Federal Trade Commission Archives - Page 3 of 6

Mid-Year Recap: Think Beyond US State Laws!

Much of the focus on US privacy has been US state laws, and the potential of a federal privacy law. This focus can lead one to forget, however, that US privacy and data security law follows a patchwork approach both at a state level and a federal level. “Comprehensive” privacy laws are thus only one piece of the puzzle. There are federal and state privacy and security laws that apply based on a company’s (1) industry (financial services, health care, telecommunications, gaming, etc.), (2) activity (making calls, sending emails, collecting information at point of purchase, etc.), and (3) the type of individual from whom information is being collected (children, students, employees, etc.). There have been developments this year in each of these areas.

On the industry law, there has been activity focused on data brokers, those in the health space, and for those that sell motor vehicles. The FTC has focused on the activities of data brokers this year, beginning the year with a settlement with lead-generation company Response Tree. It also settled with X-Mode Social over the company’s collection and use of sensitive information. There have also been ongoing regulation and scrutiny of companies in the health space, including HHS’s new AI transparency rule. Finally, in this area is a new law in Utah, with a Motor Vehicle Data Protection Act applicable to data systems used by car dealers to house consumer information.

On the activity side, there has been less news, although in this area the “activity” of protecting information (or failing to do so) has continued to receive regulatory focus. This includes the SEC’s new cybersecurity reporting obligations for public companies, as well as minor modifications to Utah’s data breach notification law.

Finally, there have been new laws directed to particular individuals. In particular, laws intended to protect children. These include social media laws in Florida and Utah, effective January 1, 2025 and October 1, 2024 respectively. These are similar to attempts to regulate social media’s collection of information from children in Arkansas, California, Ohio and Texas, but the drafters hope sufficiently different to survive challenges currently being faced by those laws. The FTC is also exploring updates to its decades’ old Children’s Online Privacy Protection Act.

Putting It Into Practice: As we approach the mid-point of the year, now is a good time to look back at privacy developments over the past six months. There have been many developments in the privacy patchwork, and companies may want to take the time now to ensure that their privacy programs have incorporated and addressed those laws’ obligations.

Listen to this post

NIST Releases Risk ‘Profile’ for Generative AI

A year ago, we highlighted the National Institute of Standards and Technology’s (“NIST”) release of a framework designed to address AI risks (the “AI RMF”). We noted how it is abstract, like its central subject, and is expected to evolve and change substantially over time, and how NIST frameworks have a relatively short but significant history that shapes industry standards.

As support for the AI RMF, last month NIST released in draft form the Generative Artificial Intelligence Profile (the “Profile”).The Profile identifies twelve risks posed by Generative AI (“GAI”) including several that are novel or expected to be exacerbated by GAI. Some of the risks are exotic and new, such as confabulation, toxicity, and homogenization.

The Profile also identifies risks that are familiar, such as those for data privacy and cybersecurity. For the latter, the Profile details two types of cybersecurity risks: (1) those with the potential to discover or enable the lowering of barriers for offensive capabilities, and (2) those that can expand the overall attack surface by exploiting vulnerabilities as novel attacks.

For offensive capabilities and novel attack risks, the Profile includes these examples:

Large language models (a subset of GAI) that discover vulnerabilities in data and write code to exploit them.
GAI-powered co-pilots that proactively inform threat actors on how to evade detection.
Prompt-injections that steal data and run code remotely on a machine.
Compromised datasets that have been ‘poisoned’ to undermine the integrity of outputs.

In the past, the Federal Trade Commission (“FTC”) has referred to NIST when investigating companies’ data breaches. In settlement agreements, the FTC has required organizations to implement security measures through the NIST Cybersecurity Framework. It is reasonable to assume then, that NIST guidance on GAI will also be recommended or eventually required.

But it’s not all bad news – despite the risks when in the wrong hands, GAI will also improve cybersecurity defenses. As recently noted by Microsoft’s recent report on the GDPR & GAI, GAI can already: (1) support cybersecurity teams and protect organizations from threats, (2) train models to review applications and code for weaknesses, and (3) review and deploy new code more quickly by automating vulnerability detection.

