Consumer Protection Archives - The National Law Forum

FDA Issues New Guidance on Cosmetic Product Registration and Listing

On December 11, 2024, the U.S. Food & Drug Administration (FDA) issued updated guidance for industry on the registration and listing of cosmetic product facilities and products. The guidance provides recommendations and instructions to help individuals and companies comply with the Modernization of Cosmetics Regulations Act of 2022 (MoCRA).
MoCRA mandates that cosmetic companies report serious adverse events to FDA within 15 business days, register their facilities and list their products, ensure product safety before marketing, and comply with FDA’s authority to access records and order recalls if products are found to be unsafe or misbranded.
The updated guidance outlines the statutory requirements for submitting cosmetic product facility registrations and product listings. It finalizes the frequently asked questions (FAQs) in Appendix B (Q1-19) and introduces three new FAQs (Q20-22) for public comment.
- Q20 outlines the responsibilities of a U.S agent, which includes assisting FDA with communications, responding to product inquiries, helping schedule inspections, and receiving documents on behalf of the foreign establishment;
- Q21 explains that multiple buildings within three miles can share one FEI number if they are part of the same establishment and management, and can be inspected together; and
- Q22 indicates that a product listing is generally required for all cosmetic products, including free samples or gifts, unless specific exemptions apply.
The comment period is open until January 13, 2024, and comments can be submitted through the docket.

PRIVACY ON ICE: A Chilling Look at Third-Party Data Risks for Companies

An intelligent lawyer could tackle a problem and figure out a solution. But a brilliant lawyer would figure out how to prevent the problem to begin with. That’s precisely what we do here at Troutman Amin. So here is the latest scoop to keep you cool. A recent case in the United States District Court for the Northern District of California, Smith v. Yeti Coolers, L.L.C., No. 24-cv-01703-RFL, 2024 U.S. Dist. LEXIS 194481 (N.D. Cal. Oct. 21, 2024), addresses complex issues surrounding online privacy and the liability of companies who enable third parties to collect and use consumer data without proper disclosures or consent.

Here, Plaintiff alleged that Yeti Coolers (“Yeti”) used a third-party payment processor, Adyen, that collected customers’ personal and financial information during transactions on Yeti’s website. Plaintiff claimed Adyen then stored this data and used it for its own commercial purposes, like marketing fraud prevention services to merchants, without customers’ knowledge or consent. Alarm bells should be sounding off in your head—this could signal a concerning trend in data practices.

Plaintiff sued Yeti under the California Invasion of Privacy Act (“CIPA”) for violating California Penal Code Sections 631(a) (wiretapping) and 632 (recording confidential communications). Plaintiff also brought a claim under the California Constitution for invasion of privacy. The key question here was whether Yeti could be held derivatively liable for Adyen’s alleged wrongful conduct.

So, let’s break this down step by step.

Under the alleged CIPA Section 631(a) violation, the court found that Plaintiff plausibly alleged Adyen violated this Section by collecting customer data as a third-party eavesdropper without proper consent. In analyzing whether Yeti’s Privacy Policy and Terms of Use constituted enforceable agreements, it applied the legal frameworks for “clickwrap” and “browsewrap” agreements.

Luckily, my Contracts professor during law school here in Florida was remarkable, Todd J. Clark, now the Dean of Widner University Delaware Law School. For those who snoozed out during Contracts class during law school, here is a refresher:

Clickwrap agreements present the website’s terms to the user and require the user to affirmatively click an “I agree” button to proceed. Browsewrap agreements simply post the terms via a hyperlink at the bottom of the webpage. For either type of agreement to be enforceable, the Court explained that a website must provide 1) reasonably conspicuous notice of the terms and 2) require some action unambiguously manifesting assent. See Oberstein v. Live Nation Ent., Inc., 60 F.4th 505, 515 (9th Cir. 2023).

The Court held that while Yeti’s pop-up banner and policy links were conspicuous, they did not create an enforceable clickwrap agreement because “Defendant’s pop-up banner does not require individuals to click an “I agree” button, nor does it include any language to imply that by proceeding to use the website, users reasonably consent to Defendant’s terms and conditions of use.” See Smith, 2024 U.S. Dist. LEXIS 194481, at *8. The Court also found no enforceable browsewrap agreement was formed because although the policies were conspicuously available, “Defendant’s website does not require additional action by users to demonstrate assent and does not conspicuously notify them that continuing to use to website constitutes assent to the Privacy Policy and Terms of Use.” Id. at *9.

What is more, the Court relied on Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1179 (9th Cir. 2014), which held that “where a website makes its terms of use available via a conspicuous hyperlink on every page of the website but otherwise provides no notice to users nor prompts them to take any affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant buttons users must click on—without more—is insufficient to give rise to constructive notice.” Here, the Court found the pop-up banner and link on Yeti’s homepage presented the same situation as in Nguyen and thus did not create an enforceable browsewrap agreement.

Thus, the Court dismissed the Section 631(a) claim due to insufficient allegations that Yeti was aware of Adyen’s alleged violations.

However, the Court held that to establish Yeti’s derivative liability for “aiding” Adyen under Section 631(a), Plaintiff had to allege facts showing Yeti acted with both knowledge of Adyen’s unlawful conduct and the intent or purpose to assist it. It found Plaintiff’s allegations that Yeti was “aware of the purposes for which Adyen collects consumers’ sensitive information because Defendant is knowledgeable of and benefitting from Adyen’s fraud prevention services” and “assists Adyen in intercepting and indefinitely storing this sensitive information” were too conclusory. Smith, 2024 U.S. Dist. LEXIS 194481, at *13. It reasoned: “Without further information, the Court cannot plausibly infer from Defendant’s use of Adyen’s fraud prevention services alone that Defendant knew that Adyen’s services were based on its allegedly illegal interception and storing of financial information, collected during Adyen’s online processing of customers’ purchases.” Id.

Next, the Court similarly found that Plaintiff plausibly alleged Adyen recorded a confidential communication without consent in violation of CIPA Section 632. A communication is confidential under this section if a party “has an objectively reasonable expectation that the conversation is not being overheard or recorded.” Flanagan v. Flanagan, 27 Cal. 4th 766, 776-77 (2002). It explained that “[w]hether a party has a reasonable expectation of privacy is a context-specific inquiry that should not be adjudicated as a matter of law unless the undisputed material facts show no reasonable expectation of privacy.” Smith, 2024 U.S. Dist. LEXIS 194481, at *18-19. At the pleading stage, the Court found Plaintiff’s allegation that she reasonably expected her sensitive financial information would remain private was sufficient.

However, as with the Section 631(a) claim, the Court held that Plaintiff did not plead facts establishing Yeti’s derivative liability under the standard for aiding and abetting liability. Under Saunders v. Superior Court, 27 Cal. App. 4th 832, 846 (1994), the Court explained a defendant is liable if they a) know the other’s conduct is wrongful and substantially assist them or b) substantially assist the other in accomplishing a tortious result and the defendant’s own conduct separately breached a duty to the plaintiff. The Court found that the Complaint lacked sufficient non-conclusory allegations that Yeti knew or intended to assist Adyen’s alleged violation. See Smith, 2024 U.S. Dist. LEXIS 194481, at *16.

Lastly, the Court analyzed Plaintiff’s invasion of privacy claim under the California Constitution using the framework from Hill v. Nat’l Coll. Athletic Ass’n, 7 Cal. 4th 1, 35-37 (1994). For a valid invasion of privacy claim, Plaintiff had to show 1) a legally protected privacy interest, 2) a reasonable expectation of privacy under the circumstances, and 3) a serious invasion of privacy constituting “an egregious breach of the social norms.” Id.

