumer Fraud Lawsuit

On October 28, 2022, plaintiffs Jacob Krakauer and Joyce Rockwood filed a lawsuit in Washington federal court seeking a proposed class action against REI. The lawsuit alleges that REI markets the company and its products as environmentally friendly and sustainable. Further, the lawsuit cites to statements made by REI that the company is taking proactive steps with respect to chemical use in its products to argue that such statements were false, misleading or induced consumers to purchase products when the presence of PFAS in the products was not disclosed.

In the Complaint, plaintiffs allege the following counts against REI:

  • Violation of state consumer protection laws and the federal Magnuson-Moss Warranty Act

  • Breach of warranty (implied and express)

  • Fraud (actual and constructive)

  • Fraudulent inducement

  • Money had and received

  • Fraudulent omission or concealment

  • Fraudulent misrepresentation

  • Negligent misrepresentation

  • Unjust enrichment

  • Negligent failure to warn

The plaintiffs seek certification of a nationwide class action lawsuit, with subclasses defined as consumers n Washington and Arizona. In addition, the lawsuit seeks damages, fees, costs, the establishment of medical monitoring, and a jury trial.

Just the Beginning For Consumer Products Companies

With studies underway, legislation pending that targets consumer goods, and increasing media reporting on PFAS in consumer goods and concerns over human health, product manufacturers should be increasingly wary of lawsuits similar to the REI lawsuit being filed against them. There are an increasing number of PFAS consumer fraud cases being filed, with some of the below as representative of recent trends:

  • Cosmetics industry:

    • Brown v. Cover Girl, New York (April 1, 2022)

    • Anderson v. Almay, New York (April 1, 2022)

    • Rebecca Vega v. L’Oreal, New Jersey (April 8, 2022)

    • Spindel v. Burt’s Bees, California (March 25, 2022)

    • Hicks and Vargas v. L’Oreal, New York (March 9, 2022)

    • Davenport v. L’Oreal, California (February 22, 2022)

  • Food packaging industry:

    • Richburg v. Conagra Brands, Illinois (May 6, 2022)

    • Ruiz v. Conagra Brands, Illinois (May 6, 2022)

    • Hamman v. Cava Group, California (April 27, 2022)

    • Azman Hussain v. Burger King, California (April 11, 2022)

    • Little v. NatureStar, California (April 8, 2022)

    • Larry Clark v. McDonald’s, Illinois (March 28, 2022)

  • Feminine hygiene products:

    • Gemma Rivera v. Knix Wear Inc., California (April 4, 2022)

    • Blenis v. Thinx, Inc., Massachusetts (June 18, 2021)

    • Destini Canan v. Thinx Inc., California (November 12, 2020)

As the above is indicative of, several major companies now find themselves embroiled in litigation focused on PFAS false advertising, consumer protection violations, and deceptive statements made in marketing and ESG reports. The lawsuits may well serve as test cases for plaintiffs’ bar to determine whether similar lawsuits will be successful in any (or all) of the fifty states in this country. Companies must consider the possibility of needing to defend lawsuits involving plaintiffs in all fifty states for products that contain PFAS.

It should be noted that these lawsuits would only touch on the marketing, advertising, ESG reporting, and consumer protection type of issues. Separate products lawsuits could follow that take direct aim at obtaining damages for personal injury for plaintiffs from consumer products. In addition, environmental pollution lawsuits could seek damage for diminution of property value, cleanup costs, and PFAS filtration systems if drinking water cleanup is required.

Conclusion

It is of the utmost importance that businesses along the whole supply chain in the consumer products industry evaluate their PFAS risk. Public health and environmental groups urge legislators to regulate PFAS at an ever-increasing pace. Similarly, state level EPA enforcement action is increasing at a several-fold rate every year. Now, the first wave of lawsuits take direct aim at the consumer products industry. Companies that did not manufacture PFAS, but merely utilized PFAS in their manufacturing processes, are therefore becoming targets of costly enforcement actions at rates that continue to multiply year over year. Lawsuits are also filed monthly by citizens or municipalities against companies that are increasingly not PFAS chemical manufacturers.