Before ‘using AI to fight AI’ becomes legally required, just as multi-factor authentication, encryption, and training have become legally required for cybersecurity, the Profile should be considered to mitigate GAI risks. From pages 11-52, the Profile examines four hundred ways to use the Profile for GAI risks. Grouping them together, some of the recommendations include:

Refine existing incident response plans and risk assessments if acquiring, embedding, incorporating, or using open-source or proprietary GAI systems.
Implement regular adversary testing of the GAI, along with regular tabletop exercises with stakeholders and the incident response team to better inform improvements.
Carefully review and revise contracts and service level agreements to identify who is liable for a breach and responsible for handling an incident in case one is identified.
Document everything throughout the GAI lifecycle, including changes to any third parties’ GAI systems, and where audited data is stored.

“Cybersecurity is the mother of all problems. If you don’t solve it, all the other technology stuff just doesn’t happen” said Charlie Bell, Microsoft’s Chief of Security, in 2022. To that end, the AM RMF and now the Profile provide useful and early guidance on how to manage GAI Risks. The Profile is open for public comment until June 2, 2024.

Update on FTC Noncompete Ban: Court Challenges Begin

On April 23 we reported on the Federal Trade Commission’s vote to ban almost all non-competition agreements in the United States. Within hours of that vote, Ryan LLC, a global tax consulting firm headquartered in Dallas, filed a lawsuit in the U.S. District Court for the Northern District of Texas challenging the FTC’s authority to issue such a rule.

The U.S. Chamber of Commerce has been allowed to intervene in that case and will join in the challenge to the FTC ban.

Ryan’s claims are that:

The FTC lacks the legal authority to promulgate such a rule.
Even if Congress had granted that authority by statute, such a grant would be an unconstitutional delegation of legislative authority to the executive branch, in violation of Article 1 of the U.S. Constitution.
The FTC Act is unconstitutional because it limits the president’s authority to remove subordinates (in this case, FTC Commissioners).
The FTC promulgated the rule in violation of the Administrative Procedure Act because it failed to establish a factual basis for the rule.
The rule is retroactive in purporting to invalidate all existing non-competition agreements, but the FTC has no authority to issue retroactive rules.

Based on our review of the pleadings filed thus far in the case, we think that the U.S. Chamber and its allies agree that these are the correct arguments and that they will file a brief supporting them.

Ryan is asking the court for two things: a stay of the effective date of the rule, and preliminary and permanent injunctions barring the FTC from enforcing it. The case is on an expedited schedule, with briefing to be completed by June 12 and a ruling expected on the pending motion by July 3.

Given that the rule’s effective date is September 4, if the court can meet that schedule, employers should have sufficient time to take the necessary steps to comply, if the court allows the rule to go into effect.

However, we would advise employers to start identifying all employees who are subject to an existing non-competition agreement, so they can move quickly to meet the notice requirements over the summer, should that become necessary.

The FTC Has Banned Non-Competes: What Do Employers in the Energy Space Do Now?

When is the FTC’s rule effective?

The FTC’s non-compete ban is not in effect yet. It does not become effective until 120 days after the date of publication in the Federal Register of the final rule. The Federal Register is expected to publish the final rule next week, likely making the effective date around the beginning of September 2024.

Has litigation already been filed to challenge the non-compete ban?

The FTC’s non-compete ban is subject to at least two existing legal challenges seeking to have it invalidated. The U.S. Chamber of Commerce filed a Complaint for Declaratory Judgment and Injunctive Relief in U.S. District Court for the Eastern District of Texas, Tyler Division (Chamber of Commerce of the United States of America v. Federal Trade Commission, Case No. 6:24-cv-00148 (E.D. Tex. filed April 24, 2024); see also Ryan, LLC v. Federal Trade Commission, Case No. 3:24-cv-986 (N.D. Tex. filed April 23, 2024)). We don’t know whether these legal challenges will be successful, but we will provide updates when we know more.

What if the legal challenges are unsuccessful?

If the legal challenges are not successful and the rule goes into effect 120 days from next week (again, approximately early September 2024), here are steps that employers can take to get ready for the effective date:

Review existing agreements to determine if they are now “unfair methods of competition”:
- One issue to analyze is whether an individual with a non-compete is a “worker” or a “senior executive.”
  - If a “senior executive,” then a non-compete in place that pre-exists that effective date can still be enforced.
  - If not a “senior executive,” then any non-compete clause that pre-dates the effective date for a worker is banned by the rule.
  - If an independent contractor (or another non-employee worker), any non-compete clause is banned.
- Another issue to consider is whether non-solicitation, non-disclosure, or reimbursement provisions could be subject to the FTC ban. A provision that prevents a worker from seeking or accepting work in the U.S. with a different person or from operating a business in the U.S., then it is a “non-compete clause” that is subject to the rule. Depending on the wording and the factual circumstances, an obligation not to solicit customers could be considered a prohibited non-compete. For example, if an obligation not to solicit certain clients keeps a worker from accepting any job in the Permian Basin, it is arguable that the provision operates as a non-compete and violates the rule.
Determine whether notice is required: After reviewing which non-compete clauses are not in compliance with the FTC rule, prepare a notice for workers who are currently subject to a non-compete clause banned by the rule. The FTC put out model language on the notification, which informs the worker that the non-compete clause is no longer valid as of the effective date.
Update any form agreements: As part of the review of existing non-compete agreements, take the opportunity to update form agreements to remove now unenforceable non-compete (and possibly non-solicit) provisions. It is always a good idea to review and update the agreement generally to make sure that it reflects your current business and definition of confidential information.
Enter into non-compete agreements with “senior executives”:
- The FTC ban permits non-compete agreements with “senior executives” that pre-exist the effective date to continue after the effective date. After the effective date, an employer may not require a senior executive to sign a new non-compete.
- The term “senior executive” refers to officers earning more than $151,164 with “policy-making authority.” As so defined, the FTC estimates that senior executives represent less than 0.75% of all workers.
- “Policy-making authority” means “final authority to make policy decisions that control significant aspects of a business entity or common enterprise and does not include authority limited to advising or exerting influence over such policy decisions or having final authority to make policy decisions for only a subsidiary of or affiliate of a common enterprise.”
- Energy company officers of companies that are part of a common enterprise or joint venture will want to analyze whether senior executives have final authority that qualifies for a non-compete under the rule.
- As always, any employer should make sure that a non-compete complies with existing state laws to assist in any enforcement efforts.
Take note of violations before the effective date: The FTC’s noncompete ban does not apply where a cause of action related to a noncompete clause accrued before the effective date. So, if a worker is violating a noncompete that would otherwise be banned under the FTC rule, an employer may want to consider whether to initiate legal action against that worker before the effective date to fall under this exception.

FTC: Three Enforcement Actions and a Ruling

In today’s digital landscape, the exchange of personal information has become ubiquitous, often without consumers fully comprehending the extent of its implications.

The recent actions undertaken by the Federal Trade Commission (FTC) shine a light on the intricate web of data extraction and mishandling that pervades our online interactions. From the seemingly innocuous permission requests of game apps to the purported protection promises of security software, consumers find themselves at the mercy of data practices that blur the lines between consent and exploitation.

The FTC’s proposed settlements with companies like X-Mode Social (“X Mode”) and InMarket, two data aggregators, and Avast, a security software company, underscores the need for businesses to appropriately secure and limit the use of consumer data, including previously considered innocuous information such as browsing and location data. In a world where personal information serves as currency, ensuring consumer privacy compliance has never been more critical – or posed such a commercial risk for failing to get it right.

X-Mode and InMarket Settlements: The proposed settlements with X-Mode and InMarket concern numerous allegations based on the mishandling of consumers’ location data. Both companies supposedly collected precise location data through their own mobile apps and those of third parties (through software development kits). X-Mode is alleged to have sold precise location data (advertised as being 70% accurate within 20 meters or less) linked to timestamps and unique persistent identifiers (i.e., names, email addresses, etc.) of its consumers to private government contractors without obtaining proper consent. Plotting this data on a map makes it easy to reveal each person’s movements over time.

InMarket purportedly utilized location data to cross-reference such data with points of interest to sort consumers into particularized audience segments for targeted advertising purposes without adequately informing consumers – examples of audience segments include parents of preschoolers, Christian church attendees, and “wealthy and not healthy,” among other groupings.

Avast Settlement: Avast, a security software company, allegedly sold granular and re-identifiable browsing information of its consumers despite assuring consumers it would protect their privacy. Avast allegedly collected extensive browsing data of its consumers through its antivirus software and browser extensions while ensuring its consumers that their browsing data would only be used in aggregated and anonymous form. The data collected by Avast revealed visits to various websites that could be attributed to particular people and allowed for inferences to be drawn about such individuals – examples include academic papers on symptoms of breast cancer, education courses on tax exemptions, government jobs in Fort Meade, Maryland with a salary over $100,000, links to FAFSA applications and directions from one location to another, among others.