The Court found Plaintiff had a protected informational privacy interest in her personal and financial data, as “individual[s] ha[ve] a legally protected privacy interest in ‘precluding the dissemination or misuse of sensitive and confidential information.”‘ Smith, 2024 U.S. Dist. LEXIS 194481, at *17. It also found Plaintiff plausibly alleged a reasonable expectation of privacy at this stage given the sensitivity of financial data, even if “voluntarily disclosed during the course of ordinary online commercial activity,” as this presents “precisely the type of fact-specific inquiry that cannot be decided on the pleadings.” Id. at *19-20.

Conversely, the Court found Plaintiff did not allege facts showing Yeti’s conduct was “an egregious breach of the social norms” rising to the level of a serious invasion of privacy, which requires more than “routine commercial behavior.” Id. at *21. The Court explained that while Yeti’s simple use of Adyen for payment processing cannot amount to a serious invasion of privacy, “if Defendant was aware of Adyen’s usage of the personal information for additional purposes, this may present a plausible allegation that Defendant’s conduct was sufficiently egregious to survive a Motion to Dismiss.” Id. However, absent such allegations about Yeti’s knowledge, this claim failed.

In the end, the Court dismissed Plaintiff’s Complaint but granted leave to amend to correct the deficiencies, so this case may not be over. The Court’s grant of “leave to amend” signals that if Plaintiff can sufficiently allege Yeti’s knowledge of or intent to facilitate Adyen’s use of customer data, these claims could proceed. As companies increasingly rely on third parties to handle customer data, we will likely see more litigation in this area, testing the boundaries of corporate liability for data privacy violations.

So, what is the takeaway? As a brilliant lawyer, your company’s goal should be to prevent privacy pitfalls before they snowball into costly litigation. Key things to keep in mind are 1) ensure your privacy policies and terms of use are properly structured as enforceable clickwrap or browsewrap agreements, with conspicuous notice and clear assent mechanisms; 2) conduct thorough due diligence on third-party service providers’ data practices and contractual protections; 3) implement transparent data collection and sharing disclosures for informed customer consent; and 4) stay abreast of evolving privacy laws.

In essence, taking these proactive steps can help mitigate the risks of derivative liability for third-party misconduct and, most importantly, foster trust with your customers.

EVERYTHING’S FINE: Big TCPA Win For Medical Debt Collector Suggests FCC Rulings Still Binding After Loper Bright–Let’s Hope it Stays That Way

Fascinating little case for you all today.

Consumer visits hospital for treatment. Provides phone number at admission. Receives treatment and is discharged.

Consumer fails to pay resulting invoices. Hospital and provider network turn account over to collections. Debt collector allegedly uses an ATDS to call consumer on the number she provided.

What result?

Prior to the Supreme Court’s Loper Bright decision the determination would be easy. The FCC held back in 2009 that providing a number in connection with a transaction permits autodialed calls to a consumer in connection with that transaction. And the Sixth Circuit Court of Appeals has directly held that providing a phone number on hospital intake documents permits later debt collection activity at that number–including via autodialer.

But the Loper Bright decision recently destroyed Chevron deference–meaning courts no longer have to yield to agency determinations of this sort. And while the Hobbs Act affords extra protections to certain FCC rulings, those protections only apply where certain procedural requirements were met by the Commission in adopting the rule.

So does the FCC’s rule from 2009 permitting informational calls to numbers provided in connection with a transaction still bind courts? According to the decision in Woodman v. Medicredit, 2024 WL 4132732 (D. Nv Sept. 9, 2024) the answer is yes!

In Woodman the defendant debt collector moved for summary judgment arguing the Plaintiff consented when she provided her number to the hospital. The Court had little problem applying the FCC’s 2009 order and precedent that came before Loper Bright to grant summary judgment to he defense. So just like that case is gone.

Great ruling for the defense, of course, and it makes me feel a bit better about the whole “no one knows what the law is anymore” thing, but the Woodman court didn’t really address the core issue– was the 2009 ruling enacted with sufficient APA pop and circumstance to merit Hobbs Act deference under PDR Resources.

Really interesting question and one folks should keep in mind.

FTC Announces Final Rule Imposing Civil Penalties for Fake Consumer Reviews and Testimonials

On August 14, 2024, the Federal Trade Commission announced a Final Rule combatting bogus consumer reviews and testimonials by prohibiting their sale or purchase. The Rule allows the FTC to strengthen enforcement, seek civil penalties against violators and deter AI-generated fake reviews.

“Fake reviews not only waste people’s time and money, but also pollute the marketplace and divert business away from honest competitors,” said FTC attorney Chair Lina M. Khan. “By strengthening the FTC’s toolkit to fight deceptive advertising, the final rule will protect Americans from getting cheated, put businesses that unlawfully game the system on notice, and promote markets that are fair, honest, and competitive.”

The Rule announced on August 14, 2024 follows an advance notice of proposed rulemaking and a notice of proposed rulemaking announced in November 2022 and June 2023, respectively. The FTC also held an informal hearing on the proposed rule in February 2024. In response to public comments, the Commission made numerous clarifications and adjustments to its previous proposal.

What Does the FTC Final on the Use of Consumer Reviews and Testimonials Prohibit?

The FTC Final Rule on the Use of Consumer Reviews and Testimonials prohibits:

Writing, selling, or buying fake or false consumer reviews.

The Rule prohibits businesses from writing or selling consumer reviews that misrepresent they are by someone who does not exist or who did not have actual experience with the business or its products or services, or that misrepresent the reviewers’ experience. It also prohibits businesses from buying consumer reviews that they knew or should have known made such a misrepresentation. Businesses are also prohibited from procuring from certain company insiders such reviews about the business or its products or services for posting on third-party sites, when the businesses knew or should have known about the misrepresentation. The prohibitions on buying or procuring reviews do not cover generalized review solicitations to past customers or simply hosting reviews on the business’s website. Neither will a retailer or other entity be liable for sharing consumer reviews unless it would have been liable for displaying those same reviews on its own website.

Writing, selling, or disseminating fake or false testimonials.

Businesses are similarly prohibited from writing or selling consumer or celebrity testimonials that make the same kinds of misrepresentations. The are also prohibited from disseminating or causing the dissemination of such testimonials when they knew or should have known about the misrepresentation. The prohibition on disseminating testimonials does not cover the type of generalized solicitations to past customers discussed above with respect to reviews.

Buying positive or negative reviews.

Businesses are prohibited from providing compensation or other incentives contingent on the writing of consumer reviews expressing a particular sentiment, either positive or negative. Violations here include situations in which such a contingency is express or implied. So, for example, while it prohibits offering $25 for a 5-star review, it also prohibits offering $25 for a review “telling everyone how much you love our product.”

Failing to make disclosures about insider reviews and testimonials.

The Rule prohibits a company’s officers and managers from writing reviews or testimonials about the business or its products or services without clearly disclosing their relationship. Businesses are also prohibited from disseminating testimonials by company insiders without clear disclosures, if the businesses knew or should have known of the relationship. A similar prohibition exists for officer or manager solicitations of reviews from their immediate relatives or from employees or agents of the business, and when officers or managers ask employees or agents to seek such reviews from relatives. For these various solicitations, the Rule is violated only if: (i) the officers or managers did not give instructions about making clear disclosures; (ii) the resulting reviews – either by the employees, agents, or the immediate relatives of the officers, managers, employees, or agents – appear without clear disclosures; and (iii) the officers or managers knew or should have known that such reviews appeared and failed to take steps to have those reviews either removed or amended to include clear disclosures. All of these prohibitions hinge on the undisclosed relationship being material to consumers. These disclosure provisions also clarify that they do not cover mere review hosting or generalized solicitations to past customers.

Deceptively claiming that company-controlled review websites are independent.

Businesses are prohibited from misrepresenting that websites or entities they control or operate are providing independent reviews or opinions, other than consumer reviews, about a category of businesses, products, or services that includes their own business, product, or service.

Illegally suppressing negative reviews.