For more Environmental Law news, click here to visit the National Law Review.

©2022 CMBG3 Law, LLC. All rights reserved.

Pair of Lawsuits Target Mint Flavored Products

  • Spencer Sheehan, a well-known class-action attorney, has filed a pair of class-action lawsuits in the U.S. District Court for the Northern District of Illinois, alleging that mint flavored products which do not contain mint are deceptively labeled.
  • The first lawsuit alleged that a “mint chocolate chip ice cream” statement of identity is misleading to consumers where the product’s flavor is derived from “natural flavor” and not any mint or mint-containing ingredient. The product also contains images of mint leaves on the front panel. As support for the allegation that the lack of mint is deceptive, the complaint cites to the ice cream flavoring regulation (21 CFR 135.110(f)(2)), which requires that the term “flavored” (e.g., mint flavored) be used where a product contains a natural flavor which predominates.
  • The second lawsuit alleged that consumers are misled by a gum product which is labeled as “original flavor” with a backdrop of what appears to be a blue mint leaf, but which only contains “natural and artificial flavor,” and no mint-based ingredients. Plaintiff, citing to the general flavoring regulation (21 CFR 101.22), alleged that the product should have been labeled as “naturally and artificially flavored mint” and that the failure to disclose the flavor or include the other qualifiers is misleading.
  • Although Plaintiffs have alleged technical violations of FDA’s labeling regulations, courts have consistently held that a reasonable consumer may not be aware of the intricacies of FDA’s labeling regulations and that therefore a technical labeling violation is not in itself sufficient to show that a reasonable consumer would be misled.
© 2022 Keller and Heckman LLP

Chamber of Commerce Challenges CFPB Anti-Bias Focus Concerning AI

The end of last month the U.S. Chamber of Commerce, the American Bankers Association and other industry groups (collectively, “Plaintiffs”) filed suit in Texas federal court challenging the Consumer Financial Protection Bureau’s (“CFPB”) update this year to the Unfair, Deceptive, or Abusive Acts or Practices section of its examination manual to include discrimination.  Chamber of Commerce of the United States of America, et al v. Consumer Financial Protection Bureau, et al., Case No. 6:22-cv-00381 (E.D. Tex.)

By way of background, the Consumer Financial Protection Act, which is Title X of the 2010 Dodd-Frank Act (the “Act”), prohibits providers of consumer financial products or services or a service provider from engaging in any unfair, deceptive or abusive act or practice (“UDAAP”).  The Act also provides the CFPB with rulemaking and enforcement authority to “prevent unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service.”  See, e.g.https://files.consumerfinance.gov/f/documents/cfpb_unfair-deceptive-abusive-acts-practices-udaaps_procedures.pdf.  In general, the Act provides that an act or practice is unfair when it causes or is likely to cause substantial injury to consumers, which is not reasonably avoidable by consumers, and the injury is not outweighed by countervailing benefits to consumers or to competition.

The CFPB earlier this spring published revised examination guidelines on unfair, deceptive, or abusive acts and practices, or UDAAPs.  Importantly, this set forth a new position from the CFPB, that discrimination in the provision of consumer financial products and services can itself be a UDAAP.  This was a development that was surprising to many providers of financial products and services.  The CFPB also released an updated exam manual that outlined its position regarding how discriminatory conduct may qualify as a UDAAP in consumer finance.  Additionally, the CFPB in May 2022 additionally published a Consumer Financial Protection Circular to remind the public of creditors’ adverse action notice requirements under the Equal Credit Opportunity Act (“ECOA”).  In the view of the CFPB, creditors cannot use technologies (include algorithmic decision making) if it means they are unable to provide required explanations under the ECOA.