Sensitivity of Browsing and Location Data

It is important to note that none of the underlying datasets in question contained traditional types of personally identifiable information (e.g., name, identification numbers, physical descriptions, etc.) (“PII”). Even still, the three proposed settlements by the FTC underscore the sensitive nature of browsing and location data due to the insights such data reveals, such as religious beliefs, health conditions, and financial status, and the ease with which the insights can be linked to certain individuals.

In the digital age, the amount of data available about individuals online and collected by various companies makes the re-identification of individuals easier every day. Even when traditional PII is not included in a data set, by linking sufficient data points, a profile or understanding of an individual can be created. When such profile is then linked to an identifier (such as username, phone number, or email address provided when downloading an app or setting up an account on an app) and cross-referenced with various publicly available data, such as name, email, phone number or content on social media sites, it can allow for deep insights into an individual. Despite the absence of traditional types of PII, such data poses significant privacy risks due to the potential for re-identification and the intimate details about individuals’ lives that it can divulge.

The FTC emphasizes the imperative for companies to recognize and treat browsing and location data as sensitive information and implement appropriate robust safeguards to protect consumer privacy. This is especially true when the data set includes information with the precision of those cited by the FTC in its proposed settlements.

Accountability and Consent

With browsing and location data, there is also a concern that the consumer may not be fully aware of how their data is used. For instance, Avast claimed to protect consumers’ browsing data and then sold that very same browsing information, often without notice to consumers. When Avast did inform customers of their practices, the FTC claims it deceptively stated any sharing would be “anonymous and aggregated.” Similarly, X-Mode claimed it would use location data for ad-personalization and location-based analytics. Consumers were unaware such location data was also sold to government contractors.

The FTC has recognized that a company may need to process an individual’s information to provide them with services or products requested by the individual. The FTC also holds that such processing does not mean the company is then free to collect, access, use, or transfer that information for other purposes (e.g., marketing, profiling, background screening, etc.). Essentially, purpose matters. As the FTC explains, a flashlight app provider cannot collect, use, store, or share a user’s precise geolocation data, or a tax preparation service cannot use a customer’s information to market other products or services.

If companies want to use consumer personal information for purposes other than providing the requested product or services, the FTC states that companies should inform consumers of such uses and obtain consent to do so.

The FTC aims to hold companies accountable for their data-handling practices and ensure that consumers are provided with meaningful consent mechanisms. Companies should handle consumer data only for the purposes for which data was collected and honor their privacy promises to consumers. The proposed settlements emphasize the importance of transparency, accountability, meaningful consent, and the prioritization of consumer privacy in companies’ data handling practices.

Implementing and Maintaining Safeguards

Data, especially specific data that provide insights and inferences about individuals, is extremely valuable to companies, but it is that same data that exposes such individuals’ privacy. Companies that sell or share information sometimes include limitations for the use of the data, but not all contracts have such restrictions or sufficient restrictions to safeguard individuals’ privacy.

For instance, the FTC alleges that some of Avast’s underlying contracts did not prohibit the re-identification of Avast’s users. Where Avast’s underlying contracts prohibited re-identification, the FTC alleges that purchasers of the data were still able to match Avast users’ browsing data with information from other sources if the information was not “personally identifiable.” Avast also failed to audit or confirm that purchasers of data complied with its prohibitions.

The proposed complaint against X-Mode recognized that at least twice, X-Mode sold location data to purchasers who violated restrictions in X-Mode’s contracts by reselling the data they bought from X-Mode to companies further downstream. The X-Mode example shows that even when restrictions are included in contracts, they may not prevent misuse by subsequent downstream parties.

Ongoing Commitment to Privacy Protection:

The FTC stresses the importance of obtaining informed consent before collecting or disclosing consumers’ sensitive data, as such data can violate consumer privacy and expose them to various harms, including stigma and discrimination. While privacy notices, consent, and contractual restrictions are important, the FTC emphasizes they need to be backed up by action. Accordingly, the FTC’s proposed orders require companies to design, implement, maintain, and document safeguards to protect the personal information they handle, especially when it is sensitive in nature.

What Does a Company Need To Do?