The Rule prohibits using unfounded or groundless legal threats, physical threats, intimidation or public false accusations (when the accusation is made with knowledge that it is false or with reckless disregard as to its truth or falsity) to prevent the posting or cause the removal of all or part of a consumer review. Legal threats are “unfounded or groundless” if they are unwarranted by existing law or based on allegations that have no evidentiary support, according to the FTC. Also, if reviews on a marketer’s website have been suppressed based on their rating or negative sentiment, the Rule prohibits that business from misrepresenting that the reviews on a portion of its website dedicated to receiving and displaying such reviews represent most or all submitted reviews.

Selling and buying fake social media indicators.

The Rule prohibits the sale or distribution of fake indicators of social media influence, like fake followers or views. A “fake” indicator means one generated by a bot, a hijacked account, or that otherwise does not reflect a real individual’s or entity’s activities or opinions, according to the FTC. The Rule also bars anyone from buying or procuring such fake indicators. These prohibitions are limited to situations in which the violator knew or should have known that the indicators were fake and which involved misrepresentations of a person’s or company’s influence or importance for a commercial purpose.

The Rule does not specifically refer to AI. However, according to the FTC, these prohibitions cover situations when someone uses an AI tool to generate the deceptive content at issue.

According to the FTC, case-by-case enforcement without civil penalty authority might not be enough to deter clearly deceptive review and testimonial practices. The Supreme Court’s decision in AMG Capital Management LLC v. FTC has hindered the FTC’s ability to seek monetary relief for consumers under the FTC Act. The Rule is intended to enhance deterrence and strengthen FTC enforcement actions.

The Rule will become effective 60 days after the date it’s published in the Federal Register.

Takeaway: The FTC will aggressively enforce the new Rule. The agency has challenged illegal practices regarding bogus reviews and testimonials for quite some time. In addition to investigations and enforcement actions, the FTC has also issued guidance to help businesses to comply. According to the agency, online marketplaces and social media companies could and should do more when it comes to policing their platforms.

Recent Federal Developments, July 2024

TSCA/FIFRA/TRI

EPA’s Proposed NMP Risk Management Rule Includes Requirements To Protect Workers And Consumers: On June 15, 2024, the U.S. Environmental Protection Agency (EPA) issued a proposed rule under Section 6(a) of the Toxic Substances Control Act (TSCA) that would protect workers and consumers from exposure to N-methylpyrrolidone (NMP). 89 Fed. Reg. 51134. To address the identified unreasonable risk, EPA proposes to: prohibit the manufacture (including import), processing, distribution in commerce, and use of NMP in several occupational conditions of use (COU); require worker protections through an NMP workplace chemical protection program (WCPP) or prescriptive controls (including concentration limits) for most of the occupational COUs; require concentration limits on a consumer product; regulate certain consumer products to prevent commercial use; and establish recordkeeping, labeling, and downstream notification requirements. Comments are due July 29, 2024. Under the Paperwork Reduction Act (PRA), comments on the information collection provisions are best assured of consideration if the Office of Management and Budget (OMB) receives a copy of the comments on or before July 15, 2024. According to EPA’s June 5, 2024, press release, NMP is used to manufacture and produce many electronics, polymers, agricultural chemicals, and petrochemical products. EPA states that NMP is used in the production of specialized electronics, such as semiconductors and magnet wire, as well as lithium-ion batteries used in a wide variety of applications, including aerospace vehicles and electronic devices. EPA notes that NMP “also has numerous other industrial, commercial and consumer applications, including adhesives and sealants, paints and coatings, paint removers, lubricants, automotive care products, degreasers, cleaning and furniture care products.” For more information, please read the full memorandum.

EPA Announces Final Cancellation Order And Updates To Existing Stocks Provisions For Several Chlorpyrifos Products: On June 25, 2024, EPA announced the issuance of a final cancellation order for Corteva’s chlorpyrifos product “Dursban 50W in Water Soluble Packets” and three Gharda chlorpyrifos products, and an amendment to the existing stocks provisions for two Liberty and three Winfield chlorpyrifos end-use products. EPA also states that it has updated its frequently asked questions about chlorpyrifos. More information is available in our July 2, 2024, blog.

EPA Announces New Initiatives To Improve Efficiency, Worker Protections, And Transparency In New Chemical Reviews: During the June 26, 2024, “TSCA Reform — Eight Years Later” conference, presented by Bergeson & Campbell, P.C. (B&C^®), the Environmental Law Institute (ELI), and the George Washington University Milken Institute School of Public Health, Michal Ilana Freedhoff, Ph.D., Assistant Administrator, Office of Chemical Safety and Pollution Prevention, EPA, provided the keynote address. During her remarks, Freedhoff announced four new initiatives in EPA’s review of new chemicals under TSCA. As later announced by EPA, these initiatives are:

Engineering checklist: In May 2024, EPA began implementing an internal engineering checklist to review systematically new chemical submissions and identify potential data gaps at the beginning of the review process.
Worker protections: According to EPA, most TSCA Section 5(e) orders are consent orders negotiated between EPA and the notice submitter that use standard “boilerplate” text. In June 2024, EPA updated the boilerplate language to strengthen worker protections and provide further clarity to the text.
Updated statistics for new chemical review timelines: On June 26, 2024, EPA began including completed “rework” risk assessments when reporting monthly statistics on new chemical reviews. EPA has updated its Statistics for the New Chemicals Program under TSCA web page to include a category listing all completed rework risk assessments since the beginning of 2024.
Reference Library: On June 26, 2024, EPA launched the New Chemicals Division Reference Library, an index of EPA documents related to the work of the New Chemicals Division. It currently contains over 90 entries, and EPA will update it as it develops new materials.

More information is available in our June 26, 2024, blog item. A summary of the conference is available in our July 9, 2024, memorandum.

EPA Postpones Proposed Expansion Of The Safer Choice And DfE Programs: As reported in our July 27, 2023, memorandum, in July 2023, EPA proposed an expansion of the Safer Choice and Design for the Environment (DfE) programs to include certification of additional product categories. According to EPA’s website, “EPA thanks the many commenters for their input. EPA reviewed the comments and understands several categories are of interest to stakeholders and Safer Choice partners. With the 2024 decrease in EPA’s funding, however, EPA is not able to pursue expansion at this time. EPA plans to reconsider the expansion in the future as resources allow.” On June 28, 2024, a summary of comments received on EPA’s proposed expansion was posted in the online docket. More information is available in our July 5, 2024, blog item.

EPA Releases Draft Risk Evaluation For 1,1-Dichloroethane And Draft Hazard Assessment Of 1,2-Dichloroethane For Public Comment And Peer Review: On July 1, 2024, EPA announced the release of the draft risk evaluation for 1,1-dichloroethane and the draft human health hazard assessment supporting the draft risk evaluation for 1,2-dichloroethane (also known as ethylene dichloride) prepared under TSCA. EPA states that it “preliminarily determined 1,1-dichloroethane poses unreasonable risk to human health (of workers) and the environment.” According to EPA, the effects to people from exposure to 1,1-dichloroethane and 1,2-dichlorethane are “kidney and other cancers, as well as harmful non-cancer renal, nasal, immune system, and reproductive effects.” Publication of a notice of availability in the Federal Register will begin a 60-day comment period. More information will be available in a forthcoming memorandum.

Court Vacates TSCA Section 4 Test Order, Grant’s Vinyl Institute’s Petition For Review: On July 5, 2024, the U.S. Court of Appeals for the District of Columbia Circuit issued its decision in Vinyl Institute, Inc. v. EPA (No. 22-1089). As reported in our May 31, 2022, blog item, on May 23, 2022, the Vinyl Institute, Inc. (VI) filed suit against EPA, seeking review of EPA’s March 2022 test order for 1,1,2-trichloroethane issued under TSCA Section 4(a)(2). The court states that “EPA’s non-public part of the administrative record is not part of ‘the record taken as a whole’ subject to our heightened substantial evidence review of TSCA test orders.” According to the court, to the extent EPA relies on non-public portions of the administrative record, it “has failed to provide substantial evidence that meets its statutory mandate.” The court vacated the test order, remanding to EPA to satisfy that mandate with “substantial evidence in the record taken as a whole.” The court also denied VI’s motion to supplement the record “with scientific information it could have — and should have — submitted earlier.” More information is available in our July 10, 2024, blog item.