In July 2022, the Chamber and others called on the CFPB to rescind the update to the manual.  This included, among other arguments raised in a white paper supporting their position, that in conflating the concepts of “unfairness” and “discrimination,” the CFPB ignores the Act’s text, structure, and legislative history which discusses “unfairness” and “discrimination” as two separate concepts and defines “unfairness” without mentioning discrimination

The Complaint filed this fall raises three claims under the Administrative Procedure Act (“APA”) in relation to the updated manual as well as others.  The Complaint contends that ultimately it is consumers that will suffer as a result of the CFPB’s new position, as “[t]hese amendments to the manual harm Plaintiffs’ members by imposing heavy compliance costs that are ultimately passed down to consumers in the form of higher prices and reduced access to products.”

The litigation process started by Plaintiffs in this case will be time consuming (a response to the Complaint is not expected from Defendants until December).  In the meantime, entities in the financial sector should be cognizant of the CFPB’s new approach and ensure that their compliance practices appropriately mitigate risk, including in relation to algorithmic decision making and AI.  As always, we will keep you up to date with the latest news on this litigation.

For more Consumer Finance Legal News, click here to visit the National Law Review

© Copyright 2022 Squire Patton Boggs (US) LLP

First BIPA Trial Results in $228M Judgment for Plaintiffs

Businesses defending class actions under the Illinois Biometric Information Privacy Act (BIPA) have struggled to defeat claims in recent years, as courts have rejected a succession of defenses.

We have been following this issue and have previously reported on this trend, which continued last week in the first BIPA class action to go to trial. The Illinois federal jury found that BNSF Railway Co. violated BIPA, resulting in a $228 million award to a class of more than 45,000 truck drivers.

Named plaintiff Richard Rogers filed suit in Illinois state court in April 2019, and BNSF removed the case to the US District Court for the Northern District of Illinois. Plaintiff alleged on behalf of a putative class of BNSF truck drivers that BNSF required the drivers to provide biometric identifiers in the form of fingerprints and hand geometry to access BNSF’s facilities. The lawsuit alleged BNSF violated BIPA by (i) failing to inform class members their biometric identifiers or information were being collected or stored prior to collection, (ii) failing to inform class members of the specific purpose and length of term for which the biometric identifiers or information were being collected, and (iii) failing to obtain informed written consent from class members prior to collection.

In October 2019, the court rejected BNSF’s legal defenses that the class’s BIPA claims were preempted by three federal statutes governing interstate commerce and transportation: the Federal Railroad Safety Act, the Interstate Commerce Commission Termination Act, and the Federal Aviation Administration Authorization Act. The court held that BIPA’s regulation of how BNSF obtained biometric identifiers or information did not unreasonably interfere with federal regulation of rail transportation, motor carrier prices, routes, or services, or safety and security of railroads.

Throughout the case, including at trial, BNSF also argued it should not be held liable where the biometric data was collected by its third-party contractor, Remprex LLC, which BNSF hired to process drivers at the gates of BNSF’s facilities. In March 2022, the court denied BNSF’s motion for summary judgment, pointing to evidence that BNSF employees were also involved in registering drivers in the biometric systems and that BNSF gave direction to Remprex regarding the management and use of the systems. The court concluded (correctly, as it turned out) that a jury could find that BNSF, not just Remprex, had violated BIPA.

The case proceeded to trial in October 2022 before US District Judge Matthew Kennelly. At trial, BNSF continued to argue it should not be held responsible for Remprex’s collection of drivers’ fingerprints. Plaintiff’s counsel argued BNSF could not avoid liability by pleading ignorance and pointing to a third-party contractor that BNSF controlled. Following a five-day trial and roughly one hour of deliberations, the jury returned a verdict in favor of the class, finding that BNSF recklessly or intentionally violated BIPA 45,600 times. The jury did not calculate damages. Rather, because BIPA provides for $5,000 in liquidated damages for every willful or reckless violation (and $1,000 for every negligent violation), Judge Kennelly applied BIPA’s damages provision, which resulted in a judgment of $228 million in damages. The judgment does not include attorneys’ fees, which plaintiff is entitled to and will inevitably seek under BIPA.

While an appeal will almost certainly follow, the BNSF case serves as a stark reminder of the potential exposure companies face under BIPA. Businesses that collect biometric data must ensure they do so in compliance with BIPA and other biometric privacy regulations. Where BIPA claims have been asserted, companies should promptly seek outside counsel to develop a legal strategy for a successful resolution.

For more Privacy and Cybersecurity Legal News, click here to visit the National Law Review.

© 2022 ArentFox Schiff LLP

White House Office of Science and Technology Policy Releases “Blueprint for an AI Bill of Rights”

On October 4, 2022, the White House Office of Science and Technology Policy (“OSTP”) unveiled its Blueprint for an AI Bill of Rights, a non-binding set of guidelines for the design, development, and deployment of artificial intelligence (AI) systems.

The Blueprint comprises of five key principles:

  1. The first Principle is to protect individuals from unsafe or ineffective AI systems, and encourages consultation with diverse communities, stakeholders and experts in developing and deploying AI systems, as well as rigorous pre-deployment testing, risk identification and mitigation, and ongoing monitoring of AI systems.

  2. The second Principle seeks to establish safeguards against discriminative results stemming from the use of algorithmic decision-making, and encourages developers of AI systems to take proactive measures to protect individuals and communities from discrimination, including through equity assessments and algorithmic impact assessments in the design and deployment stages.

  3.  The third Principle advocates for building privacy protections into AI systems by default, and encourages AI systems to respect individuals’ decisions regarding the collection, use, access, transfer and deletion of personal information where possible (and where not possible, use default privacy by design safeguards).

  4. The fourth Principle emphasizes the importance of notice and transparency, and encourages developers of AI systems to provide a plain language description of how the system functions and the role of automation in the system, as well as when an algorithmic system is used to make a decision impacting an individual (including when the automated system is not the sole input determining the decision).

  5. The fifth Principle encourages the development of opt-out mechanisms that provide individuals with the option to access a human decisionmaker as an alternative to the use of an AI system.

In 2019, the European Commission published a similar set of automated systems governance principles, called the Ethics Guidelines for Trustworthy AI. The European Parliament currently is in the process of drafting the EU Artificial Intelligence Act, a legally enforceable adaptation of the Commission’s Ethics Guidelines. The current draft of the EU Artificial Intelligence Act requires developers of open-source AI systems to adhere to detailed guidelines on cybersecurity, accuracy, transparency, and data governance, and provides for a private right of action.

For more Technology Legal News, click here to visit the National Law Review.
Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

Former Uber Security Chief Found Guilty in Criminal Trial for Failure to Disclose Breach to FTC

On October 5, 2022, former Uber security chief Joe Sullivan was found guilty by a jury in U.S. federal court for his alleged failure to disclose a breach of Uber customer and driver data to the FTC in the midst of an ongoing FTC investigation into the company. Sullivan was charged with one count of obstructing an FTC investigation and one count of misprision, the act of concealing a felony from authorities.

The government alleged that in 2016, in the midst of an ongoing FTC investigation into Uber for a 2014 data breach, Sullivan learned of a new breach that affected the personal information of more than 57 million Uber customers and drivers. The hackers allegedly demanded a ransom of at least $100,000 from Uber. Instead of reporting the new breach to the FTC, Sullivan and his team allegedly paid the ransom and had the hackers sign a nondisclosure agreement. Sullivan also allegedly did not report the breach to Uber’s General Counsel.  Uber did not publicly disclose the incident or inform the FTC of the incident until 2017, when Uber’s new chief executive, Dara Khosrowshahi, joined the company.

This case is significant because it represents the first time a company executive has faced criminal prosecution related to the handling of a data breach.

For more Privacy Law news, click here to visit the National Law Review.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

USDA Focused on Accurate “Made in the USA” Beef Labeling

  • In response to industry concerns for mislabeled beef products, U.S. Agriculture Secretary Tom Vilack recently said that the “Product of the USA” label on meat products should undergo a full-scale review. Vilack maintains that he is “committed to ensuring that the ‘Product of USA’ label reflects what a plain understanding of those terms means to U.S. consumers.” In March, we reported that the Tenth Circuit dismissed lawsuits based on meat producer’s use of allegedly deceptive and misleading “Product of the USA”  labels on their beef products that did not originate from cattle born and raised in the United States.
  • The issue of country-of-origin beef labeling (“COOL”) continues to be a source of debate. Earlier this week, the FTC finalized a rule that is intended to tighten the use of the Made in the USA standard. The FTC said that this update would benefit small businesses who lack the resources to defend their products from foreign imitators. However, the FTC rule does not require USDA action. In response, the beef industry is demanding Congress to act swiftly.
  • R-CALF, a group of USA-based cattle ranchers, has been pushing hard for reforms on COOL. On September 22, R-CALF released a poll that shows staggering support for mandatory COOL legislation by the American public. R-CALF reports that 86 percent of American voters support the American Beef Labeling Act that reinstates mandatory country of origin labeling for beef, and 90 percent of voters are concerned that foreign importers of beef can legally put a “Product of USA” sticker on a package containing beef that was born, raised, and harvested outside the United States.
  • Currently, Congress is working through prospective beef labeling legislation that would require USDA oversight of COOL. The American Beef Labeling Act (S.2716) is a bipartisan bill that was introduced in the Senate in 2021; however, the bill has languished without action in the U.S. Senate Agriculture Committee. In March 2022, a bipartisan companion bill was introduced in the U.S. House (H.R.7291), which has also seen little to no progress in the House Agriculture Committee. Keller and Heckman will continue to monitor these legislative developments and USDA action.

For more Food and Drug Law news, click here to visit the National Law Review.

© 2022 Keller and Heckman LLP

Ongoing Foodborne Illness Outbreaks Increasing

  • On September 14, 2022, Food and Drug Administration (FDA) officials reported a new outbreak of infections from Listeria monocytogenes. FDA has not yet identified a particular product linked to the pathogenic bacterial outbreak but has initiated traceback procedures. To date, FDA has confirmed 6 patients from this week’s Listeria outbreak, and the numbers appear to keep rising. It is still unclear what age group or geographic location has been afflicted by the outbreak.
  • FDA is currently actively investigating ten foodborne illness outbreaks with increasing patient numbers every week. The Center for Disease Control (CDC) continues to actively investigate a sizable E. coli outbreak suspected to have been caused by romaine lettuce served at Wendy’s restaurants in Indiana, Michigan, Ohio, and Pennsylvania starting in early September 2022. To date, 43 individuals have been hospitalized due to E. coli poisoning, and 13 new patients have been accounted for this week alone. Other current FDA investigations include a Salmonella Typhimurium outbreak that now affects 30 individuals, a Cyclospora outbreak whose patient count is now 81, and a Salmonella Mississippi outbreak that now afflicts 103 patients nationwide.
  • Notably, in March 2022, FDA opened a similar investigation into a Listeria outbreak caused by ice cream products originating from Big Olaf Creamery in Sarasota, Florida. This investigation is still ongoing, but has resulted in 24 patient hospitalizations, 1 death, and 1 miscarriage across 11 states. Keller and Heckman will continue to monitor these outbreaks as they impact the food industry.

For more Food Law news, click here to visit the National Law Review.

© 2022 Keller and Heckman LLP

CFPB Plans to Increase Regulation over “Buy Now, Pay Later” Lenders

The Consumer Financial Protect Bureau (CFPB) issued a release on September 15, 2022, announcing its intent to issue additional interpretive guidance or rules to ensure “Buy Now, Pay Later” (BNPL) lenders comply with the same or similar regulations already established for credit cards following a study on the industry.

In its press release, the CFPB Director Rohit Chopra noted the rapidly growing use of “Buy Now, Pay Later is a rapidly growing type of loan that serves as a close substitute for credit cards.” While credit cards include interest charges, BNPL loans do not, making them more attractive to consumers. Instead, these loans allow consumers to purchase a product and repay the purchase price through several installment payments. As a result, BNPL loans have become prominent over the past several years, particularly during the COVID-19 pandemic. These previously niche loans, typically used for apparel and beauty purchases, are now used in almost all consumer-facing industries.

The CFPB noted several highlights of BNPL loans found through the study, which include:

  • Increased loan approval rates year over year;
  • Increased occurrences of late fee charges;
  • Increased product returns by consumers; and
  • Shrinking profit margins by BNPL lenders.

As a result of the study, the CFPB outlined the following concerns with the BNPL industry, mainly because the marketing of these loans leads consumers to believe the loans are a “zero-risk credit option.”

  • Limited Consumer Protections: While BNPL loans are used as an alternative to credit cards, they lack the standard credit disclosures, dispute resolution rights, etc., that similar consumer credit transactions often require.
  • Data Harvesting: Lower profit margins associated with BNPL loans have pushed the industry to monetize consumer data, potentially impacting consumer privacy.
  • Debt Accumulation: According to the CFPB, BNPL loans encourage consumers to purchase more products and borrow more, resulting in consumers becoming overleveraged. While the CFPB notes that the lenders in this space do not furnish credit data to credit reporting companies, the CFPB is concerned about this industry extending credit to consumers who may not be able to repay the debt.

Takeaways

The CFPB has yet again reinforced its commitment to regulate lenders that extend consumer credit. The CFPB’s decision to either enforce existing consumer laws (i.e., the Truth in Lending Act disclosures already required for credit cards and other consumer loans) or create new rules on the growing BNPL industry is not unexpected. However, the CFPB’s release shows a renewed focus on protecting consumers’ privacy rights and ensuring that consumers can afford to repay their credit lines before offers of credit are extended, and demonstrates once more that the Bureau will seek to regulate emerging forms of consumer credit.

© 2022 Bradley Arant Boult Cummings LLP

OCR Announces $300,000 Settlement Related to Improper Disposal of Physical PHI

On August 23, 2022, the U.S. Department of Health & Human Services, Office for Civil Rights (“HHS”) announced that it had settled a case involving the disposal of physical protected health information (“PHI”).

OCR alleged that, on March 31, 2021, a specimen containing PHI was found by a third-party security guard in the parking lot of the New England Dermatology and Laser Center (“NEDLC”). The PHI included patient name, patient date of birth, date of sample collection, and the name of the provider who took the specimen, in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

As part of the settlement, NEDLC agreed to pay HHS $300,640. According to NEDLC’s Resolution Agreement and the Corrective Action Plan, there were two potential violations by NEDLC. First, NEDLC allegedly failed to maintain appropriate safeguards to protect the privacy of PHI,” as required by 45 C.F.R. § 164.530(c). Second, NEDLC allegedly permitted the impermissible disclosure of PHI, in violation of Rule 45 C.F.R. § 164.502(a). The Corrective Action Plan requires NEDLC to develop, maintain and appropriately revise written policies and procedures in accordance with HIPAA.

Several highlights of the settlement include:

  1. Changes to Policies and Procedures. NEDLC must develop, maintain and revise, as necessary, its written HIPAA policies and procedures, and provide such policies and procedures to HHS for review and approval. NEDLC also must assess, update and revise, as necessary, such policies and procedures at least annually, or as needed, and seek HHS’s approval of the revised policies and procedures.
  2. Designation of Privacy Official. NEDLC must designate a privacy official who is responsible for the development and implementation of NEDLC’s HIPAA policies and procedures, and a contact person or office who is responsible for receiving relevant complaints.
  3. Training Requirements. NEDLC must provide HHS with training materials for its workforce members and seek HHS’s approval of such training materials. NEDLC must also distribute the HIPAA policies and procedures to its workforce members and relevant business associates, and obtain a written compliance certification from all such individuals. NEDLC must provide HIPAA training for new workforce members, and all workforce members at least every 12 months. Each workforce member must certify, in electronic or written form, that they received training. NEDLC must review the training at least annually, and update the training where appropriate. NEDLC must promptly investigate, review, report to HHS, and sanction any workforce member that does not comply with its HIPAA policies and procedures.
  4. Implementation Report and Annual Report.  NEDLC is required to submit to HHS a written report summarizing the status of its implementation of the requirements provided set forth in the settlement, and annual compliance reports.

For more Health Care legal news, click here to visit the National Law Review.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.