Given the recent enforcement actions by the FTC, companies should:

Consider the data it collects and whether such data is needed to provide the services and products requested by the consumer and/or a legitimate business need in support of providing such services and products (e.g., billing, ongoing technical support, shipping);
Consider browsing and location data as sensitive personal information;
Accurately inform consumers of the types of personal information collected by the company, its uses, and parties to whom it discloses the personal information;
Collect, store, use, or share consumers’ sensitive personal information (including browser and location data) only with such consumers’ informed consent;
Limit the use of consumers’ personal information solely to the purposes for which it was collected and not market, sell, or monetize consumers’ personal information beyond such purpose;
Design, Implement, maintain, document, and adhere to safeguards that actually maintain consumers’ privacy; and
Audit and inspect service providers and third-party companies downstream with whom consumers’ data is shared to confirm they are (a) adhering to and complying with contractual restrictions and (b) implementing appropriate safeguards to protect such consumer data.

A Closer Look at the FTC’s Final Non-Compete Rule

On April 23, 2024, the Federal Trade Commission (FTC) issued its Final Non-Compete Agreement Rule (Final Rule), banning non-compete agreements between employers and their workers. The Final Rule will go into effect 120 days after being published in the Federal Register. This Final Rule will impact most US businesses, specifically those that utilize non-compete agreements to protect their trade secrets, confidential business information, goodwill, and other important intangible assets.

The Final Rule prohibits employers from entering or attempting to enter into a non-compete agreement with “workers” (employees and independent contractors). Employers are also prohibited from even representing that a worker is subject to such a clause. The Final Rule provides that it is an unfair method of competition for employers to enter into non-compete agreements with workers and is therefore a violation of Section 5 of the FTC Act.

There are few exceptions under the Final Rule. For senior executives, existing non-compete agreements can remain in force. However, employers are barred from entering or attempting to enter into a non-compete agreement with a senior executive after the effective date of the Final Rule. The Final Rule defines “senior executive” as a worker who is both (1) earning more than $151,164 annually and (2) in a “policy-making position” for the business. For workers who are not senior executives, existing non-competes are not enforceable after the effective date. If not invalidated all together, the Final Rule will likely have extensive litigation related to “policy-making position.” According to the current commentary on the Final Rule, the FTC will likely take the position that “senior executive” is a very limited definition.

Further, the Final Rule does not apply to non-competes entered into pursuant to a “bona fide sale of a business entity, of the person’s ownership interest in [a] business entity, or of all or substantially all of a business entity’s operating assets.” As a result, parties entering into transactions can continue to use non-compete agreements in the sale of a business. But transactional lawyers should note that any non-compete in a subsequent employment agreement with a seller will likely be subject to the Final Rule. The Final Rule also does not prohibit employers from enforcing non-compete clauses where the cause of action related to the non-compete clause occurred prior to the effective date of the Final Rule.

The Final Rule also states that agreements that “penalize” or “function to prevent” an employee from working for a competitor are banned and unlawful. For example, a non-disclosure agreement may be viewed as a non-compete when it is so broad that it functions to prevent workers from seeking or accepting other work or starting a business after they leave their job. Similarly, non-solicitation agreements may also be banned under the new rule “where they function to prevent a worker from seeking or accepting other work or starting a business after their employment ends.” The commentary makes clear that the enforceability and legality of these types of agreements will need to be analyzed on a case-by-case basis.

Under the Final Rule, employers are required to provide clear and conspicuous notice to workers who are subject to a prohibited non-compete. This notice must be sent in an individualized communication (text message, hand delivery, mailed to last known address, etc.) and indicate that the worker’s non-compete clause will not be enforced.

The Final Rule has already been challenged in at least two lawsuits, both filed in the state of Texas. The US Chamber of Commerce filed suit in the US District Court for the Eastern District of Texas seeking a declaratory judgment and an injunction to prevent the enactment of the Final Rule. A second suit, filed by Ryan, LLC, a tax services firm, was filed in the US District Court for the Northern District of Texas. Both suits raise similar arguments: (1) the FTC lacks authority to enact the rule due to the major questions doctrine; (2) the Final Rule is inconsistent with the FTC Act; (3) the retroactive nature of the Final Rule exceeds the FTC’s authority and raises Fifth Amendment concerns; and (4) the Final Rule is arbitrary and capricious. The US Chamber of Commerce has also filed a motion to stay the effective date of the Final Rule pending resolution of the lawsuit.

The very nature of how business entities protect their intangible assets is at risk, and the Final Rule will change the contractual dynamic of the employer-employee relationship.

