Consumer Protection Archives - The National Law Forum

EVERYTHING’S FINE: Big TCPA Win For Medical Debt Collector Suggests FCC Rulings Still Binding After Loper Bright–Let’s Hope it Stays That Way

Fascinating little case for you all today.

Consumer visits hospital for treatment. Provides phone number at admission. Receives treatment and is discharged.

Consumer fails to pay resulting invoices. Hospital and provider network turn account over to collections. Debt collector allegedly uses an ATDS to call consumer on the number she provided.

What result?

Prior to the Supreme Court’s Loper Bright decision the determination would be easy. The FCC held back in 2009 that providing a number in connection with a transaction permits autodialed calls to a consumer in connection with that transaction. And the Sixth Circuit Court of Appeals has directly held that providing a phone number on hospital intake documents permits later debt collection activity at that number–including via autodialer.

But the Loper Bright decision recently destroyed Chevron deference–meaning courts no longer have to yield to agency determinations of this sort. And while the Hobbs Act affords extra protections to certain FCC rulings, those protections only apply where certain procedural requirements were met by the Commission in adopting the rule.

So does the FCC’s rule from 2009 permitting informational calls to numbers provided in connection with a transaction still bind courts? According to the decision in Woodman v. Medicredit, 2024 WL 4132732 (D. Nv Sept. 9, 2024) the answer is yes!

In Woodman the defendant debt collector moved for summary judgment arguing the Plaintiff consented when she provided her number to the hospital. The Court had little problem applying the FCC’s 2009 order and precedent that came before Loper Bright to grant summary judgment to he defense. So just like that case is gone.

Great ruling for the defense, of course, and it makes me feel a bit better about the whole “no one knows what the law is anymore” thing, but the Woodman court didn’t really address the core issue– was the 2009 ruling enacted with sufficient APA pop and circumstance to merit Hobbs Act deference under PDR Resources.

Really interesting question and one folks should keep in mind.

FTC Announces Final Rule Imposing Civil Penalties for Fake Consumer Reviews and Testimonials

On August 14, 2024, the Federal Trade Commission announced a Final Rule combatting bogus consumer reviews and testimonials by prohibiting their sale or purchase. The Rule allows the FTC to strengthen enforcement, seek civil penalties against violators and deter AI-generated fake reviews.

“Fake reviews not only waste people’s time and money, but also pollute the marketplace and divert business away from honest competitors,” said FTC attorney Chair Lina M. Khan. “By strengthening the FTC’s toolkit to fight deceptive advertising, the final rule will protect Americans from getting cheated, put businesses that unlawfully game the system on notice, and promote markets that are fair, honest, and competitive.”

The Rule announced on August 14, 2024 follows an advance notice of proposed rulemaking and a notice of proposed rulemaking announced in November 2022 and June 2023, respectively. The FTC also held an informal hearing on the proposed rule in February 2024. In response to public comments, the Commission made numerous clarifications and adjustments to its previous proposal.

What Does the FTC Final on the Use of Consumer Reviews and Testimonials Prohibit?

The FTC Final Rule on the Use of Consumer Reviews and Testimonials prohibits:

Writing, selling, or buying fake or false consumer reviews.

The Rule prohibits businesses from writing or selling consumer reviews that misrepresent they are by someone who does not exist or who did not have actual experience with the business or its products or services, or that misrepresent the reviewers’ experience. It also prohibits businesses from buying consumer reviews that they knew or should have known made such a misrepresentation. Businesses are also prohibited from procuring from certain company insiders such reviews about the business or its products or services for posting on third-party sites, when the businesses knew or should have known about the misrepresentation. The prohibitions on buying or procuring reviews do not cover generalized review solicitations to past customers or simply hosting reviews on the business’s website. Neither will a retailer or other entity be liable for sharing consumer reviews unless it would have been liable for displaying those same reviews on its own website.

Writing, selling, or disseminating fake or false testimonials.

Businesses are similarly prohibited from writing or selling consumer or celebrity testimonials that make the same kinds of misrepresentations. The are also prohibited from disseminating or causing the dissemination of such testimonials when they knew or should have known about the misrepresentation. The prohibition on disseminating testimonials does not cover the type of generalized solicitations to past customers discussed above with respect to reviews.

Buying positive or negative reviews.

Businesses are prohibited from providing compensation or other incentives contingent on the writing of consumer reviews expressing a particular sentiment, either positive or negative. Violations here include situations in which such a contingency is express or implied. So, for example, while it prohibits offering $25 for a 5-star review, it also prohibits offering $25 for a review “telling everyone how much you love our product.”

Failing to make disclosures about insider reviews and testimonials.

The Rule prohibits a company’s officers and managers from writing reviews or testimonials about the business or its products or services without clearly disclosing their relationship. Businesses are also prohibited from disseminating testimonials by company insiders without clear disclosures, if the businesses knew or should have known of the relationship. A similar prohibition exists for officer or manager solicitations of reviews from their immediate relatives or from employees or agents of the business, and when officers or managers ask employees or agents to seek such reviews from relatives. For these various solicitations, the Rule is violated only if: (i) the officers or managers did not give instructions about making clear disclosures; (ii) the resulting reviews – either by the employees, agents, or the immediate relatives of the officers, managers, employees, or agents – appear without clear disclosures; and (iii) the officers or managers knew or should have known that such reviews appeared and failed to take steps to have those reviews either removed or amended to include clear disclosures. All of these prohibitions hinge on the undisclosed relationship being material to consumers. These disclosure provisions also clarify that they do not cover mere review hosting or generalized solicitations to past customers.

Deceptively claiming that company-controlled review websites are independent.

Businesses are prohibited from misrepresenting that websites or entities they control or operate are providing independent reviews or opinions, other than consumer reviews, about a category of businesses, products, or services that includes their own business, product, or service.

Illegally suppressing negative reviews.

The Rule prohibits using unfounded or groundless legal threats, physical threats, intimidation or public false accusations (when the accusation is made with knowledge that it is false or with reckless disregard as to its truth or falsity) to prevent the posting or cause the removal of all or part of a consumer review. Legal threats are “unfounded or groundless” if they are unwarranted by existing law or based on allegations that have no evidentiary support, according to the FTC. Also, if reviews on a marketer’s website have been suppressed based on their rating or negative sentiment, the Rule prohibits that business from misrepresenting that the reviews on a portion of its website dedicated to receiving and displaying such reviews represent most or all submitted reviews.

Selling and buying fake social media indicators.

The Rule prohibits the sale or distribution of fake indicators of social media influence, like fake followers or views. A “fake” indicator means one generated by a bot, a hijacked account, or that otherwise does not reflect a real individual’s or entity’s activities or opinions, according to the FTC. The Rule also bars anyone from buying or procuring such fake indicators. These prohibitions are limited to situations in which the violator knew or should have known that the indicators were fake and which involved misrepresentations of a person’s or company’s influence or importance for a commercial purpose.

The Rule does not specifically refer to AI. However, according to the FTC, these prohibitions cover situations when someone uses an AI tool to generate the deceptive content at issue.

According to the FTC, case-by-case enforcement without civil penalty authority might not be enough to deter clearly deceptive review and testimonial practices. The Supreme Court’s decision in AMG Capital Management LLC v. FTC has hindered the FTC’s ability to seek monetary relief for consumers under the FTC Act. The Rule is intended to enhance deterrence and strengthen FTC enforcement actions.