EPA Publishes Compliance Guide For Final Methylene Chloride Risk Management Rule: On July 10, 2024, EPA published a compliance guide for its final methylene chloride risk management rule issued under TSCA. According to EPA, the compliance guide will help industry, workers, and other interested stakeholders understand and comply with the new regulations to prevent injuries, long-term illnesses, and deaths. EPA also announced that in June 2024, it released a fact sheet on the rule containing information on who is subject to the rule along with a summary of compliance timelines. More information will be available in a forthcoming memorandum.

EPA Grants TSCA Section 21 Petition Seeking Section 6 Rule Prohibiting Three PFAS Found In Fluorinated Plastic Containers: EPA announced on July 11, 2024, that it granted a petition filed a petition under TSCA Section 21 requesting that EPA establish regulations under TSCA Section 6 prohibiting the manufacturing, processing, use, distribution in commerce, and disposal of three per- and polyfluoroalkyl substances (PFAS) formed during the fluorination of plastic containers. EPA “will promptly commence an appropriate proceeding under TSCA Section 6.” According to EPA’s announcement, EPA intends to request information, including the number, location, and uses of fluorinated containers in the United States; alternatives to the fluorination process that generates perfluorooctanoic acid (PFOA), perfluorononanoic acid (PFNA), and perfluorodecanoic acid (PFDA); and measures to address risk from PFOA, PFNA, and PFDA formed during the fluorination of plastic containers. More information will be available in a forthcoming memorandum.

EPA’s Spring 2024 Unified Agenda Includes Proposed And Final TSCA, TRI, And PFAS Rules: EPA’s Spring 2024 Unified Agenda, published on July 5, 2024, includes a number of proposed and final TSCA, Toxics Release Inventory (TRI), and PFAS rulemakings. More information on the rulemakings, including links to our memoranda, will be available in an upcoming blog item.

RCRA/CERCLA/CWA/CAA/PHMSA/SDWA

EPA Publishes 2024-2027 Climate Adaptation Plan: EPA announced on June 20, 2024, the release of its 2024-2027 Climate Adaptation Plan, which describes Agency actions to address the impacts of climate change and help build a more climate-resilient nation. Highlights include:

Fostering a climate-ready workforce;
Building facility resilience;
Developing climate-resilient supply chains;
Integrating climate resilience into external funding opportunities;
Applying climate data and tools to decision making; and
Integrating climate adaptation into rulemaking processes.

EPA Amends Standards And Practices For All Appropriate Inquiries: EPA issued a final rule on June 24, 2024, amending the “Standards and Practices for All Appropriate Inquiries” to reference a standard practice recently made available by ASTM International, “a widely recognized standards development organization.” 89 Fed. Reg. 52386. EPA states that it is amending the All Appropriate Inquiries Rule to reference ASTM International’s E2247-23 “Standard Practice for Environmental Site Assessments: Phase I Environmental Site Assessment Process for Forestland or Rural Property” and allow for its use to satisfy the requirements for conducting all appropriate inquiries under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). In addition, after one year, EPA will remove recognition of the previous version of that standard, ASTM E2247-16, as compliant with the All Appropriate Inquiries Rule. The final rule will be effective August 23, 2024.

EPA Proposes To Remove Affirmative Defense Provisions From Specified NSPS And NESHAP: On June 24, 2024, EPA proposed amendments to several New Source Performance Standards (NSPS) and National Emission Standards for Hazardous Air Pollutants (NESHAP) under the Clean Air Act (CAA). 89 Fed. Reg. 52425. Specifically, EPA proposes to remove the affirmative defense provisions associated with violation of emission standards due to malfunctions. According to EPA, it proposes to remove these provisions because they are inconsistent with a D.C. Circuit Court decision that vacated affirmative defense provisions in one of EPA’s CAA regulations, and because EPA finds that the reasoning in the decision applies equally to other CAA rules. Since the court decision, EPA has been removing affirmative defense provisions from CAA rules when they were otherwise revised or amended. EPA states that this action “proposes to remove the remaining affirmative defense provisions more efficiently.” Comments are due August 8, 2024.

PHMSA Amends HMR To Require Real-Time Train Consistent Information In Electronic Form: The Pipeline and Hazardous Materials Safety Administration (PHMSA) published a final rule on June 24, 2024, amending the Hazardous Materials Regulations (HMR) to require railroads that carry hazardous materials to generate in electronic form, maintain, and provide to first responders, emergency response officials, and law enforcement personnel certain information regarding hazardous materials in rail transportation to enhance emergency response and investigative efforts. 89 Fed. Reg. 52956. According to PHMSA, the amendments address a safety recommendation of the National Transportation Safety Board and statutory mandates in The Fixing America’s Surface Transportation Act, as amended by the Infrastructure, Investment, and Jobs Act, and complement existing regulatory requirements pertaining to the generation, maintenance, and provision of similar information in hard copy form, as well as other hazard communication requirements. The effective date of the final rule is July 24, 2024. The voluntary compliance date was June 24, 2024. The delayed compliance date for Class I Railroads is June 24, 2025, and for Class II and III Railroads is June 24, 2026.

EPA Proposes To Extend Compliance Date For Installation Of Certain Variable Refrigerant Flow Systems: On June 26, 2024, EPA proposed to amend a provision of the Technology Transitions regulations promulgated under the American Innovation and Manufacturing Act. 89 Fed. Reg. 53373. The proposed amendment would allow one additional year, until January 1, 2027, solely for the installation of new residential and light commercial air conditioning and heat pump variable refrigerant flow systems that are 65,000 British thermal units per hour or greater using components manufactured in the United States or imported prior to January 1, 2026. According to EPA, the existing January 1, 2026, compliance date for the installation of certain variable refrigerant flow systems “may result in significant stranded inventory that was intended for new construction. EPA is promulgating this action to mitigate the potential for significant stranded inventory in this subsector.” Comments are due July 26, 2024.

PHMSA Requests Feedback On De Minimis Quantities Of Explosives: PHMSA published a request for information (RFI) on June 28, 2024, to solicit information from hazardous materials (HAZMAT) shippers pertaining to what small quantities or low concentrations of explosives they offer for transport appear to present a low risk to life, property, and the environment. 89 Fed. Reg. 54157. PHMSA seeks to determine what small quantities or low concentrations of explosives HAZMAT shippers offer for transport that appear to present a low risk (e.g., negligible severity, remote probability) to life, property, and the environment. PHMSA will use the information to define the focus of a research project investigating the risk of small and/or de minimis quantities of explosive substances and in selecting test samples for PHMSA research and development Contract# 693JK322C00003. Comments are due September 26, 2024. PHMSA states that it will consider comments received after that date to the extent possible.

EPA Determines Current NESHAP For PQBS Source Category Provides “Ample Margin Of Safety”: On July 5, 2024, EPA published a final rule regarding the residual risk and technology review conducted for the NESHAP for the Coke Ovens: Pushing, Quenching, and Battery Stacks (PQBS) source category and the periodic technology review for the Coke Oven Batteries (COB) source category NESHAP. 89 Fed. Reg. 55684. EPA states that it is issuing a final determination that risks due to emissions of hazardous air pollutants (HAP) from the PQBS source category are acceptable and that “the current NESHAP provides an ample margin of safety to protect public health.” The final rule was effective July 5, 2024, except for amendatory instruction 3, which was effective July 15, 2024. The incorporation by reference (IBR) of certain publications listed in the rule is approved by the Director of the Federal Register beginning July 5, 2024. The IBR of certain other material listed in the rule was approved by the Director of the Federal Register as of July 13, 2005.