FTC Moves to Strike Most Noncompetes: Considerations for Cannabis Companies

As Bradley previously reported, the Federal Trade Commission at the beginning of last year issued a notice of proposed rulemaking to effectively ban employee noncompete provisions as an unfair method of competition in violation of Section 5 of the FTC Act. Following a 16-month administrative process that drew more than 26,000 public comments, the FTC on April 23, 2024, issued its final rule that will, according to the FTC, “promote competition by banning noncompetes nationwide, protecting the fundamental freedom of workers to change jobs, increasing innovation, and fostering new business formation.”

Key Features of the Final Rule

Key features of the final rule include:

Defining “noncompete clauses” as a term or condition of employment that either “prohibits” a worker from, “penalizes” a worker for, or “functions to prevent” a worker from (a) seeking or accepting work in the United States with a different person where such work would begin after the conclusion of the employment that includes the term or condition; or (b) operating a business in the United States after the conclusion of the employment that includes the term or condition.
Treating existing noncompetes differently depending on the category of worker.
- For “senior executives,” existing noncompetes may remain in force. The term “senior executive” refers to workers earning more than $151,164 who are in a “policy-making position.” As so defined, the FTC estimates that senior executives represent less than 0.75% of all workers.
- For all other categories of workers, existing noncompetes will be unenforceable following the effective date (i.e., 120 days following its publication on the Federal Register).
Banning new noncompetes for all workers following the effective date.
Requiring employers to provide “clear and conspicuous notice” to workers who are not senior executives and are subject to existing noncompetes that such provisions are no longer enforceable. The FTC included model language in the final rule that satisfies the notice requirements.
Excluding banks but not bank affiliates. Because the FTC does not have regulatory authority over banks, it does not apply to banks. The rule does apply to bank affiliates however as those entities are within FTC jurisdiction.
Excluding nonprofit entities. The final rule does not apply to nonprofit entities, such as nonprofit hospitals, as they fall outside of the jurisdiction of the FTC Act. The FTC notes, however, that not all entities that claim tax-exempt status in their tax filings are automatically outside of the scope of the final rule. Rather, the FTC applies a two-part test to determine whether the purported nonprofit is within the scope of the FTC Act, focusing on the source of the entity’s income and the destination of the income.
Excluding noncompetes in the sale of business context. The final rule generally does not apply to business owners upon the “bona fide” sale of a business. The final rule expanded the sale of business exception found in the proposed rule.
The final rule does not apply where a cause of action related to a noncompete accrued prior to the effective date of the final rule.

What Does the New Rule Mean for the Cannabis Industry in Particular?

The FTC contends that the final rule will benefit the U.S. economy by, among other things, increasing worker earnings, reducing healthcare costs, spurring new business formation, and enhancing innovation. But what will it mean for the U.S. cannabis industry specifically?

As we’ve written about before, there’s a significant amount of proprietary information that may give players in the cannabis space a competitive edge – e.g., customer lists, grow processes, or unique cannabinoid extracts, plants, and products. Because marijuana is still a Schedule I substance under the Controlled Substance Act, however, there are open questions about whether an entity engaged in marijuana-related commercial activity can avail itself of federal law protections, such as U.S. patent and trademark laws. If an entity cannot avail itself of those federal law protections, the ability to turn to state contract law becomes even more important to protect its investments. That’s where noncompetes could come in — going a long way to protect an individual from taking and utilizing a company’s or individual’s investments. The FTC final rule largely would put an end to the ability to use noncompete protections, save for the exceptions outlined above. That may be an even bigger blow to the cannabis industry as compared to other industries who can readily utilize federal law protections. On the other hand, the cannabis industry is largely transient and collaborative, and many cannabis companies and individuals in the industry may be willing to take the good with the bad when it comes to the absence of noncompete rules.

What’s Next?

First, the final rule is not yet in effect. It will go into effect 120 days after its publication in the Federal Register.

Second, we expect there will be significant legal challenges and efforts to halt the implementation of the rule.

The final rule was issued following a 3-2 vote by the commissioners, with the two newly appointed Republican commissioners – Melissa Holyoak and Andrew Ferguson – voting against the rule. In their prepared remarks, the dissenting commissioners questioned the FTC’s legal authority to take such sweeping action.