The Rule will become effective 60 days after the date it’s published in the Federal Register.

Takeaway: The FTC will aggressively enforce the new Rule. The agency has challenged illegal practices regarding bogus reviews and testimonials for quite some time. In addition to investigations and enforcement actions, the FTC has also issued guidance to help businesses to comply. According to the agency, online marketplaces and social media companies could and should do more when it comes to policing their platforms.

Recent Federal Developments, July 2024

TSCA/FIFRA/TRI

EPA’s Proposed NMP Risk Management Rule Includes Requirements To Protect Workers And Consumers: On June 15, 2024, the U.S. Environmental Protection Agency (EPA) issued a proposed rule under Section 6(a) of the Toxic Substances Control Act (TSCA) that would protect workers and consumers from exposure to N-methylpyrrolidone (NMP). 89 Fed. Reg. 51134. To address the identified unreasonable risk, EPA proposes to: prohibit the manufacture (including import), processing, distribution in commerce, and use of NMP in several occupational conditions of use (COU); require worker protections through an NMP workplace chemical protection program (WCPP) or prescriptive controls (including concentration limits) for most of the occupational COUs; require concentration limits on a consumer product; regulate certain consumer products to prevent commercial use; and establish recordkeeping, labeling, and downstream notification requirements. Comments are due July 29, 2024. Under the Paperwork Reduction Act (PRA), comments on the information collection provisions are best assured of consideration if the Office of Management and Budget (OMB) receives a copy of the comments on or before July 15, 2024. According to EPA’s June 5, 2024, press release, NMP is used to manufacture and produce many electronics, polymers, agricultural chemicals, and petrochemical products. EPA states that NMP is used in the production of specialized electronics, such as semiconductors and magnet wire, as well as lithium-ion batteries used in a wide variety of applications, including aerospace vehicles and electronic devices. EPA notes that NMP “also has numerous other industrial, commercial and consumer applications, including adhesives and sealants, paints and coatings, paint removers, lubricants, automotive care products, degreasers, cleaning and furniture care products.” For more information, please read the full memorandum.

EPA Announces Final Cancellation Order And Updates To Existing Stocks Provisions For Several Chlorpyrifos Products: On June 25, 2024, EPA announced the issuance of a final cancellation order for Corteva’s chlorpyrifos product “Dursban 50W in Water Soluble Packets” and three Gharda chlorpyrifos products, and an amendment to the existing stocks provisions for two Liberty and three Winfield chlorpyrifos end-use products. EPA also states that it has updated its frequently asked questions about chlorpyrifos. More information is available in our July 2, 2024, blog.

EPA Announces New Initiatives To Improve Efficiency, Worker Protections, And Transparency In New Chemical Reviews: During the June 26, 2024, “TSCA Reform — Eight Years Later” conference, presented by Bergeson & Campbell, P.C. (B&C^®), the Environmental Law Institute (ELI), and the George Washington University Milken Institute School of Public Health, Michal Ilana Freedhoff, Ph.D., Assistant Administrator, Office of Chemical Safety and Pollution Prevention, EPA, provided the keynote address. During her remarks, Freedhoff announced four new initiatives in EPA’s review of new chemicals under TSCA. As later announced by EPA, these initiatives are:

Engineering checklist: In May 2024, EPA began implementing an internal engineering checklist to review systematically new chemical submissions and identify potential data gaps at the beginning of the review process.
Worker protections: According to EPA, most TSCA Section 5(e) orders are consent orders negotiated between EPA and the notice submitter that use standard “boilerplate” text. In June 2024, EPA updated the boilerplate language to strengthen worker protections and provide further clarity to the text.
Updated statistics for new chemical review timelines: On June 26, 2024, EPA began including completed “rework” risk assessments when reporting monthly statistics on new chemical reviews. EPA has updated its Statistics for the New Chemicals Program under TSCA web page to include a category listing all completed rework risk assessments since the beginning of 2024.
Reference Library: On June 26, 2024, EPA launched the New Chemicals Division Reference Library, an index of EPA documents related to the work of the New Chemicals Division. It currently contains over 90 entries, and EPA will update it as it develops new materials.

More information is available in our June 26, 2024, blog item. A summary of the conference is available in our July 9, 2024, memorandum.

EPA Postpones Proposed Expansion Of The Safer Choice And DfE Programs: As reported in our July 27, 2023, memorandum, in July 2023, EPA proposed an expansion of the Safer Choice and Design for the Environment (DfE) programs to include certification of additional product categories. According to EPA’s website, “EPA thanks the many commenters for their input. EPA reviewed the comments and understands several categories are of interest to stakeholders and Safer Choice partners. With the 2024 decrease in EPA’s funding, however, EPA is not able to pursue expansion at this time. EPA plans to reconsider the expansion in the future as resources allow.” On June 28, 2024, a summary of comments received on EPA’s proposed expansion was posted in the online docket. More information is available in our July 5, 2024, blog item.

EPA Releases Draft Risk Evaluation For 1,1-Dichloroethane And Draft Hazard Assessment Of 1,2-Dichloroethane For Public Comment And Peer Review: On July 1, 2024, EPA announced the release of the draft risk evaluation for 1,1-dichloroethane and the draft human health hazard assessment supporting the draft risk evaluation for 1,2-dichloroethane (also known as ethylene dichloride) prepared under TSCA. EPA states that it “preliminarily determined 1,1-dichloroethane poses unreasonable risk to human health (of workers) and the environment.” According to EPA, the effects to people from exposure to 1,1-dichloroethane and 1,2-dichlorethane are “kidney and other cancers, as well as harmful non-cancer renal, nasal, immune system, and reproductive effects.” Publication of a notice of availability in the Federal Register will begin a 60-day comment period. More information will be available in a forthcoming memorandum.

Court Vacates TSCA Section 4 Test Order, Grant’s Vinyl Institute’s Petition For Review: On July 5, 2024, the U.S. Court of Appeals for the District of Columbia Circuit issued its decision in Vinyl Institute, Inc. v. EPA (No. 22-1089). As reported in our May 31, 2022, blog item, on May 23, 2022, the Vinyl Institute, Inc. (VI) filed suit against EPA, seeking review of EPA’s March 2022 test order for 1,1,2-trichloroethane issued under TSCA Section 4(a)(2). The court states that “EPA’s non-public part of the administrative record is not part of ‘the record taken as a whole’ subject to our heightened substantial evidence review of TSCA test orders.” According to the court, to the extent EPA relies on non-public portions of the administrative record, it “has failed to provide substantial evidence that meets its statutory mandate.” The court vacated the test order, remanding to EPA to satisfy that mandate with “substantial evidence in the record taken as a whole.” The court also denied VI’s motion to supplement the record “with scientific information it could have — and should have — submitted earlier.” More information is available in our July 10, 2024, blog item.

EPA Publishes Compliance Guide For Final Methylene Chloride Risk Management Rule: On July 10, 2024, EPA published a compliance guide for its final methylene chloride risk management rule issued under TSCA. According to EPA, the compliance guide will help industry, workers, and other interested stakeholders understand and comply with the new regulations to prevent injuries, long-term illnesses, and deaths. EPA also announced that in June 2024, it released a fact sheet on the rule containing information on who is subject to the rule along with a summary of compliance timelines. More information will be available in a forthcoming memorandum.

EPA Grants TSCA Section 21 Petition Seeking Section 6 Rule Prohibiting Three PFAS Found In Fluorinated Plastic Containers: EPA announced on July 11, 2024, that it granted a petition filed a petition under TSCA Section 21 requesting that EPA establish regulations under TSCA Section 6 prohibiting the manufacturing, processing, use, distribution in commerce, and disposal of three per- and polyfluoroalkyl substances (PFAS) formed during the fluorination of plastic containers. EPA “will promptly commence an appropriate proceeding under TSCA Section 6.” According to EPA’s announcement, EPA intends to request information, including the number, location, and uses of fluorinated containers in the United States; alternatives to the fluorination process that generates perfluorooctanoic acid (PFOA), perfluorononanoic acid (PFNA), and perfluorodecanoic acid (PFDA); and measures to address risk from PFOA, PFNA, and PFDA formed during the fluorination of plastic containers. More information will be available in a forthcoming memorandum.

EPA’s Spring 2024 Unified Agenda Includes Proposed And Final TSCA, TRI, And PFAS Rules: EPA’s Spring 2024 Unified Agenda, published on July 5, 2024, includes a number of proposed and final TSCA, Toxics Release Inventory (TRI), and PFAS rulemakings. More information on the rulemakings, including links to our memoranda, will be available in an upcoming blog item.

RCRA/CERCLA/CWA/CAA/PHMSA/SDWA

EPA Publishes 2024-2027 Climate Adaptation Plan: EPA announced on June 20, 2024, the release of its 2024-2027 Climate Adaptation Plan, which describes Agency actions to address the impacts of climate change and help build a more climate-resilient nation. Highlights include:

Fostering a climate-ready workforce;
Building facility resilience;
Developing climate-resilient supply chains;
Integrating climate resilience into external funding opportunities;
Applying climate data and tools to decision making; and
Integrating climate adaptation into rulemaking processes.

EPA Amends Standards And Practices For All Appropriate Inquiries: EPA issued a final rule on June 24, 2024, amending the “Standards and Practices for All Appropriate Inquiries” to reference a standard practice recently made available by ASTM International, “a widely recognized standards development organization.” 89 Fed. Reg. 52386. EPA states that it is amending the All Appropriate Inquiries Rule to reference ASTM International’s E2247-23 “Standard Practice for Environmental Site Assessments: Phase I Environmental Site Assessment Process for Forestland or Rural Property” and allow for its use to satisfy the requirements for conducting all appropriate inquiries under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). In addition, after one year, EPA will remove recognition of the previous version of that standard, ASTM E2247-16, as compliant with the All Appropriate Inquiries Rule. The final rule will be effective August 23, 2024.

EPA Proposes To Remove Affirmative Defense Provisions From Specified NSPS And NESHAP: On June 24, 2024, EPA proposed amendments to several New Source Performance Standards (NSPS) and National Emission Standards for Hazardous Air Pollutants (NESHAP) under the Clean Air Act (CAA). 89 Fed. Reg. 52425. Specifically, EPA proposes to remove the affirmative defense provisions associated with violation of emission standards due to malfunctions. According to EPA, it proposes to remove these provisions because they are inconsistent with a D.C. Circuit Court decision that vacated affirmative defense provisions in one of EPA’s CAA regulations, and because EPA finds that the reasoning in the decision applies equally to other CAA rules. Since the court decision, EPA has been removing affirmative defense provisions from CAA rules when they were otherwise revised or amended. EPA states that this action “proposes to remove the remaining affirmative defense provisions more efficiently.” Comments are due August 8, 2024.

PHMSA Amends HMR To Require Real-Time Train Consistent Information In Electronic Form: The Pipeline and Hazardous Materials Safety Administration (PHMSA) published a final rule on June 24, 2024, amending the Hazardous Materials Regulations (HMR) to require railroads that carry hazardous materials to generate in electronic form, maintain, and provide to first responders, emergency response officials, and law enforcement personnel certain information regarding hazardous materials in rail transportation to enhance emergency response and investigative efforts. 89 Fed. Reg. 52956. According to PHMSA, the amendments address a safety recommendation of the National Transportation Safety Board and statutory mandates in The Fixing America’s Surface Transportation Act, as amended by the Infrastructure, Investment, and Jobs Act, and complement existing regulatory requirements pertaining to the generation, maintenance, and provision of similar information in hard copy form, as well as other hazard communication requirements. The effective date of the final rule is July 24, 2024. The voluntary compliance date was June 24, 2024. The delayed compliance date for Class I Railroads is June 24, 2025, and for Class II and III Railroads is June 24, 2026.

EPA Proposes To Extend Compliance Date For Installation Of Certain Variable Refrigerant Flow Systems: On June 26, 2024, EPA proposed to amend a provision of the Technology Transitions regulations promulgated under the American Innovation and Manufacturing Act. 89 Fed. Reg. 53373. The proposed amendment would allow one additional year, until January 1, 2027, solely for the installation of new residential and light commercial air conditioning and heat pump variable refrigerant flow systems that are 65,000 British thermal units per hour or greater using components manufactured in the United States or imported prior to January 1, 2026. According to EPA, the existing January 1, 2026, compliance date for the installation of certain variable refrigerant flow systems “may result in significant stranded inventory that was intended for new construction. EPA is promulgating this action to mitigate the potential for significant stranded inventory in this subsector.” Comments are due July 26, 2024.

PHMSA Requests Feedback On De Minimis Quantities Of Explosives: PHMSA published a request for information (RFI) on June 28, 2024, to solicit information from hazardous materials (HAZMAT) shippers pertaining to what small quantities or low concentrations of explosives they offer for transport appear to present a low risk to life, property, and the environment. 89 Fed. Reg. 54157. PHMSA seeks to determine what small quantities or low concentrations of explosives HAZMAT shippers offer for transport that appear to present a low risk (e.g., negligible severity, remote probability) to life, property, and the environment. PHMSA will use the information to define the focus of a research project investigating the risk of small and/or de minimis quantities of explosive substances and in selecting test samples for PHMSA research and development Contract# 693JK322C00003. Comments are due September 26, 2024. PHMSA states that it will consider comments received after that date to the extent possible.

EPA Determines Current NESHAP For PQBS Source Category Provides “Ample Margin Of Safety”: On July 5, 2024, EPA published a final rule regarding the residual risk and technology review conducted for the NESHAP for the Coke Ovens: Pushing, Quenching, and Battery Stacks (PQBS) source category and the periodic technology review for the Coke Oven Batteries (COB) source category NESHAP. 89 Fed. Reg. 55684. EPA states that it is issuing a final determination that risks due to emissions of hazardous air pollutants (HAP) from the PQBS source category are acceptable and that “the current NESHAP provides an ample margin of safety to protect public health.” The final rule was effective July 5, 2024, except for amendatory instruction 3, which was effective July 15, 2024. The incorporation by reference (IBR) of certain publications listed in the rule is approved by the Director of the Federal Register beginning July 5, 2024. The IBR of certain other material listed in the rule was approved by the Director of the Federal Register as of July 13, 2005.

EPA Releases Science-Based Recommendations To Help Reduce Exposure To Contaminants, Including PFAS, In Fish: EPA announced on July 11, 2024, that it issued updated recommendations under the Clean Water Act (CWA) for contaminants that states, Tribes, and territories should consider monitoring in locally caught, freshwater fish. According to EPA, for the first time, it has added several PFAS to the contaminant list alongside lead, three cyanotoxins, a flame retardant, and amphetamine. With this announcement, EPA suggests that states, Tribes, and territories monitor for these contaminants. EPA notes that this update comes after reviewing scientific literature, analyzing data, and seeking external peer review of the Agency’s analysis, and it will help ensure that state and Tribal fish advisories consider the latest science.

FDA

FDA Updates Resources For FSMA Rule: On June 27, 2024, the U.S. Food and Drug Administration (FDA) released additional resources to help industry comply with the Food Traceability Rule, a component of the Food Safety Modernization Act (FSMA). Resources include a template spreadsheet to help fulfill data submission requests and minor revisions to the Food Traceability List. Additional information is available at the link here.

FDA Releases Update For Priority Guidance Topic List: On June 28, 2024, FDA provided an update for its priority guidance topic list, which was released in January. Since January, FDA has issued the following guidance documents:

FDA notes that its “intent is to publish all draft and final guidance topics on the list” but that “modifications in plans may be needed to support emerging issues and Administration priorities.”

FDA Revokes Authorization For Brominated Vegetable Oil: On July 3, 2024, FDA amended its regulations to revoke the authorization for the use of brominated vegetable oil (BVO) in food. 89 Fed. Reg. 55040. The final rule revokes the authorization for the use of BVO as a food ingredient intended to stabilize flavoring oils in fruit-flavored beverages. FDA notes that there are no other FDA authorized uses. The rule is effective on August 2, 2024.

NANOTECHNOLOGY

ECHA Evaluating Function Of EUON; Survey Closed July 3, 2024: The European Chemicals Agency (ECHA) is evaluating the function of the European Union (EU) Observatory for Nanomaterials (EUON). As part of its evaluation, ECHA conducted a survey to collect responses from EUON website visitors and stakeholders. The survey closed July 3, 2024. More information is available in our June 24, 2024, blog item.

ECHA Updates Report On Key Areas Of Regulatory Challenge, Addresses Micro- And Nano-Sized Materials: On June 12, 2024, ECHA announced that it updated its report on key areas of regulatory challenge, providing more detailed information on areas where scientific research is needed to protect human health and the environment from hazardous chemicals. The report addresses micro- and nano-size materials. More information is available in our June 17, 2024, blog item.

NIOSH Highlights NTRC’s Work On Engineering Controls And PPE: On July 1, 2024, the National Institute for Occupational Safety and Health (NIOSH) posted a NIOSH Science Blog item entitled “Celebrating 20 Years of the Nanotechnology Research Center: Highlights from Engineering Controls and Personal Protective Equipment,” part of a series commemorating the 20th anniversary of the Nanotechnology Research Center (NTRC). NIOSH researchers plan to develop a new reliable aerosol testing method that can accurately evaluate the respirator penetration against workplace nanomaterials; evaluate the effectiveness of NIOSH-approved^® respirators to determine whether existing respirator guidelines apply to workers exposed to nanomaterials; and compare nanomaterial penetrations determined by direct-reading and elemental carbon analysis methods. More information is available in our July 5, 2024, blog item.

NNI And NNCO Will Hold July 24 Workshop On “Responsible Development, Social Science, And The National Nanotechnology Initiative”: The National Nanotechnology Initiative (NNI) and the National Nanotechnology Coordination Office (NNCO) are convening a July 24, 2024, workshop, “Responsible Development, Social Science, and the National Nanotechnology Initiative: A Workshop to Explore Past and Future Intersections.” The agenda includes a presentation about the recently released “Blueprint for the Use of Social and Behavioral Science to Advance Evidence-Based Policymaking,” introductions to key nanotechnology case studies by federal experts, and flash talks by social scientists. More information is available in our July 3, 2024, blog item.

BIOBASED/RENEWABLE PRODUCTS/SUSTAINABILITY

B&C^® Biobased And Sustainable Chemicals Blog: For access to a summary of key legislative, regulatory, and business developments in biobased chemicals, biofuels, and industrial biotechnology, go to https://www.lawbc.com/brand/bioblog/.

LEGISLATIVE

House Appropriations Committee Approves FY 2025 Interior, Environment, And Related Agencies Appropriations Act: The House Appropriations Committee announced on July 9, 2024, that it approved the Fiscal Year (FY) 2025 Interior, Environment, and Related Agencies Appropriations Act by a vote of 29 to 25. According to the press release, the bill:

Ensures chemical and pesticide manufacturers are not overburdened with requirements that would drive business overseas and threaten American competitiveness;
Blocks EPA’s car regulations on light, medium, and heavy-duty vehicles;
Prohibits EPA from allowing California to require that new small off-road engines, such as lawn care equipment, be zero-emission;
Prohibits funds for EPA’s Clean Power Plan 2.0 and regulatory overreach regarding ozone emissions and steam electric power plants;
Reduces funding for EPA by 20 percent;
Reduces funding for the Council on Environmental Quality to the authorized level of $1 million;
Rejects eight of the Administration’s climate change executive orders; and
Prohibits agencies from using the Social Cost of Carbon (SCC) in cost-benefit analyses and blocks the Interagency Working Group on Social Cost of Greenhouse Gases.

House Committee Holds EPA Oversight Hearing On July 10, 2024: The House Committee on Oversight and Accountability held a full committee hearing on July 10, 2024, on “Oversight of the U.S. Environmental Protection Agency.” The Committee’s July 3, 2024, press release quotes Committee Chair James Comer (R-KY) as stating: “We know the Biden Administration is overreaching its environmental protection authorities extensively, flouting the limits the Supreme Court set upon them two years ago in West Virginia v. EPA and adopting statutory interpretations that surely will not pass muster under the Court’s recent decision in Loper Bright Enterprises v. Raimondo. The Committee looks forward to holding the agency accountable next week for its efforts to cement Green New Deal and other misguided priorities that have hurt both American businesses and consumers across the country.” More information will be available in a forthcoming memorandum.

MISCELLANEOUS

California Court Grants Injunction To Stop Prop 65 Warnings For Titanium Dioxide In Cosmetic And Personal Care Products: On June 12, 2024, the U.S. District Court for the Eastern District of California (District Court) issued an Order granting a preliminary injunction brought by the Personal Care Products Council (PCPC), which alleged that the California Office of Environmental Health Hazard Assessment’s (OEHHA) requirement for warnings under Proposition 65 (Prop 65) related to titanium dioxide in cosmetics and personal care products violated the First Amendment. The Personal Care Products Council v. Bonta, No. 2:23-cv-01006-TLN-JDP (E.D. Cal. 2024). In its Order, the District Court enjoined the California Attorney General and any private citizen enforcers from enforcing Prop 65’s warning requirement for “cancer as applied to Listed Titanium Dioxide (i.e., titanium dioxide that consists of airborne, unbound particles of respirable size) in cosmetic and personal care products.” The District Court also denied a motion to intervene by Environmental Health Advocates, Inc. (EHA), who had argued it was “an interested party because it is the primary enforcer of Prop 65.” For more information, please read the full memorandum.

Proposition 65: OEHHA Proposes Additional Changes To “Short-Form” Warning Option: On June 14, 2024, the California OEHHA issued a notice proposing additional changes to its Prop 65 Article 6 “clear and reasonable warnings” regulations for “short-form” warnings (Notice). The changes proposed now are to the proposed regulations that OEHHA issued on October 27, 2023. The history of these amendments, dating back to January 2021, are set forth in our memorandum available here. Written comments on the proposed changes were due no later than June 28, 2024. More information is available in our July 5, 2024, memorandum.

June 2024 IRIS Program Outlook Released: EPA’s Health and Environmental Risk Assessment (HERA) Program announced on June 27, 2024, the release of the June 2024 Integrated Risk Information System (IRIS) Program Outlook. To maintain transparency, the IRIS Program provides an updated outlook of program activities. The IRIS Program Outlook describes assessments that are in development and projected public milestone dates.

Registration Opens For July Webinars On Minnesota’s PFAS In Products Law; MPCA Publishes Summary Of Comments On CUUs: The Minnesota Pollution Control Agency (MPCA) will hold two public webinars in July to provide updates and answer questions on Minnesota’s PFAS in products law (Amara’s Law), which takes effect in stages between 2025 and 2032:

Progress on rule development, July 18, 2024, 10:00 a.m. – 11:30 a.m. (CDT): Join MPCA staff for a presentation on preliminary rule writing for the PFAS in products reporting, fees, and currently unavoidable use (CUU) rules. Registration is open.
Information on 2025 prohibitions for retailers and manufacturers, July 25, 2024, 11:00 a.m. – 12:00 p.m. (CDT): This webinar will discuss how the 2025 PFAS in products prohibitions will affect retailers and manufacturers starting January 1, 2025, when 11 categories of consumer products must be free of intentionally added PFAS. Registration is open.

As reported in our January 12, 2024, blog item, MPCA published a request for comments (RFC) on planned new rules governing CUU determinations for products containing PFAS. According to the RFC, the main purpose of the rulemaking is to establish criteria and processes through which MPCA will make decisions on what uses of intentionally added PFAS will qualify as CUUs in products sold, offered for sale, or distributed in Minnesota. Any such determinations must be published by rule by MPCA by January 1, 2032. MPCA has posted a summary of the comments received on the RFC. More information is available in our June 24, 2024, blog item.

Minnesota Department Of Health Highlights Recent Publications On PFAS Bioaccumulation And PFAS In Infant Formula: The Minnesota Department of Health (MDH) recently noted that Health Risk Assessment scientists at MDH have published two articles in the Journal of Environmental Exposure Assessment related to PFAS:

OIRA Will Offer Training Sessions On Effective Participation In The Public Comment Process: As part of its efforts to strengthen public engagement in the federal regulatory process, the Office of Information and Regulatory Affairs (OIRA) in OMB announced on July 10, 2024, that it will offer training sessions on effective public participation in the public comment process. 89 Fed. Reg. 56777. In response to feedback received from the public and as part of its ongoing efforts to strengthen public participation in the regulatory process, OIRA will hold two training sessions on effective participation in the public comment process. During the training sessions, OIRA will describe opportunities to provide comment in the federal regulatory process; how to submit public comments; and how to draft effective public comments. The training sessions will be held on July 18, 2024, from 3:00 p.m. to 3:45 p.m. (EDT) and July 24, 2024, from 5:30 p.m. to 6:15 p.m. (EDT).

CISA Hosts 2024 Chemical Security Seminars On July 11 And 18, 2024: The U.S. Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is hosting the fully virtual 2024 Chemical Security Seminars on July 11 and July 18, 2024, from 10:00 a.m. – 3:00 p.m. (EDT). The sessions will cover a range of topics related to the security of dangerous chemicals. More information is available in our July 8, 2024, blog item.

Comments On Canada’s Updated Draft State Of PFAS Report And Revised Risk Management Scope Are Due September 11, 2024: The July 13, 2024, Canada Gazette includes a notice announcing the availability of the Updated Draft State of Per- and Polyfluoroalkyl Substances (PFAS) Report (Updated Draft Report) and Revised Risk Management Scope for Per- and Polyfluoroalkyl Substances (PFAS) (Revised Risk Management Scope). The Minister of the Environment and the Minister of Health (the ministers) propose to recommend that the class of PFAS, excluding fluoropolymers, be added to Part 2 of Schedule 1 of the Canadian Environmental Protection Act, 1999 (CEPA). According to the Revised Risk Management Scope, Canada is considering:

As a first step, a regulatory instrument under CEPA to restrict PFAS not currently regulated in firefighting foams; and
Additional regulatory instrument(s) under CEPA to prohibit other uses or sectors in relation to PFAS. Prioritization for prohibition may be based on factors such as socioeconomic considerations, the availability of feasible alternatives, and the potential for human and environmental exposure.

The Revised Risk Management Scope states that “[v]oluntary risk management actions are also being considered to achieve early results to reduce releases of PFAS, as a complement to the proposed regulatory instruments.” Comments are due September 11, 2024. More information is available in our July 12, 2024, blog item.

On July 1, 2024, Texas May Have the Strongest Consumer Data Privacy Law in the United States

It’s Bigger. But is it Better?

They say everything is bigger in Texas which includes big privacy protection. After the Texas Senate approved HB 4 — the Texas Data Privacy and Security Act (“TDPSA”), on June 18, 2023, Texas became the eleventh state to enact comprehensive privacy legislation.^[1]

Like many state consumer data privacy laws enacted this year, TDPSA is largely modeled after the Virginia Consumer Data Protection Act.^[2] However, the law contains several unique differences and drew significant pieces from recently enacted consumer data privacy laws in Colorado and Connecticut, which generally include “stronger” provisions than the more “business-friendly” laws passed in states like Utah and Iowa.

Some of the more notable provisions of the bill are described below:

More Scope Than You Can Shake a Stick At!

The TDPSA applies much more broadly than any other pending or effective state consumer data privacy act, pulling in individuals as well as businesses regardless of their revenues or the number of individuals whose personal data is processed or sold.
The TDPSA applies to any individual or business that meets all of the following criteria:
- conduct business in Texas (or produce goods or services consumed in Texas) and,
- process or sell personal data:
  - The “processing or sale of personal data” further expands the applicability of the TDPSA to include individuals and businesses that engage in any operations involving personal data, such as the “collection, use, storage, disclosure, analysis, deletion, or modification of personal data.”
  - In short, collecting, storing or otherwise handling the personal data of any resident of Texas, or transferring that data for any consideration, will likely meet this standard.
Uniquely, the carveout for “small businesses” excludes from coverage those entities that meet the definition of “a small business as defined by the United States Small Business Administration.”^[3]
The law requires all businesses, including small businesses, to obtain opt-in consent before processing sensitive personal data.
Similar to other state comprehensive privacy laws, TDPSA excludes state agencies or political subdivisions of Texas, financial institutions subject to Title V of the Gramm-Leach-Bliley Act, covered entities and business associates governed by HIPAA, nonprofit organizations, and institutions of higher education. But, TDPSA uniquely excludes electric utilities, power generation companies, and retail electric providers, as defined under Section 31.002 of the Texas Utilities Code.
Certain categories of information are also excluded, including health information protected by HIPAA or used in connection with human clinical trials, and information covered by the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act of 1974, the Farm Credit Act of 1971, emergency contact information used for emergency contact purposes, and data necessary to administer benefits.

Don’t Mess with Texas Consumers

Texas’s longstanding libertarian roots are evidenced in the TDPSA’s strong menu of individual consumer privacy rights, including the right to:

Confirm whether a controller is processing the consumer’s personal data and accessing that data;
Correct inaccuracies in the consumer’s personal data, considering the nature of the data and the purposes of the processing;
Delete personal data provided by or obtained about the consumer;
Obtain a copy of the consumer’s personal data that the consumer previously provided to a controller in a portable and readily usable format, if the data is available digitally and it is technically feasible; and
Opt-out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces legal or similarly significant legal effects concerning the consumer.

Data controllers are required to respond to consumer requests within 45 days, which may be extended by 45 days when reasonably necessary. The bill would also give consumers a right to appeal a controller’s refusal to respond to a request.

Controller Hospitality

The Texas bill imposes a number of obligations on data controllers, most of which are similar to other state consumer data privacy laws:

Data Minimization – Controllers should limit data collection to what is “adequate, relevant, and reasonably necessary” to achieve the purposes of collection that have been disclosed to a consumer. Consent is required before processing information in ways that are not reasonably necessary or not compatible with the purposes disclosed to a consumer.
Nondiscrimination – Controllers may not discriminate against a consumer for exercising individual rights under the TDPSA, including by denying goods or services, charging different rates, or providing different levels of quality.
Sensitive Data – Consent is required before processing sensitive data, which includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, citizenship or immigration status, genetic or biometric data processed for purposes of uniquely identifying an individual; personal data collected from a child known to be under the age of 13, and precise geolocation data.
- The Senate version of the bill excludes data revealing “sexual orientation” from the categories of sensitive information, which differs from all other state consumer data privacy laws.
Privacy Notice – Controllers must post a privacy notice (e.g. website policy) that includes (1) the categories of personal data processed by the controller (including any sensitive data), (2) the purposes for the processing, (3) how consumers may exercise their individual rights under the Act, including the right of appeal, (4) any categories of personal data that the controller shares with third parties and the categories of those third parties, and (5) a description of the methods available to consumers to exercise their rights (e.g., website form or email address).
Targeted Advertising – A controller that sells personal data to third parties for purposes of targeted advertising must clearly and conspicuously disclose to consumers their right to opt-out.

Assessing the Privacy of Texans

Unlike some of the “business-friendly” privacy laws in Utah and Iowa, the Texas bill requires controllers to conduct data protection assessments (“Data Privacy Protection Assessments” or “DPPAs) for certain types of processing that pose heightened risks to consumers. The assessments must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the consumer as mitigated by any safeguards that could reduce those risks. In Texas, the categories that require assessments are identical to those required by Connecticut’s consumer data privacy law and include:

Processing personal data for targeted advertising;
The sale of personal data;
Processing personal data for profiling consumers, if such profiling presents a reasonably foreseeable risk to consumers of unfair or deceptive treatment, disparate impact, financial, physical or reputational injury, physical or other intrusion upon seclusion of private affairs, or “other substantial injury;”
Processing of sensitive data; and
Any processing activities involving personal data that present a “heightened risk of harm to consumers.”

Opting Out and About

Businesses are required to recognize a universal opt-out mechanism for consumers (or, Global Privacy Control signal), similar to provisions required in Colorado, Connecticut, California, and Montana, but it would also allow businesses more leeway to ignore those signals if it cannot verify the consumers’ identity or lacks the technical ability to receive it.

Show Me Some Swagger!

The Attorney General has the exclusive right to enforce the law, punishable by civil penalties of up to $7,500 per violation. Businesses have a 30-day right to cure violations upon written notice from the Attorney General. Unlike several other laws, the right to cure has no sunset provision and would remain a permanent part of the law. The law does not include a private right of action.

Next Steps for TDPSA Compliance

For businesses that have already developed a state privacy compliance program, especially those modeled around Colorado and Connecticut, making room for TDPSA will be a streamlined exercise. However, businesses that are starting from ground zero, especially “small businesses” defined in the law, need to get moving.

If TDPSA is your first ride in a state consumer privacy compliance rodeo, some first steps we recommend are:

Update your website privacy policy for facial compliance with the law and make sure that notice is being given at or before the time of collection.
Put procedures in place to respond to consumer privacy requests and ask for consent before processing sensitive information
Gather necessary information to complete data protection assessments.
Identify vendor contracts that should be updated with mandatory data protection terms.

Footnotes

[1] As of date of publication, there are now 17 states that have passed state consumer data privacy laws (California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Massachusetts, Montana, New Jersey, New Hampshire, Tennessee, Texas, Utah, Virginia) and two (Vermont and Minnesota) that are pending.

[2] See, Code of Virginia Code – Chapter 53. Consumer Data Protection Act

[3] This is notably broader than other state privacy laws, which establish threshold requirements based on revenues or the amount of personal data that a business processes. It will also make it more difficult to know what businesses are covered because SBA definitions vary significantly from one industry vertical to another. As a quick rule of thumb, under the current SBA size standards, a U.S. business with annual average receipts of less than $2.25 million and fewer than 100 employees will likely be small, and therefore exempt from the TDPSA’s primary requirements.

For more news on State Privacy Laws, visit the NLR Consumer Protection and Communications, Media & Internet sections.

FTC Issues Report to Congress Highlighting Collaboration with State Attorneys General

On April 10, 2024, the Federal Trade Commission issued a report to Congress on the agency’s collaboration with state attorneys general highlighting current cooperative law enforcement efforts, best practices to ensure continued collaboration and legislative recommendations to enhance such efforts.

The report, directed by the FTC Collaboration Act of 2021, “Working Together to Protect Consumers: A Study and Recommendations on FTC Collaboration with the State Attorneys General” makes legislative recommendations that would enhance these efforts, including reinstating the Commission’s authority to seek money for defrauded consumers and providing it with the independent authority to seek civil penalties.

“Today’s consumer protection challenges require an all-hands-on-deck response, and our report details how the FTC is working closely with state enforcers to share information, stop fraud, and ensure fairness in the marketplace,” said FTC attorney Samuel Levine, Director of the Bureau of Consumer Protection. “We look forward to seeking new opportunities to strengthen these ties and confront the challenges of the future.”

In June 2023, the Commission announced a request for public information (RFI) seeking public comments and suggestions on ways it can work more effectively with state AGs to help educate consumers about, and protect them from, potential fraud. After reviewing and analyzing the comments received, the agency developed the report to Congress issued today. The report is divided into three sections: 1) The FTC’s Existing Collaborative Efforts with State
Attorneys General to Prevent, Publicize, and Penalize Frauds and Scams; 2) Recommended Best Practices to Enhance Collaboration; and 3) Legislative Recommendations to Enhance Collaboration Efforts.

The first section lays out the roles and responsibilities of the FTC and state AGs in protecting consumers from frauds and scams, provides an overview of their respective law enforcement authority, and discusses how federal and state enforcers share their information and expertise to facilitate effective communication and cooperation. It also provides a breakdown of the FTC’s
structure and a description of the Consumer Sentinel consumer complaint database, the largest such information-sharing network in the United States.

The second section details best practices used to enhance strong information-sharing between the FTC and its state law enforcement partners, discusses how the Commission coordinates joint and parallel enforcement actions with state AGs and other state consumer protection agencies, and presents ideas on expanding the sharing of expertise and technical resources between agencies.

Finally, the third section stresses the legislative need to restore the FTC’s Section 13(b) authority to seek equitable monetary refunds for injured consumers, presents ways to enhance collaboration and conserve resources by providing the FTC with the independent authority to seek civil penalties, and describes the agency’s need for clear authority to pursue legal actions against those who assist and facilitate unfair or deceptive acts or practices.

The Commission vote approving the report to Congress was 3-0-2, with Commissioners Melissa Holyoak and Andrew N. Ferguson not participating. Chair Lina M. Khan issued a separate statement, in which she was joined by Commissioners Rebecca Kelly Slaughter and Alvaro M. Bedoya. Commissioner Slaughter also issued a separate statement.

California PFAS Ban in Products: 6th Largest Global Economy Enters the Fray

We reported extensively on the landmark legislation passed in Maine in 2021 and Minnesota in 2023, which were at the time the most far-reaching PFAS ban in the United States. Other states, including Massachusetts and Rhode Island, have subsequently introduced legislation similar to Maine and Minnesota’s regulations. While we have long predicted that the so-called “all PFAS / all products” legislative bans will become the trend at the state levels, it is significant to note that California, the world’s sixth largest economy, recently introduced a similar proposed PFAS ban for consumer products.

The California proposed legislation, coupled with the existing legislation passed or on the table, will have enormous impacts on companies doing business in or with the state of California, as well as on likely future consumer goods personal injury lawsuits. The California PFAS ban must therefore not be overlooked in companies’ compliance and product development departments.

California PFAS Ban

California’s SB 903 in its current form would prohibit for sale (or offering for sale) any products that contain intentionally added PFAS. A “product” is defined as “an item manufactured, assembled, packaged, or otherwise prepared for sale in California, including, but not limited to, its components, sold or distributed for personal, residential, commercial, or industrial use, including for use in making other products.” It further defines “component” as “an identifiable ingredient, part, or piece of a product, regardless of whether the manufacturer of the product is the manufacturer of the component.”

While the effective date of SB 903’s prohibition would be January 1, 2030, the bill gives the California Department of Toxic Substances Control (“DTSC”) the authority to prohibit intentionally added PFAS in a product before the 2030 effective date. It also allows DTSC to categorize PFAS in a product as an “unavoidable use”, thereby effectively creating an exemption to the bill’s ban, although California exemption would be limited to five years in duration. Similar carve outs were also included in the Maine and Minnesota bans. In each instance, certain information must be provided to the state to obtain an “unavoidable use” exemption. In California, an “unavoidable use” exemption would only be granted if:

There are no safer alternatives to PFAS that are reasonably available.
The function provided by PFAS in the product is necessary for the product to work.
The use of PFAS in the product is critical for health, safety, or the functioning of society.

If a company sells a products containing PFAS in the state of California in violation of the proposed law, companies would be assessed a $1,000 per day penalty for each violation, a maximum of $2,500 per day for repeat offenders, and face possible Court-ordered prohibition of sales for violating products.

Implications To Businesses From The Minnesota PFAS Legislation

First and foremost of concern to companies is the compliance aspect of the California law. The state continues to modify and refine key definitions of the regulation, resulting in companies needing to consider the wording implications on their reporting requirements. In addition, some companies find themselves encountering supply chain disclosure issues that will impact reporting to the state of California, which raises the concern of accuracy of reporting by companies. Companies and industries are also very concerned that the information that is being gathered will provide a legacy repository of valuable information for plaintiffs’ attorneys who file future products liability lawsuits for personal injury, not only in the state of California, but in any state in which the same products were sold.

It is of the utmost importance for businesses along the whole supply chain to evaluate their PFAS risk. Public health and environmental groups urge legislators to regulate these compounds. One major point of contention among members of various industries is whether to regulate PFAS as a class or as individual compounds. While each PFAS compound has a unique chemical makeup and impacts the environment and the human body in different ways, some groups argue PFAS should be regulated together as a class because they interact with each other in the body, thereby resulting in a collective impact. Other groups argue that the individual compounds are too diverse and that regulating them as a class would be over restrictive for some chemicals and not restrictive enough for others.

Companies should remain informed so they do not get caught off guard. Regulators at both the state and federal level are setting drinking water standards and notice requirements of varying stringency, and states are increasingly passing PFAS product bills that differ in scope. For any manufacturers, especially those who sell goods interstate, it is important to understand how those various standards will impact them, whether PFAS is regulated as individual compounds or as a class. Conducting regular self-audits for possible exposure to PFAS risk and potential regulatory violations can result in long term savings for companies and should be commonplace in their own risk assessment.

Multistate Coalition Supports EPA’s Proposed Revisions to the Safer Choice Standard

As reported in our December 5, 2023, memorandum, the U.S. Environmental Protection Agency (EPA) proposed updates to the Safer Choice Standard on November 14, 2023, that include a name change to the Safer Choice and Design for the Environment (DfE) Standard (Standard), an update to the packaging criteria, the addition of a Safer Choice certification for cleaning service providers, a provision allowing for preterm partnership termination under exceptional circumstances, and the addition of several product and functional use class requirements. 88 Fed. Reg. 78017. On January 16, 2024, California Attorney General Rob Bonta announced that, alongside a coalition of 12 attorneys general, he submitted a comment letter that:

Supports EPA’s proposed revisions to its Safer Choice Standard;
Recommends that EPA not allow products with plastic primary packaging to use the Safer Choice label or DfE logo;
Recommends that if EPA does allow products with plastic primary packaging to use the label and logo, EPA should prohibit the use of chemical recycling in meeting the proposed standard’s plastic packaging recycled content requirements; and
Calls on EPA to exclude any products or packaging that contain any per- and polyfluoroalkyl substances (PFAS), “whether intentionally introduced or not.”

Exploring the Future of Information Governance: Key Predictions for 2024

Information governance has evolved rapidly, with technology driving the pace of change. Looking ahead to 2024, we anticipate technology playing an even larger role in data management and protection. In this blog post, we’ll delve into the key predictions for information governance in 2024 and how they’ll impact businesses of all sizes.

Embracing AI and Automation: Artificial intelligence and automation are revolutionizing industries, bringing about significant changes in information governance practices. Over the next few years, it is anticipated that an increasing number of companies will harness the power of AI and automation to drive efficient data analysis, classification, and management. This transformative approach will not only enhance risk identification and compliance but also streamline workflows and alleviate administrative burdens, leading to improved overall operational efficiency and effectiveness. As organizations adapt and embrace these technological advancements, they will be better equipped to navigate the evolving landscape of data governance and stay ahead in an increasingly competitive business environment.
Prioritizing Data Privacy and Security: In recent years, data breaches and cyber-attacks have significantly increased concerns regarding the usage and protection of personal data. As we look ahead to 2024, the importance of data privacy and security will be paramount. This heightened emphasis is driven by regulatory measures such as the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR). These regulations necessitate that businesses take proactive measures to protect sensitive data and provide transparency in their data practices. By doing so, businesses can instill trust in their customers and ensure the responsible handling of personal information.
Fostering Collaboration Across Departments: In today’s rapidly evolving digital landscape, information governance has become a collective responsibility. Looking ahead to 2024, we can anticipate a significant shift towards closer collaboration between the legal, compliance, risk management, and IT departments. This collaborative effort aims to ensure comprehensive data management and robust protection practices across the entire organization. By adopting a holistic approach and providing cross-functional training, companies can empower their workforce to navigate the complexities of information governance with confidence, enabling them to make informed decisions and mitigate potential risks effectively. Embracing this collaborative mindset will be crucial for organizations to adapt and thrive in an increasingly data-driven world.
Exploring Blockchain Technology: Blockchain technology, with its decentralized and immutable nature, has the tremendous potential to revolutionize information governance across industries. By 2024, as businesses continue to recognize the benefits, we can expect a significant increase in the adoption of blockchain for secure and transparent transaction ledgers. This transformative technology not only enhances data integrity but also mitigates the risks of tampering, ensuring trust and accountability in the digital age. With its ability to provide a robust and reliable framework for data management, blockchain is poised to reshape the way we handle and secure information, paving the way for a more efficient and trustworthy future.
Prioritizing Data Ethics: As data-driven decision-making becomes increasingly crucial in the business landscape, the importance of ethical data usage cannot be overstated. In the year 2024, businesses will place even greater emphasis on data ethics, recognizing the need to establish clear guidelines and protocols to navigate potential ethical dilemmas that may arise. To ensure responsible and ethical data practices, organizations will invest in enhancing data literacy among their workforce, prioritizing education and training initiatives. Additionally, there will be a growing focus on transparency in data collection and usage, with businesses striving to build trust and maintain the privacy of individuals while harnessing the power of data for informed decision-making.

The future of information governance will be shaped by technology, regulations, and ethical considerations. Businesses that adapt to these changes will thrive in a data-driven world. By investing in AI and automation, prioritizing data privacy and security, fostering collaboration, exploring blockchain technology, and upholding data ethics, companies can prepare for the challenges and opportunities of 2024 and beyond.

Jim Merrifield, Robinson+Cole’s Director of Information Governance & Business Intake, contributed to this report.

Under the GDPR, Are Companies that Utilize Personal Information to Train Artificial Intelligence (AI) Controllers or Processors?

The EU’s General Data Protection Regulation (GDPR) applies to two types of entities – “controllers” and “processors.”

A “controller” refers to an entity that “determines the purposes and means” of how personal information will be processed.[1] Determining the “means” of processing refers to deciding “how” information will be processed.[2] That does not necessitate, however, that a controller makes every decision with respect to information processing. The European Data Protection Board (EDPB) distinguishes between “essential means” and “non-essential means.[3] “Essential means” refers to those processing decisions that are closely linked to the purpose and the scope of processing and, therefore, are considered “traditionally and inherently reserved to the controller.”[4] “Non-essential means” refers to more practical aspects of implementing a processing activity that may be left to third parties – such as processors.[5]

A “processor” refers to a company (or a person such as an independent contractor) that “processes personal data on behalf of [a] controller.”[6]

Data typically is needed to train and fine-tune modern artificial intelligence models. They use data – including personal information – in order to recognize patterns and predict results.

Whether an organization that utilizes personal information to train an artificial intelligence engine is a controller or a processor depends on the degree to which the organization determines the purpose for which the data will be used and the essential means of processing. The following chart discusses these variables in the context of training AI:

The following chart discusses these variables in the context of training AI:

Function	Activities Indicative of a Controller	Activities Indicative of a Processor
Purpose of processing
Why the AI is being trained.	If an organization makes its own decision to utilize personal information to train an AI, then the organization will likely be considered a “controller.”	If an organization is using personal information provided by a third party to train an AI, and is doing so at the direction of the third party, then the organization may be considered a processor.
Essential means
Data types used in training.	If an organization selects which data fields will be used to train an AI, the organization will likely be considered a “controller.”	If an organization is instructed by a third party to utilize particular data types to train an AI, the organization may be a processor.
Duration personal information is held within the training engine	If an organization determines how long the AI can retain training data, it will likely be considered a “controller.”	If an organization is instructed by a third party to use data to train an AI, and does not control how long the AI may access the training data, the organization may be a processor.
Recipients of the personal information	If an organization determines which third parties may access the training data that is provided to the AI, that organization will likely be considered a “controller.”	If an organization is instructed by a third party to use data to train an AI, but does not control who will be able to access the AI (and the training data to which the AI has access), the organization may be a processor.
Individuals whose information is included	If an organization is selecting whose personal information will be used as part of training an AI, the organization will likely be considered a “controller.”	If an organization is being instructed by a third party to utilize particular individuals’ data to train an AI, the organization may be a processor.

[1] GDPR, Article 4(7).

[2] EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 33.

[3] EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 38.

[4] EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 38.

[5] EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 38.

[6] GDPR, Article 4(8).

For more Privacy Legal News, click here to visit the National Law Review.

Montana Passes 9th Comprehensive Consumer Privacy Law in the U.S.

On May 19, 2023, Montana’s Governor signed Senate Bill 384, the Consumer Data Privacy Act. Montana joins California, Colorado, Connecticut, Indiana, Iowa, Tennessee, Utah, and Virginia in enacting a comprehensive consumer privacy law. The law is scheduled to take effect on October 1, 2024.

When does the law apply?

The law applies to a person who conducts business in the state of Montana and:

Controls or processes the personal data of not less than 50,000 consumers (defined as Montana residents), excluding data controlled or processed solely to complete a payment transaction.
Controls and processes the personal data of not less than 25,000 consumers and derive more than 25% of gross revenue from the sale of personal data.

Hereafter these covered persons are referred to as controllers.

The following entities are exempt from coverage under the law:

Body, authority, board, bureau, commission, district, or agency of this state or any political subdivision of this state;
Nonprofit organization;
Institution of higher education;
National securities association that is registered under 15 U.S.C. 78o-3 of the federal Securities Exchange Act of 1934;
A financial institution or an affiliate of a financial institution governed by Title V of the Gramm- Leach-Bliley Act;
Covered entity or business associate as defined in the privacy regulations of the federal Health Insurance Portability and Accountability Act (HIPAA);

Who is protected by the law?

Under the law, a protected consumer is defined as an individual who resides in the state of Montana.

However, the term consumer does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit, or government agency.

What data is protected by the law?

The statute protects personal data defined as information that is linked or reasonably linkable to an identified or identifiable individual.

There are several exemptions to protected personal data, including for data protected under HIPAA and other federal statutes.

What are the rights of consumers?

Under the new law, consumers have the right to:

Confirm whether a controller is processing the consumer’s personal data
Access Personal Data processed by a controller
Delete personal data
Obtain a copy of personal data previously provided to a controller.
Opt-out of the processing of the consumer’s personal data for the purpose of targeted advertising, sales of personal data, and profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

What obligations do businesses have?

The controller shall comply with requests by a consumer set forth in the statute without undue delay but no later than 45 days after receipt of the request.

If a controller declines to act regarding a consumer’s request, the business shall inform the consumer without undue delay, but no later than 45 days after receipt of the request, of the reason for declining.

The controller shall also conduct and document a data protection assessment for each of their processing activities that present a heightened risk of harm to a consumer.

How is the law enforced?

Under the statute, the state attorney general has exclusive authority to enforce violations of the statute. There is no private right of action under Montana’s statute.

For more Privacy Legal News, click here to visit the National Law Review.

Tag: Consumer Protection

EVERYTHING’S FINE: Big TCPA Win For Medical Debt Collector Suggests FCC Rulings Still Binding After Loper Bright–Let’s Hope it Stays That Way

Like this:

FTC Announces Final Rule Imposing Civil Penalties for Fake Consumer Reviews and Testimonials