EPA Releases Science-Based Recommendations To Help Reduce Exposure To Contaminants, Including PFAS, In Fish: EPA announced on July 11, 2024, that it issued updated recommendations under the Clean Water Act (CWA) for contaminants that states, Tribes, and territories should consider monitoring in locally caught, freshwater fish. According to EPA, for the first time, it has added several PFAS to the contaminant list alongside lead, three cyanotoxins, a flame retardant, and amphetamine. With this announcement, EPA suggests that states, Tribes, and territories monitor for these contaminants. EPA notes that this update comes after reviewing scientific literature, analyzing data, and seeking external peer review of the Agency’s analysis, and it will help ensure that state and Tribal fish advisories consider the latest science.

FDA

FDA Updates Resources For FSMA Rule: On June 27, 2024, the U.S. Food and Drug Administration (FDA) released additional resources to help industry comply with the Food Traceability Rule, a component of the Food Safety Modernization Act (FSMA). Resources include a template spreadsheet to help fulfill data submission requests and minor revisions to the Food Traceability List. Additional information is available at the link here.

FDA Releases Update For Priority Guidance Topic List: On June 28, 2024, FDA provided an update for its priority guidance topic list, which was released in January. Since January, FDA has issued the following guidance documents:

FDA notes that its “intent is to publish all draft and final guidance topics on the list” but that “modifications in plans may be needed to support emerging issues and Administration priorities.”

FDA Revokes Authorization For Brominated Vegetable Oil: On July 3, 2024, FDA amended its regulations to revoke the authorization for the use of brominated vegetable oil (BVO) in food. 89 Fed. Reg. 55040. The final rule revokes the authorization for the use of BVO as a food ingredient intended to stabilize flavoring oils in fruit-flavored beverages. FDA notes that there are no other FDA authorized uses. The rule is effective on August 2, 2024.

NANOTECHNOLOGY

ECHA Evaluating Function Of EUON; Survey Closed July 3, 2024: The European Chemicals Agency (ECHA) is evaluating the function of the European Union (EU) Observatory for Nanomaterials (EUON). As part of its evaluation, ECHA conducted a survey to collect responses from EUON website visitors and stakeholders. The survey closed July 3, 2024. More information is available in our June 24, 2024, blog item.

ECHA Updates Report On Key Areas Of Regulatory Challenge, Addresses Micro- And Nano-Sized Materials: On June 12, 2024, ECHA announced that it updated its report on key areas of regulatory challenge, providing more detailed information on areas where scientific research is needed to protect human health and the environment from hazardous chemicals. The report addresses micro- and nano-size materials. More information is available in our June 17, 2024, blog item.

NIOSH Highlights NTRC’s Work On Engineering Controls And PPE: On July 1, 2024, the National Institute for Occupational Safety and Health (NIOSH) posted a NIOSH Science Blog item entitled “Celebrating 20 Years of the Nanotechnology Research Center: Highlights from Engineering Controls and Personal Protective Equipment,” part of a series commemorating the 20th anniversary of the Nanotechnology Research Center (NTRC). NIOSH researchers plan to develop a new reliable aerosol testing method that can accurately evaluate the respirator penetration against workplace nanomaterials; evaluate the effectiveness of NIOSH-approved^® respirators to determine whether existing respirator guidelines apply to workers exposed to nanomaterials; and compare nanomaterial penetrations determined by direct-reading and elemental carbon analysis methods. More information is available in our July 5, 2024, blog item.

NNI And NNCO Will Hold July 24 Workshop On “Responsible Development, Social Science, And The National Nanotechnology Initiative”: The National Nanotechnology Initiative (NNI) and the National Nanotechnology Coordination Office (NNCO) are convening a July 24, 2024, workshop, “Responsible Development, Social Science, and the National Nanotechnology Initiative: A Workshop to Explore Past and Future Intersections.” The agenda includes a presentation about the recently released “Blueprint for the Use of Social and Behavioral Science to Advance Evidence-Based Policymaking,” introductions to key nanotechnology case studies by federal experts, and flash talks by social scientists. More information is available in our July 3, 2024, blog item.

BIOBASED/RENEWABLE PRODUCTS/SUSTAINABILITY

B&C^® Biobased And Sustainable Chemicals Blog: For access to a summary of key legislative, regulatory, and business developments in biobased chemicals, biofuels, and industrial biotechnology, go to https://www.lawbc.com/brand/bioblog/.

LEGISLATIVE

House Appropriations Committee Approves FY 2025 Interior, Environment, And Related Agencies Appropriations Act: The House Appropriations Committee announced on July 9, 2024, that it approved the Fiscal Year (FY) 2025 Interior, Environment, and Related Agencies Appropriations Act by a vote of 29 to 25. According to the press release, the bill:

Ensures chemical and pesticide manufacturers are not overburdened with requirements that would drive business overseas and threaten American competitiveness;
Blocks EPA’s car regulations on light, medium, and heavy-duty vehicles;
Prohibits EPA from allowing California to require that new small off-road engines, such as lawn care equipment, be zero-emission;
Prohibits funds for EPA’s Clean Power Plan 2.0 and regulatory overreach regarding ozone emissions and steam electric power plants;
Reduces funding for EPA by 20 percent;
Reduces funding for the Council on Environmental Quality to the authorized level of $1 million;
Rejects eight of the Administration’s climate change executive orders; and
Prohibits agencies from using the Social Cost of Carbon (SCC) in cost-benefit analyses and blocks the Interagency Working Group on Social Cost of Greenhouse Gases.

House Committee Holds EPA Oversight Hearing On July 10, 2024: The House Committee on Oversight and Accountability held a full committee hearing on July 10, 2024, on “Oversight of the U.S. Environmental Protection Agency.” The Committee’s July 3, 2024, press release quotes Committee Chair James Comer (R-KY) as stating: “We know the Biden Administration is overreaching its environmental protection authorities extensively, flouting the limits the Supreme Court set upon them two years ago in West Virginia v. EPA and adopting statutory interpretations that surely will not pass muster under the Court’s recent decision in Loper Bright Enterprises v. Raimondo. The Committee looks forward to holding the agency accountable next week for its efforts to cement Green New Deal and other misguided priorities that have hurt both American businesses and consumers across the country.” More information will be available in a forthcoming memorandum.

MISCELLANEOUS

California Court Grants Injunction To Stop Prop 65 Warnings For Titanium Dioxide In Cosmetic And Personal Care Products: On June 12, 2024, the U.S. District Court for the Eastern District of California (District Court) issued an Order granting a preliminary injunction brought by the Personal Care Products Council (PCPC), which alleged that the California Office of Environmental Health Hazard Assessment’s (OEHHA) requirement for warnings under Proposition 65 (Prop 65) related to titanium dioxide in cosmetics and personal care products violated the First Amendment. The Personal Care Products Council v. Bonta, No. 2:23-cv-01006-TLN-JDP (E.D. Cal. 2024). In its Order, the District Court enjoined the California Attorney General and any private citizen enforcers from enforcing Prop 65’s warning requirement for “cancer as applied to Listed Titanium Dioxide (i.e., titanium dioxide that consists of airborne, unbound particles of respirable size) in cosmetic and personal care products.” The District Court also denied a motion to intervene by Environmental Health Advocates, Inc. (EHA), who had argued it was “an interested party because it is the primary enforcer of Prop 65.” For more information, please read the full memorandum.

Proposition 65: OEHHA Proposes Additional Changes To “Short-Form” Warning Option: On June 14, 2024, the California OEHHA issued a notice proposing additional changes to its Prop 65 Article 6 “clear and reasonable warnings” regulations for “short-form” warnings (Notice). The changes proposed now are to the proposed regulations that OEHHA issued on October 27, 2023. The history of these amendments, dating back to January 2021, are set forth in our memorandum available here. Written comments on the proposed changes were due no later than June 28, 2024. More information is available in our July 5, 2024, memorandum.

June 2024 IRIS Program Outlook Released: EPA’s Health and Environmental Risk Assessment (HERA) Program announced on June 27, 2024, the release of the June 2024 Integrated Risk Information System (IRIS) Program Outlook. To maintain transparency, the IRIS Program provides an updated outlook of program activities. The IRIS Program Outlook describes assessments that are in development and projected public milestone dates.

Registration Opens For July Webinars On Minnesota’s PFAS In Products Law; MPCA Publishes Summary Of Comments On CUUs: The Minnesota Pollution Control Agency (MPCA) will hold two public webinars in July to provide updates and answer questions on Minnesota’s PFAS in products law (Amara’s Law), which takes effect in stages between 2025 and 2032:

Progress on rule development, July 18, 2024, 10:00 a.m. – 11:30 a.m. (CDT): Join MPCA staff for a presentation on preliminary rule writing for the PFAS in products reporting, fees, and currently unavoidable use (CUU) rules. Registration is open.
Information on 2025 prohibitions for retailers and manufacturers, July 25, 2024, 11:00 a.m. – 12:00 p.m. (CDT): This webinar will discuss how the 2025 PFAS in products prohibitions will affect retailers and manufacturers starting January 1, 2025, when 11 categories of consumer products must be free of intentionally added PFAS. Registration is open.

As reported in our January 12, 2024, blog item, MPCA published a request for comments (RFC) on planned new rules governing CUU determinations for products containing PFAS. According to the RFC, the main purpose of the rulemaking is to establish criteria and processes through which MPCA will make decisions on what uses of intentionally added PFAS will qualify as CUUs in products sold, offered for sale, or distributed in Minnesota. Any such determinations must be published by rule by MPCA by January 1, 2032. MPCA has posted a summary of the comments received on the RFC. More information is available in our June 24, 2024, blog item.

Minnesota Department Of Health Highlights Recent Publications On PFAS Bioaccumulation And PFAS In Infant Formula: The Minnesota Department of Health (MDH) recently noted that Health Risk Assessment scientists at MDH have published two articles in the Journal of Environmental Exposure Assessment related to PFAS:

OIRA Will Offer Training Sessions On Effective Participation In The Public Comment Process: As part of its efforts to strengthen public engagement in the federal regulatory process, the Office of Information and Regulatory Affairs (OIRA) in OMB announced on July 10, 2024, that it will offer training sessions on effective public participation in the public comment process. 89 Fed. Reg. 56777. In response to feedback received from the public and as part of its ongoing efforts to strengthen public participation in the regulatory process, OIRA will hold two training sessions on effective participation in the public comment process. During the training sessions, OIRA will describe opportunities to provide comment in the federal regulatory process; how to submit public comments; and how to draft effective public comments. The training sessions will be held on July 18, 2024, from 3:00 p.m. to 3:45 p.m. (EDT) and July 24, 2024, from 5:30 p.m. to 6:15 p.m. (EDT).

CISA Hosts 2024 Chemical Security Seminars On July 11 And 18, 2024: The U.S. Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is hosting the fully virtual 2024 Chemical Security Seminars on July 11 and July 18, 2024, from 10:00 a.m. – 3:00 p.m. (EDT). The sessions will cover a range of topics related to the security of dangerous chemicals. More information is available in our July 8, 2024, blog item.

Comments On Canada’s Updated Draft State Of PFAS Report And Revised Risk Management Scope Are Due September 11, 2024: The July 13, 2024, Canada Gazette includes a notice announcing the availability of the Updated Draft State of Per- and Polyfluoroalkyl Substances (PFAS) Report (Updated Draft Report) and Revised Risk Management Scope for Per- and Polyfluoroalkyl Substances (PFAS) (Revised Risk Management Scope). The Minister of the Environment and the Minister of Health (the ministers) propose to recommend that the class of PFAS, excluding fluoropolymers, be added to Part 2 of Schedule 1 of the Canadian Environmental Protection Act, 1999 (CEPA). According to the Revised Risk Management Scope, Canada is considering:

As a first step, a regulatory instrument under CEPA to restrict PFAS not currently regulated in firefighting foams; and
Additional regulatory instrument(s) under CEPA to prohibit other uses or sectors in relation to PFAS. Prioritization for prohibition may be based on factors such as socioeconomic considerations, the availability of feasible alternatives, and the potential for human and environmental exposure.

The Revised Risk Management Scope states that “[v]oluntary risk management actions are also being considered to achieve early results to reduce releases of PFAS, as a complement to the proposed regulatory instruments.” Comments are due September 11, 2024. More information is available in our July 12, 2024, blog item.

On July 1, 2024, Texas May Have the Strongest Consumer Data Privacy Law in the United States

It’s Bigger. But is it Better?

They say everything is bigger in Texas which includes big privacy protection. After the Texas Senate approved HB 4 — the Texas Data Privacy and Security Act (“TDPSA”), on June 18, 2023, Texas became the eleventh state to enact comprehensive privacy legislation.^[1]

Like many state consumer data privacy laws enacted this year, TDPSA is largely modeled after the Virginia Consumer Data Protection Act.^[2] However, the law contains several unique differences and drew significant pieces from recently enacted consumer data privacy laws in Colorado and Connecticut, which generally include “stronger” provisions than the more “business-friendly” laws passed in states like Utah and Iowa.

Some of the more notable provisions of the bill are described below:

More Scope Than You Can Shake a Stick At!

The TDPSA applies much more broadly than any other pending or effective state consumer data privacy act, pulling in individuals as well as businesses regardless of their revenues or the number of individuals whose personal data is processed or sold.
The TDPSA applies to any individual or business that meets all of the following criteria:
- conduct business in Texas (or produce goods or services consumed in Texas) and,
- process or sell personal data:
  - The “processing or sale of personal data” further expands the applicability of the TDPSA to include individuals and businesses that engage in any operations involving personal data, such as the “collection, use, storage, disclosure, analysis, deletion, or modification of personal data.”
  - In short, collecting, storing or otherwise handling the personal data of any resident of Texas, or transferring that data for any consideration, will likely meet this standard.
Uniquely, the carveout for “small businesses” excludes from coverage those entities that meet the definition of “a small business as defined by the United States Small Business Administration.”^[3]
The law requires all businesses, including small businesses, to obtain opt-in consent before processing sensitive personal data.
Similar to other state comprehensive privacy laws, TDPSA excludes state agencies or political subdivisions of Texas, financial institutions subject to Title V of the Gramm-Leach-Bliley Act, covered entities and business associates governed by HIPAA, nonprofit organizations, and institutions of higher education. But, TDPSA uniquely excludes electric utilities, power generation companies, and retail electric providers, as defined under Section 31.002 of the Texas Utilities Code.
Certain categories of information are also excluded, including health information protected by HIPAA or used in connection with human clinical trials, and information covered by the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act of 1974, the Farm Credit Act of 1971, emergency contact information used for emergency contact purposes, and data necessary to administer benefits.

Don’t Mess with Texas Consumers

Texas’s longstanding libertarian roots are evidenced in the TDPSA’s strong menu of individual consumer privacy rights, including the right to:

Confirm whether a controller is processing the consumer’s personal data and accessing that data;
Correct inaccuracies in the consumer’s personal data, considering the nature of the data and the purposes of the processing;
Delete personal data provided by or obtained about the consumer;
Obtain a copy of the consumer’s personal data that the consumer previously provided to a controller in a portable and readily usable format, if the data is available digitally and it is technically feasible; and
Opt-out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces legal or similarly significant legal effects concerning the consumer.

Data controllers are required to respond to consumer requests within 45 days, which may be extended by 45 days when reasonably necessary. The bill would also give consumers a right to appeal a controller’s refusal to respond to a request.

Controller Hospitality

The Texas bill imposes a number of obligations on data controllers, most of which are similar to other state consumer data privacy laws:

Data Minimization – Controllers should limit data collection to what is “adequate, relevant, and reasonably necessary” to achieve the purposes of collection that have been disclosed to a consumer. Consent is required before processing information in ways that are not reasonably necessary or not compatible with the purposes disclosed to a consumer.
Nondiscrimination – Controllers may not discriminate against a consumer for exercising individual rights under the TDPSA, including by denying goods or services, charging different rates, or providing different levels of quality.
Sensitive Data – Consent is required before processing sensitive data, which includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, citizenship or immigration status, genetic or biometric data processed for purposes of uniquely identifying an individual; personal data collected from a child known to be under the age of 13, and precise geolocation data.
- The Senate version of the bill excludes data revealing “sexual orientation” from the categories of sensitive information, which differs from all other state consumer data privacy laws.
Privacy Notice – Controllers must post a privacy notice (e.g. website policy) that includes (1) the categories of personal data processed by the controller (including any sensitive data), (2) the purposes for the processing, (3) how consumers may exercise their individual rights under the Act, including the right of appeal, (4) any categories of personal data that the controller shares with third parties and the categories of those third parties, and (5) a description of the methods available to consumers to exercise their rights (e.g., website form or email address).
Targeted Advertising – A controller that sells personal data to third parties for purposes of targeted advertising must clearly and conspicuously disclose to consumers their right to opt-out.

Assessing the Privacy of Texans

Unlike some of the “business-friendly” privacy laws in Utah and Iowa, the Texas bill requires controllers to conduct data protection assessments (“Data Privacy Protection Assessments” or “DPPAs) for certain types of processing that pose heightened risks to consumers. The assessments must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the consumer as mitigated by any safeguards that could reduce those risks. In Texas, the categories that require assessments are identical to those required by Connecticut’s consumer data privacy law and include:

Processing personal data for targeted advertising;
The sale of personal data;
Processing personal data for profiling consumers, if such profiling presents a reasonably foreseeable risk to consumers of unfair or deceptive treatment, disparate impact, financial, physical or reputational injury, physical or other intrusion upon seclusion of private affairs, or “other substantial injury;”
Processing of sensitive data; and
Any processing activities involving personal data that present a “heightened risk of harm to consumers.”

Opting Out and About

Businesses are required to recognize a universal opt-out mechanism for consumers (or, Global Privacy Control signal), similar to provisions required in Colorado, Connecticut, California, and Montana, but it would also allow businesses more leeway to ignore those signals if it cannot verify the consumers’ identity or lacks the technical ability to receive it.

Show Me Some Swagger!

The Attorney General has the exclusive right to enforce the law, punishable by civil penalties of up to $7,500 per violation. Businesses have a 30-day right to cure violations upon written notice from the Attorney General. Unlike several other laws, the right to cure has no sunset provision and would remain a permanent part of the law. The law does not include a private right of action.

Next Steps for TDPSA Compliance

For businesses that have already developed a state privacy compliance program, especially those modeled around Colorado and Connecticut, making room for TDPSA will be a streamlined exercise. However, businesses that are starting from ground zero, especially “small businesses” defined in the law, need to get moving.

If TDPSA is your first ride in a state consumer privacy compliance rodeo, some first steps we recommend are:

Update your website privacy policy for facial compliance with the law and make sure that notice is being given at or before the time of collection.
Put procedures in place to respond to consumer privacy requests and ask for consent before processing sensitive information
Gather necessary information to complete data protection assessments.
Identify vendor contracts that should be updated with mandatory data protection terms.

Footnotes

[1] As of date of publication, there are now 17 states that have passed state consumer data privacy laws (California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Massachusetts, Montana, New Jersey, New Hampshire, Tennessee, Texas, Utah, Virginia) and two (Vermont and Minnesota) that are pending.

[2] See, Code of Virginia Code – Chapter 53. Consumer Data Protection Act

[3] This is notably broader than other state privacy laws, which establish threshold requirements based on revenues or the amount of personal data that a business processes. It will also make it more difficult to know what businesses are covered because SBA definitions vary significantly from one industry vertical to another. As a quick rule of thumb, under the current SBA size standards, a U.S. business with annual average receipts of less than $2.25 million and fewer than 100 employees will likely be small, and therefore exempt from the TDPSA’s primary requirements.

For more news on State Privacy Laws, visit the NLR Consumer Protection and Communications, Media & Internet sections.

FTC Issues Report to Congress Highlighting Collaboration with State Attorneys General

On April 10, 2024, the Federal Trade Commission issued a report to Congress on the agency’s collaboration with state attorneys general highlighting current cooperative law enforcement efforts, best practices to ensure continued collaboration and legislative recommendations to enhance such efforts.

The report, directed by the FTC Collaboration Act of 2021, “Working Together to Protect Consumers: A Study and Recommendations on FTC Collaboration with the State Attorneys General” makes legislative recommendations that would enhance these efforts, including reinstating the Commission’s authority to seek money for defrauded consumers and providing it with the independent authority to seek civil penalties.

“Today’s consumer protection challenges require an all-hands-on-deck response, and our report details how the FTC is working closely with state enforcers to share information, stop fraud, and ensure fairness in the marketplace,” said FTC attorney Samuel Levine, Director of the Bureau of Consumer Protection. “We look forward to seeking new opportunities to strengthen these ties and confront the challenges of the future.”

In June 2023, the Commission announced a request for public information (RFI) seeking public comments and suggestions on ways it can work more effectively with state AGs to help educate consumers about, and protect them from, potential fraud. After reviewing and analyzing the comments received, the agency developed the report to Congress issued today. The report is divided into three sections: 1) The FTC’s Existing Collaborative Efforts with State
Attorneys General to Prevent, Publicize, and Penalize Frauds and Scams; 2) Recommended Best Practices to Enhance Collaboration; and 3) Legislative Recommendations to Enhance Collaboration Efforts.

The first section lays out the roles and responsibilities of the FTC and state AGs in protecting consumers from frauds and scams, provides an overview of their respective law enforcement authority, and discusses how federal and state enforcers share their information and expertise to facilitate effective communication and cooperation. It also provides a breakdown of the FTC’s
structure and a description of the Consumer Sentinel consumer complaint database, the largest such information-sharing network in the United States.

The second section details best practices used to enhance strong information-sharing between the FTC and its state law enforcement partners, discusses how the Commission coordinates joint and parallel enforcement actions with state AGs and other state consumer protection agencies, and presents ideas on expanding the sharing of expertise and technical resources between agencies.

Finally, the third section stresses the legislative need to restore the FTC’s Section 13(b) authority to seek equitable monetary refunds for injured consumers, presents ways to enhance collaboration and conserve resources by providing the FTC with the independent authority to seek civil penalties, and describes the agency’s need for clear authority to pursue legal actions against those who assist and facilitate unfair or deceptive acts or practices.

The Commission vote approving the report to Congress was 3-0-2, with Commissioners Melissa Holyoak and Andrew N. Ferguson not participating. Chair Lina M. Khan issued a separate statement, in which she was joined by Commissioners Rebecca Kelly Slaughter and Alvaro M. Bedoya. Commissioner Slaughter also issued a separate statement.

California PFAS Ban in Products: 6th Largest Global Economy Enters the Fray

We reported extensively on the landmark legislation passed in Maine in 2021 and Minnesota in 2023, which were at the time the most far-reaching PFAS ban in the United States. Other states, including Massachusetts and Rhode Island, have subsequently introduced legislation similar to Maine and Minnesota’s regulations. While we have long predicted that the so-called “all PFAS / all products” legislative bans will become the trend at the state levels, it is significant to note that California, the world’s sixth largest economy, recently introduced a similar proposed PFAS ban for consumer products.

The California proposed legislation, coupled with the existing legislation passed or on the table, will have enormous impacts on companies doing business in or with the state of California, as well as on likely future consumer goods personal injury lawsuits. The California PFAS ban must therefore not be overlooked in companies’ compliance and product development departments.

California PFAS Ban

California’s SB 903 in its current form would prohibit for sale (or offering for sale) any products that contain intentionally added PFAS. A “product” is defined as “an item manufactured, assembled, packaged, or otherwise prepared for sale in California, including, but not limited to, its components, sold or distributed for personal, residential, commercial, or industrial use, including for use in making other products.” It further defines “component” as “an identifiable ingredient, part, or piece of a product, regardless of whether the manufacturer of the product is the manufacturer of the component.”

While the effective date of SB 903’s prohibition would be January 1, 2030, the bill gives the California Department of Toxic Substances Control (“DTSC”) the authority to prohibit intentionally added PFAS in a product before the 2030 effective date. It also allows DTSC to categorize PFAS in a product as an “unavoidable use”, thereby effectively creating an exemption to the bill’s ban, although California exemption would be limited to five years in duration. Similar carve outs were also included in the Maine and Minnesota bans. In each instance, certain information must be provided to the state to obtain an “unavoidable use” exemption. In California, an “unavoidable use” exemption would only be granted if:

There are no safer alternatives to PFAS that are reasonably available.
The function provided by PFAS in the product is necessary for the product to work.
The use of PFAS in the product is critical for health, safety, or the functioning of society.

If a company sells a products containing PFAS in the state of California in violation of the proposed law, companies would be assessed a $1,000 per day penalty for each violation, a maximum of $2,500 per day for repeat offenders, and face possible Court-ordered prohibition of sales for violating products.

Implications To Businesses From The Minnesota PFAS Legislation

First and foremost of concern to companies is the compliance aspect of the California law. The state continues to modify and refine key definitions of the regulation, resulting in companies needing to consider the wording implications on their reporting requirements. In addition, some companies find themselves encountering supply chain disclosure issues that will impact reporting to the state of California, which raises the concern of accuracy of reporting by companies. Companies and industries are also very concerned that the information that is being gathered will provide a legacy repository of valuable information for plaintiffs’ attorneys who file future products liability lawsuits for personal injury, not only in the state of California, but in any state in which the same products were sold.

It is of the utmost importance for businesses along the whole supply chain to evaluate their PFAS risk. Public health and environmental groups urge legislators to regulate these compounds. One major point of contention among members of various industries is whether to regulate PFAS as a class or as individual compounds. While each PFAS compound has a unique chemical makeup and impacts the environment and the human body in different ways, some groups argue PFAS should be regulated together as a class because they interact with each other in the body, thereby resulting in a collective impact. Other groups argue that the individual compounds are too diverse and that regulating them as a class would be over restrictive for some chemicals and not restrictive enough for others.

Companies should remain informed so they do not get caught off guard. Regulators at both the state and federal level are setting drinking water standards and notice requirements of varying stringency, and states are increasingly passing PFAS product bills that differ in scope. For any manufacturers, especially those who sell goods interstate, it is important to understand how those various standards will impact them, whether PFAS is regulated as individual compounds or as a class. Conducting regular self-audits for possible exposure to PFAS risk and potential regulatory violations can result in long term savings for companies and should be commonplace in their own risk assessment.

Multistate Coalition Supports EPA’s Proposed Revisions to the Safer Choice Standard

As reported in our December 5, 2023, memorandum, the U.S. Environmental Protection Agency (EPA) proposed updates to the Safer Choice Standard on November 14, 2023, that include a name change to the Safer Choice and Design for the Environment (DfE) Standard (Standard), an update to the packaging criteria, the addition of a Safer Choice certification for cleaning service providers, a provision allowing for preterm partnership termination under exceptional circumstances, and the addition of several product and functional use class requirements. 88 Fed. Reg. 78017. On January 16, 2024, California Attorney General Rob Bonta announced that, alongside a coalition of 12 attorneys general, he submitted a comment letter that:

Supports EPA’s proposed revisions to its Safer Choice Standard;
Recommends that EPA not allow products with plastic primary packaging to use the Safer Choice label or DfE logo;
Recommends that if EPA does allow products with plastic primary packaging to use the label and logo, EPA should prohibit the use of chemical recycling in meeting the proposed standard’s plastic packaging recycled content requirements; and
Calls on EPA to exclude any products or packaging that contain any per- and polyfluoroalkyl substances (PFAS), “whether intentionally introduced or not.”

Exploring the Future of Information Governance: Key Predictions for 2024

Information governance has evolved rapidly, with technology driving the pace of change. Looking ahead to 2024, we anticipate technology playing an even larger role in data management and protection. In this blog post, we’ll delve into the key predictions for information governance in 2024 and how they’ll impact businesses of all sizes.

Embracing AI and Automation: Artificial intelligence and automation are revolutionizing industries, bringing about significant changes in information governance practices. Over the next few years, it is anticipated that an increasing number of companies will harness the power of AI and automation to drive efficient data analysis, classification, and management. This transformative approach will not only enhance risk identification and compliance but also streamline workflows and alleviate administrative burdens, leading to improved overall operational efficiency and effectiveness. As organizations adapt and embrace these technological advancements, they will be better equipped to navigate the evolving landscape of data governance and stay ahead in an increasingly competitive business environment.
Prioritizing Data Privacy and Security: In recent years, data breaches and cyber-attacks have significantly increased concerns regarding the usage and protection of personal data. As we look ahead to 2024, the importance of data privacy and security will be paramount. This heightened emphasis is driven by regulatory measures such as the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR). These regulations necessitate that businesses take proactive measures to protect sensitive data and provide transparency in their data practices. By doing so, businesses can instill trust in their customers and ensure the responsible handling of personal information.
Fostering Collaboration Across Departments: In today’s rapidly evolving digital landscape, information governance has become a collective responsibility. Looking ahead to 2024, we can anticipate a significant shift towards closer collaboration between the legal, compliance, risk management, and IT departments. This collaborative effort aims to ensure comprehensive data management and robust protection practices across the entire organization. By adopting a holistic approach and providing cross-functional training, companies can empower their workforce to navigate the complexities of information governance with confidence, enabling them to make informed decisions and mitigate potential risks effectively. Embracing this collaborative mindset will be crucial for organizations to adapt and thrive in an increasingly data-driven world.
Exploring Blockchain Technology: Blockchain technology, with its decentralized and immutable nature, has the tremendous potential to revolutionize information governance across industries. By 2024, as businesses continue to recognize the benefits, we can expect a significant increase in the adoption of blockchain for secure and transparent transaction ledgers. This transformative technology not only enhances data integrity but also mitigates the risks of tampering, ensuring trust and accountability in the digital age. With its ability to provide a robust and reliable framework for data management, blockchain is poised to reshape the way we handle and secure information, paving the way for a more efficient and trustworthy future.
Prioritizing Data Ethics: As data-driven decision-making becomes increasingly crucial in the business landscape, the importance of ethical data usage cannot be overstated. In the year 2024, businesses will place even greater emphasis on data ethics, recognizing the need to establish clear guidelines and protocols to navigate potential ethical dilemmas that may arise. To ensure responsible and ethical data practices, organizations will invest in enhancing data literacy among their workforce, prioritizing education and training initiatives. Additionally, there will be a growing focus on transparency in data collection and usage, with businesses striving to build trust and maintain the privacy of individuals while harnessing the power of data for informed decision-making.

The future of information governance will be shaped by technology, regulations, and ethical considerations. Businesses that adapt to these changes will thrive in a data-driven world. By investing in AI and automation, prioritizing data privacy and security, fostering collaboration, exploring blockchain technology, and upholding data ethics, companies can prepare for the challenges and opportunities of 2024 and beyond.

Jim Merrifield, Robinson+Cole’s Director of Information Governance & Business Intake, contributed to this report.

Tag: Consumer Protection

FDA Issues New Guidance on Cosmetic Product Registration and Listing

Like this:

PRIVACY ON ICE: A Chilling Look at Third-Party Data Risks for Companies

Like this:

EVERYTHING’S FINE: Big TCPA Win For Medical Debt Collector Suggests FCC Rulings Still Binding After Loper Bright–Let’s Hope it Stays That Way

Like this:

FTC Announces Final Rule Imposing Civil Penalties for Fake Consumer Reviews and Testimonials