The final rule has already prompted a legal challenge. Shortly after the FTC’s public meeting approving the final rule, the U.S. Chamber of Commerce released a statement indicating its intent to “sue the FTC to block this unnecessary and unlawful rule and put other agencies on notice that such overreach will not go unchecked.” True to its word, the Chamber filed yesterday a Complaint for Declaratory Judgment and Injunctive Relief in U.S. District Court for the Eastern District of Texas (Chamber of Commerce of the United States of America v. Federal Trade Commission, Case No. 6:24-cv-00148 (E.D.Tex. filed April 24, 2024)). The lawsuit mounts a number of legal challenges to the final rule.

What the FTC’s Rule Banning Non-Competes Means for Healthcare

The FTC unveiled its long-awaited final rule banning most non-compete agreements during a live broadcast of a Commission meeting on April 23, 2024. The proposed rule, which was first announced in January 2023, underwent an extensive public comment process in which approximately 26,000 comments were received. According to the FTC, approximately 25,000 of these comments supported a total ban on non-competes. While there was some expectation that the final rule would be less aggressive than the proposed rule, that turned out not to be the case. By late summer 2024, most employers, except for non-profit organizations, will not be able to enforce or obtain non-competes in the U.S. except in extremely narrow circumstances. The new rule will take effect 120 days after it is published in the Federal Register. Assuming the rule is published this week, we can expect it to take effect by late August. That is, of course, if a court does not enjoin the rule first. Shortly after the rule was announced on April 23, the U.S. Chamber of Commerce stated its intention to sue the FTC. U.S. Chamber to Sue FTC Over Unlawful Power Grab on Noncompete Agreements Ban | U.S. Chamber of Commerce (uschamber.com) The first lawsuit challenging the new rule was filed on April 23, Ryan, LLC v. Federal Trade Commission, Case No. 3:24cv986 (N.D. Tex. Apr. 23, 2024). Among other relief, the Ryan suit seeks to have the rule vacated and set aside. There are significant legal questions concerning whether the FTC has the authority to take this action by rulemaking or whether this is best left to the legislative process. While some U.S. states have banned non-competes, many U.S. states have not banned them.

As written, the rule will have profound effects on virtually every industry, especially health care, where non-competes are common in physician and mid-level practitioner employment agreements. As several Commissioners indicated during the April 23 meeting, they are particularly concerned about non-competes in health care and believe this rule will save approximately $74-194 billion in reduced spending on physician services over the next decade.

Following is Nelson Mullins’ quick take on what health care employers need to know:

The rule does not apply to non-profits. The basis for the rule making is Section 5 of the FTC Act, which doesn’t apply to non-profits. So, a non-profit health system that has non-competes with physicians or other workers is not impacted by the rule. Be aware, though, that the FTC may be looking to test whether some non-profit health systems are really operating as true non-profits. Tax exempt status alone will not be enough. We believe, however, that given significant and quantifiable charitable benefits that most non-profit systems provide, the FTC may be hard pressed to find a good test case within the non-profit health care industry.
For all others, the rule bans all non-compete agreements for any worker, regardless of title, job function, or compensation, after the effective date. Thus, a for-profit health system or for-profit physician practice that uses non-competes will be significantly limited. The only non-competes that will be allowed to remain in force are non-competes for “Senior Executives” that were entered into before the rule becomes effective.
The rule will take effect 120 days after it is published in the Federal Register. This will likely occur this week, so we expect the effective date to be approximately August 20, 2024.
The rule rescinds existing non-competes for all workers who are not “Senior Executives.”
“Senior Executive” is a narrowly-defined term meaning:
1. a person in a policy making position; and
2. who was paid at least $151,164 in the prior year.
Existing non-competes for Senior Executives are not rescinded. New non-competes with Senior Executives entered into prior to the effective date are still allowed. However, no new non-competes with Senior Executives may be entered into after the effective date.
“Policy-making position” means: President, CEO, or equivalent, or other person who has policy making authority, i.e., decisions that control a significant aspect of a business entity. Most clinicians will not meet the definition of “Senior Executive.”
Non-senior executives who are now under a non-compete must be given notice by the effective date that their non-compete will not be, and cannot legally be, enforced. Model language for the notice is in the rule.

FTC Approves Non-Compete Ban

On Tuesday afternoon, April 23, the Federal Trade Commission (FTC) voted 3-2 along party lines to approve its new rule on non-competes. The new rule, which will take effect in 120 days, essentially bans non-competes for all workers, finding them “an unfair method of competition – and therefore a violation of Section 5 of the FTC Act.”

Notably, a non-complete clause is broadly defined as a “contractual term or workplace policy that prohibits a worker from, penalizes a worker for, or functions to prevent a worker from seeking or accepting work in the United States with a different person where such work would begin after the conclusion of the employment or operating a business in the United States after the conclusion of the employment.”

The new rule applies retroactively to prior agreements, other than those for senior executives earning more than $151,164 a year in a “policy-making position.” Employers must provide notice to other workers subject to non-compete agreements that they are no longer enforceable.

Not limited to employees, the non-compete ban extends to independent contractors, externs, interns, volunteers, apprentices, and sole proprietors who provide a service to a person. It does not include non-competes entered into pursuant to a bona fide sale of a business entity or in a franchisor-franchisee relationship.

While the rule is final, expect legal challenges to follow. For example, the U.S. Chamber of Commerce, the nation’s largest business lobby, told reporters it plans to sue over the rule, claiming the FTC is not authorized to make this rule, that non-competes are not categorically unfair, and the rule is arbitrary. The Chamber’s thoughts were echoed by the opposing Republican FTC voters, who cited concerns about the FTC’s authority (as compared to the merits of such a rule).

While employers’ protectable interests are often a concern, it is important to note that this rule does not ban non-disclosure and confidentiality agreements.

“…it is an unfair method of competition – and therefore a violation of Section 5 of the FTC Act – for employers to enter into noncompetes with workers after the effective date.”

FTC Issues Report to Congress Highlighting Collaboration with State Attorneys General

On April 10, 2024, the Federal Trade Commission issued a report to Congress on the agency’s collaboration with state attorneys general highlighting current cooperative law enforcement efforts, best practices to ensure continued collaboration and legislative recommendations to enhance such efforts.

The report, directed by the FTC Collaboration Act of 2021, “Working Together to Protect Consumers: A Study and Recommendations on FTC Collaboration with the State Attorneys General” makes legislative recommendations that would enhance these efforts, including reinstating the Commission’s authority to seek money for defrauded consumers and providing it with the independent authority to seek civil penalties.

“Today’s consumer protection challenges require an all-hands-on-deck response, and our report details how the FTC is working closely with state enforcers to share information, stop fraud, and ensure fairness in the marketplace,” said FTC attorney Samuel Levine, Director of the Bureau of Consumer Protection. “We look forward to seeking new opportunities to strengthen these ties and confront the challenges of the future.”

In June 2023, the Commission announced a request for public information (RFI) seeking public comments and suggestions on ways it can work more effectively with state AGs to help educate consumers about, and protect them from, potential fraud. After reviewing and analyzing the comments received, the agency developed the report to Congress issued today. The report is divided into three sections: 1) The FTC’s Existing Collaborative Efforts with State
Attorneys General to Prevent, Publicize, and Penalize Frauds and Scams; 2) Recommended Best Practices to Enhance Collaboration; and 3) Legislative Recommendations to Enhance Collaboration Efforts.

The first section lays out the roles and responsibilities of the FTC and state AGs in protecting consumers from frauds and scams, provides an overview of their respective law enforcement authority, and discusses how federal and state enforcers share their information and expertise to facilitate effective communication and cooperation. It also provides a breakdown of the FTC’s
structure and a description of the Consumer Sentinel consumer complaint database, the largest such information-sharing network in the United States.

The second section details best practices used to enhance strong information-sharing between the FTC and its state law enforcement partners, discusses how the Commission coordinates joint and parallel enforcement actions with state AGs and other state consumer protection agencies, and presents ideas on expanding the sharing of expertise and technical resources between agencies.

Finally, the third section stresses the legislative need to restore the FTC’s Section 13(b) authority to seek equitable monetary refunds for injured consumers, presents ways to enhance collaboration and conserve resources by providing the FTC with the independent authority to seek civil penalties, and describes the agency’s need for clear authority to pursue legal actions against those who assist and facilitate unfair or deceptive acts or practices.

The Commission vote approving the report to Congress was 3-0-2, with Commissioners Melissa Holyoak and Andrew N. Ferguson not participating. Chair Lina M. Khan issued a separate statement, in which she was joined by Commissioners Rebecca Kelly Slaughter and Alvaro M. Bedoya. Commissioner Slaughter also issued a separate statement.

Tag: Federal Trade Commission

Mid-Year Recap: Think Beyond US State Laws!

Listen to this post

Like this:

NIST Releases Risk ‘Profile’ for Generative AI

Like this:

Update on FTC Noncompete Ban: Court Challenges Begin

Like this: