Tag: Federal Trade Commission

It’s a Cruel Summer (for Employers Still Facing Uncertainty of Looming Federal Trade Commission Noncompete Rule)

Summer 2024 may be remembered for its uncertainty. On top of the surprises in political campaigns and the Supreme Court’s overruling of decades-old precedents, employers nationwide still face uncertainty with the FTC’s looming rule banning the vast majority of employee noncompetes across the United States. This uncertainty was underscored on Tuesday, July 23, 2024, when a federal judge in Pennsylvania declined to enjoin the FTC’s Noncompete Rule (the “Rule”) from taking effect September 4, 2024.

What will happen in September remains unclear, as the nation still awaits a final ruling next month from U.S. District Judge Ada Brown of the Northern District of Texas. On July 3, 2024, Judge Brown temporarily enjoined the Rule, but only for the named plaintiffs — not nationwide.

One thing is certain: Without a nationwide vacatur of the Rule or an injunction against its enforcement, employers will face further uncertainty.

Back in the Northern District of Texas, Plaintiff Ryan LLC and Intervenor U.S. Chamber of Commerce filed briefs this week requesting that Judge Brown’s injunction against the Rule be expanded nationwide. They argued that expanding the injunction nationally would “spare tens of thousands of American businesses the illegal burdens imposed by the rule,” promptly conclude litigation, and avoid “a torrent of lawsuits.”

The FTC’s responsive brief in Texas is expected late next week, with a final ruling from Judge Brown expected on or before August 30, 2024.

What Should Employers Be Doing Now?

Our advice from the July 5, 2024, article remains relevant — for now. We will continue monitoring developments in the courts and providing updates on best practices.

  • Get ready to distribute the required notices informing employees that their noncompetes will no longer be enforced. The Noncompete Rule requires notifying current and former employees that their noncompete agreements will not be — and cannot be — enforced going forward, with notice being provided at the employees’ last known street address, email address, or phone number. For large employers, this could be a significant undertaking to prepare. Since no courts have stopped the FTC rule from taking effect on a nationwide basis, it would be prudent for employers to start gathering all the information they would need to comply with the notice requirement. That said, employers should still wait until after further action is taken by the courts, or in another one of the cases challenging the Rule, before sending the notices.
  • Businesses should explore whether they might have other ways to accomplish some of the same goals as noncompetes, such as nondisclosure agreements or fixed-duration employment contracts.
  • Businesses should review their other restrictive covenants, including non-solicitation and no-hire clauses, to ensure those clauses are narrowly tailored to protect their legitimate interests, thereby reducing the risk that they will be challenged as being within the Rule’s catchall provision prohibiting terms that “function[ ] to prevent” a worker from working for a different company after employment.
  • Businesses should have confidentiality agreements in place with employees and should prepare for a potential wave of trade secret litigation as employees are increasingly enticed to leave their employment to work for competitors. This means businesses will need to be prepared for increased costs of data and forensic work that are generally prevalent in trade secret and confidentiality litigation matters.
  • It may be time for businesses potentially impacted by the Rule to substantively review their existing agreements and policies as described in the points above and get started on drafting replacement forms of agreements that will comply with the Rule — if it goes into effect.
© 2024 Foley & Lardner LLP
For more news on the Looming Federal Trade Commission Noncompete Rule, visit the NLR Antitrust Trade Regulation and Labor Employment sections.

Pennsylvania Federal Court Declines to Preliminarily Enjoin FTC Rule Banning Non-Competes

Earlier today (July 23, 2024), Judge Hodge in the U.S. District Court for the Eastern District of Pennsylvania denied a tree care company’s motion to stay the effective date and preliminarily enjoin the Federal Trade Commission’s (“FTC”) proposed final rule (“Final Rule”) banning nearly all non-competes. ATS Tree Services, LLC v. Federal Trade Commission, No. 2:24-cv-01743-KBH (E.D. Pa.). The decision comes in the wake of the U.S. District Court for the Northern District of Texas’ July 3, 2024 ruling to the contrary in Ryan LLC v. Federal Trade Commission, No. 3:24-cv-00986-E, which stayed the Final Rule’s effective date as to the plaintiffs in that case, but had no nationwide effect.

The Pennsylvania Court’s Decision

The Pennsylvania court denied Plaintiff ATS Tree Services, LLC’s (“ATS”) request for a preliminary injunction based on its conclusion that the company failed to establish that it (i) would suffer irreparable harm if injunctive relief was not issued; and had a reasonable likelihood of succeeding on the merits of its claims.

ATS argued it would be harmed by incurring “nonrecoverable efforts to comply” with the Rule, and by losing “the contractual benefits from its existing non-compete agreements.” ATS described its nonrecoverable compliance costs as: costs associated with notifying its twelve employees of the change in accordance with the Rule’s notice provision; the costs and efforts to “review and modify [its] business strategy”; and the unquantifiable costs and efforts of altering its specialized training program. But court found these either insufficient or too speculative to support injunctive relief. ATS further argued it would face the risk that its employees would leave and transfer confidential information to direct competitors. The court found these risks too speculative.

ATS also unsuccessfully argued that it would succeed on the merits because, it asserted, the FTC lacks substantive rulemaking authority under its enabling statute, the FTC exceeded its authority, and Congress unconstitutionally delegated legislative power to the FTC. The court rejected each argument. The court further found that the “major questions doctrine” did not apply, because the Final Rule falls within the FTC’s core mandate, and the FTC has previously used its Section 6(g) rulemaking power in similar ways to the Final Rule.

Looking Forward

The Pennsylvania court’s decision did not analyze the Ryan decision, which reached contrary conclusions. It is likely that the dispute will ascend to the Third and Fifth Circuits, respectively. Notably, the Ryan court has indicated that it intends to issue a final judgment on the merits by August 30, 2024, which is likely to be appealed, and the Final Rule is scheduled to become effective by September 4, 2024.

© 2024 Proskauer Rose LLP.
For more news on the Eastern District of Pennsylvania’s decision in ATS Tree Services, LLC v. Federal Trade Commission, visit the NLR Antitrust Trade Regulation section.

FTC/FDA Send Letters to THC Edibles Companies Warning of Risks to Children

Earlier this week, the Federal Trade Commission (FTC) and Food and Drug Administration (FDA) sent cease-and-desist letters to several companies warning them that their products, which were marketed to mimic popular children’s snacks, ran the risk of unintended consumption of the Delta-8 THC by children. In addition to the FDA’s concerns regarding marketing an unsafe food additive, the agencies warned that imitating non-THC-containing food products often consumed by children through the use of advertising or labeling is misleading under Section 5 of the FTC Act. The FTC noted that “preventing practices that present unwarranted health and safety risks, particularly to children, is one of the Commission’s highest priorities.”

The FTC’s focus on these particular companies and products shouldn’t come as a surprise. One such company advertises edible products labelled as “Stoney Ranchers Hard Candy,” mimicking the common Jolly Ranchers candy, and “Trips Ahoy” closely resembling the well-known “Chips Ahoy.” Another company advertises a product closely resembling a Nerds Rope candy, with similar background coloring, and copy-cats of the Nerds logo and mascot. This is not the first time the FTC has warned companies about the dangers of advertising products containing THC in a way that could mislead consumers, particularly minors. In July of 2023, the FTC sent cease-and-desist letters to six organizations for the same violations alleged this week – there companies copied popular snack brands such as Doritos and Cheetos, mimicking the brands’ color, mascot, font, bag style, and more.

This batch of warning letters orders the companies to stop marketing the edibles immediately, to review their products for compliance, and to inform the FTC within 15 days of the specific actions taken to address the FTC’s concerns. The companies also are required to report to the FDA on corrective actions taken.

Copyright © 2024, Hunton Andrews Kurth LLP. All Rights Reserved.
For more on Cannabis, visit the NLR Biotech Food Drug section

Mid-Year Recap: Think Beyond US State Laws!

Much of the focus on US privacy has been US state laws, and the potential of a federal privacy law. This focus can lead one to forget, however, that US privacy and data security law follows a patchwork approach both at a state level and a federal level. “Comprehensive” privacy laws are thus only one piece of the puzzle. There are federal and state privacy and security laws that apply based on a company’s (1) industry (financial services, health care, telecommunications, gaming, etc.), (2) activity (making calls, sending emails, collecting information at point of purchase, etc.), and (3) the type of individual from whom information is being collected (children, students, employees, etc.). There have been developments this year in each of these areas.

On the industry law, there has been activity focused on data brokers, those in the health space, and for those that sell motor vehicles. The FTC has focused on the activities of data brokers this year, beginning the year with a settlement with lead-generation company Response Tree. It also settled with X-Mode Social over the company’s collection and use of sensitive information. There have also been ongoing regulation and scrutiny of companies in the health space, including HHS’s new AI transparency rule. Finally, in this area is a new law in Utah, with a Motor Vehicle Data Protection Act applicable to data systems used by car dealers to house consumer information.

On the activity side, there has been less news, although in this area the “activity” of protecting information (or failing to do so) has continued to receive regulatory focus. This includes the SEC’s new cybersecurity reporting obligations for public companies, as well as minor modifications to Utah’s data breach notification law.

Finally, there have been new laws directed to particular individuals. In particular, laws intended to protect children. These include social media laws in Florida and Utah, effective January 1, 2025 and October 1, 2024 respectively. These are similar to attempts to regulate social media’s collection of information from children in Arkansas, California, Ohio and Texas, but the drafters hope sufficiently different to survive challenges currently being faced by those laws. The FTC is also exploring updates to its decades’ old Children’s Online Privacy Protection Act.

Putting It Into Practice: As we approach the mid-point of the year, now is a good time to look back at privacy developments over the past six months. There have been many developments in the privacy patchwork, and companies may want to take the time now to ensure that their privacy programs have incorporated and addressed those laws’ obligations.

Listen to this post

Copyright © 2024, Sheppard Mullin Richter & Hampton LLP.
For more on Privacy, visit the NLR Consumer Protection section.

NIST Releases Risk ‘Profile’ for Generative AI

A year ago, we highlighted the National Institute of Standards and Technology’s (“NIST”) release of a framework designed to address AI risks (the “AI RMF”). We noted how it is abstract, like its central subject, and is expected to evolve and change substantially over time, and how NIST frameworks have a relatively short but significant history that shapes industry standards.

As support for the AI RMF, last month NIST released in draft form the Generative Artificial Intelligence Profile (the “Profile”).The Profile identifies twelve risks posed by Generative AI (“GAI”) including several that are novel or expected to be exacerbated by GAI. Some of the risks are exotic and new, such as confabulation, toxicity, and homogenization.

The Profile also identifies risks that are familiar, such as those for data privacy and cybersecurity. For the latter, the Profile details two types of cybersecurity risks: (1) those with the potential to discover or enable the lowering of barriers for offensive capabilities, and (2) those that can expand the overall attack surface by exploiting vulnerabilities as novel attacks.

For offensive capabilities and novel attack risks, the Profile includes these examples:

  • Large language models (a subset of GAI) that discover vulnerabilities in data and write code to exploit them.
  • GAI-powered co-pilots that proactively inform threat actors on how to evade detection.
  • Prompt-injections that steal data and run code remotely on a machine.
  • Compromised datasets that have been ‘poisoned’ to undermine the integrity of outputs.

In the past, the Federal Trade Commission (“FTC”) has referred to NIST when investigating companies’ data breaches. In settlement agreements, the FTC has required organizations to implement security measures through the NIST Cybersecurity Framework. It is reasonable to assume then, that NIST guidance on GAI will also be recommended or eventually required.

But it’s not all bad news – despite the risks when in the wrong hands, GAI will also improve cybersecurity defenses. As recently noted by Microsoft’s recent report on the GDPR & GAI, GAI can already: (1) support cybersecurity teams and protect organizations from threats, (2) train models to review applications and code for weaknesses, and (3) review and deploy new code more quickly by automating vulnerability detection.

Before ‘using AI to fight AI’ becomes legally required, just as multi-factor authentication, encryption, and training have become legally required for cybersecurity, the Profile should be considered to mitigate GAI risks. From pages 11-52, the Profile examines four hundred ways to use the Profile for GAI risks. Grouping them together, some of the recommendations include:

  • Refine existing incident response plans and risk assessments if acquiring, embedding, incorporating, or using open-source or proprietary GAI systems.
  • Implement regular adversary testing of the GAI, along with regular tabletop exercises with stakeholders and the incident response team to better inform improvements.
  • Carefully review and revise contracts and service level agreements to identify who is liable for a breach and responsible for handling an incident in case one is identified.
  • Document everything throughout the GAI lifecycle, including changes to any third parties’ GAI systems, and where audited data is stored.

“Cybersecurity is the mother of all problems. If you don’t solve it, all the other technology stuff just doesn’t happen” said Charlie Bell, Microsoft’s Chief of Security, in 2022. To that end, the AM RMF and now the Profile provide useful and early guidance on how to manage GAI Risks. The Profile is open for public comment until June 2, 2024.

© Polsinelli PC, Polsinelli LLP in California
For more on Generative AI, visit the NLR Communications, Media & Internet section.

Update on FTC Noncompete Ban: Court Challenges Begin

On April ­­23 we reported on the Federal Trade Commission’s vote to ban almost all non-competition agreements in the United States. Within hours of that vote, Ryan LLC, a global tax consulting firm headquartered in Dallas, filed a lawsuit in the U.S. District Court for the Northern District of Texas challenging the FTC’s authority to issue such a rule.

The U.S. Chamber of Commerce has been allowed to intervene in that case and will join in the challenge to the FTC ban.

Ryan’s claims are that:

  1. The FTC lacks the legal authority to promulgate such a rule.
  2. Even if Congress had granted that authority by statute, such a grant would be an unconstitutional delegation of legislative authority to the executive branch, in violation of Article 1 of the U.S. Constitution.
  3. The FTC Act is unconstitutional because it limits the president’s authority to remove subordinates (in this case, FTC Commissioners).
  4. The FTC promulgated the rule in violation of the Administrative Procedure Act because it failed to establish a factual basis for the rule.
  5. The rule is retroactive in purporting to invalidate all existing non-competition agreements, but the FTC has no authority to issue retroactive rules.

Based on our review of the pleadings filed thus far in the case, we think that the U.S. Chamber and its allies agree that these are the correct arguments and that they will file a brief supporting them.

Ryan is asking the court for two things: a stay of the effective date of the rule, and preliminary and permanent injunctions barring the FTC from enforcing it. The case is on an expedited schedule, with briefing to be completed by June 12 and a ruling expected on the pending motion by July 3.

Given that the rule’s effective date is September 4, if the court can meet that schedule, employers should have sufficient time to take the necessary steps to comply, if the court allows the rule to go into effect.

However, we would advise employers to start identifying all employees who are subject to an existing non-competition agreement, so they can move quickly to meet the notice requirements over the summer, should that become necessary.

©2024 Pierce Atwood LLP. All rights reserved.
For more on the FTC Noncompete Ban, visit the NLR Labor & Employment section.

The FTC Has Banned Non-Competes: What Do Employers in the Energy Space Do Now?

When is the FTC’s rule effective?

The FTC’s non-compete ban is not in effect yet. It does not become effective until 120 days after the date of publication in the Federal Register of the final rule. The Federal Register is expected to publish the final rule next week, likely making the effective date around the beginning of September 2024.

Has litigation already been filed to challenge the non-compete ban?

The FTC’s non-compete ban is subject to at least two existing legal challenges seeking to have it invalidated. The U.S. Chamber of Commerce filed a Complaint for Declaratory Judgment and Injunctive Relief in U.S. District Court for the Eastern District of Texas, Tyler Division (Chamber of Commerce of the United States of America v. Federal Trade Commission, Case No. 6:24-cv-00148 (E.D. Tex. filed April 24, 2024); see also Ryan, LLC v. Federal Trade Commission, Case No. 3:24-cv-986 (N.D. Tex. filed April 23, 2024)). We don’t know whether these legal challenges will be successful, but we will provide updates when we know more.

What if the legal challenges are unsuccessful?

If the legal challenges are not successful and the rule goes into effect 120 days from next week (again, approximately early September 2024), here are steps that employers can take to get ready for the effective date:

  • Review existing agreements to determine if they are now “unfair methods of competition”:
    • One issue to analyze is whether an individual with a non-compete is a “worker” or a “senior executive.”
      • If a “senior executive,” then a non-compete in place that pre-exists that effective date can still be enforced.
      • If not a “senior executive,” then any non-compete clause that pre-dates the effective date for a worker is banned by the rule.
      • If an independent contractor (or another non-employee worker), any non-compete clause is banned.
    • Another issue to consider is whether non-solicitation, non-disclosure, or reimbursement provisions could be subject to the FTC ban. A provision that prevents a worker from seeking or accepting work in the U.S. with a different person or from operating a business in the U.S., then it is a “non-compete clause” that is subject to the rule. Depending on the wording and the factual circumstances, an obligation not to solicit customers could be considered a prohibited non-compete. For example, if an obligation not to solicit certain clients keeps a worker from accepting any job in the Permian Basin, it is arguable that the provision operates as a non-compete and violates the rule.
  • Determine whether notice is required: After reviewing which non-compete clauses are not in compliance with the FTC rule, prepare a notice for workers who are currently subject to a non-compete clause banned by the rule. The FTC put out model language on the notification, which informs the worker that the non-compete clause is no longer valid as of the effective date.
  • Update any form agreements: As part of the review of existing non-compete agreements, take the opportunity to update form agreements to remove now unenforceable non-compete (and possibly non-solicit) provisions. It is always a good idea to review and update the agreement generally to make sure that it reflects your current business and definition of confidential information.
  • Enter into non-compete agreements with “senior executives”:
    • The FTC ban permits non-compete agreements with “senior executives” that pre-exist the effective date to continue after the effective date. After the effective date, an employer may not require a senior executive to sign a new non-compete.
    • The term “senior executive” refers to officers earning more than $151,164 with “policy-making authority.” As so defined, the FTC estimates that senior executives represent less than 0.75% of all workers.
    • “Policy-making authority” means “final authority to make policy decisions that control significant aspects of a business entity or common enterprise and does not include authority limited to advising or exerting influence over such policy decisions or having final authority to make policy decisions for only a subsidiary of or affiliate of a common enterprise.”
    • Energy company officers of companies that are part of a common enterprise or joint venture will want to analyze whether senior executives have final authority that qualifies for a non-compete under the rule.
    • As always, any employer should make sure that a non-compete complies with existing state laws to assist in any enforcement efforts.
  • Take note of violations before the effective date: The FTC’s noncompete ban does not apply where a cause of action related to a noncompete clause accrued before the effective date. So, if a worker is violating a noncompete that would otherwise be banned under the FTC rule, an employer may want to consider whether to initiate legal action against that worker before the effective date to fall under this exception.
© 2024 Bradley Arant Boult Cummings LLP
For more on the FTC Noncompete Ban, visit the NLR Labor & Employment section.

FTC: Three Enforcement Actions and a Ruling

In today’s digital landscape, the exchange of personal information has become ubiquitous, often without consumers fully comprehending the extent of its implications.

The recent actions undertaken by the Federal Trade Commission (FTC) shine a light on the intricate web of data extraction and mishandling that pervades our online interactions. From the seemingly innocuous permission requests of game apps to the purported protection promises of security software, consumers find themselves at the mercy of data practices that blur the lines between consent and exploitation.

The FTC’s proposed settlements with companies like X-Mode Social (“X Mode”) and InMarket, two data aggregators, and Avast, a security software company, underscores the need for businesses to appropriately secure and limit the use of consumer data, including previously considered innocuous information such as browsing and location data. In a world where personal information serves as currency, ensuring consumer privacy compliance has never been more critical – or posed such a commercial risk for failing to get it right.

X-Mode and InMarket Settlements: The proposed settlements with X-Mode and InMarket concern numerous allegations based on the mishandling of consumers’ location data. Both companies supposedly collected precise location data through their own mobile apps and those of third parties (through software development kits).  X-Mode is alleged to have sold precise location data (advertised as being 70% accurate within 20 meters or less) linked to timestamps and unique persistent identifiers (i.e., names, email addresses, etc.) of its consumers to private government contractors without obtaining proper consent. Plotting this data on a map makes it easy to reveal each person’s movements over time.

InMarket purportedly utilized location data to cross-reference such data with points of interest to sort consumers into particularized audience segments for targeted advertising purposes without adequately informing consumers – examples of audience segments include parents of preschoolers, Christian church attendees, and “wealthy and not healthy,” among other groupings.

Avast Settlement: Avast, a security software company, allegedly sold granular and re-identifiable browsing information of its consumers despite assuring consumers it would protect their privacy. Avast allegedly collected extensive browsing data of its consumers through its antivirus software and browser extensions while ensuring its consumers that their browsing data would only be used in aggregated and anonymous form. The data collected by Avast revealed visits to various websites that could be attributed to particular people and allowed for inferences to be drawn about such individuals – examples include academic papers on symptoms of breast cancer, education courses on tax exemptions, government jobs in Fort Meade, Maryland with a salary over $100,000, links to FAFSA applications and directions from one location to another, among others.

Sensitivity of Browsing and Location Data

It is important to note that none of the underlying datasets in question contained traditional types of personally identifiable information (e.g., name, identification numbers, physical descriptions, etc.) (“PII”). Even still, the three proposed settlements by the FTC underscore the sensitive nature of browsing and location data due to the insights such data reveals, such as religious beliefs, health conditions, and financial status, and the ease with which the insights can be linked to certain individuals.

In the digital age, the amount of data available about individuals online and collected by various companies makes the re-identification of individuals easier every day. Even when traditional PII is not included in a data set, by linking sufficient data points, a profile or understanding of an individual can be created. When such profile is then linked to an identifier (such as username, phone number, or email address provided when downloading an app or setting up an account on an app) and cross-referenced with various publicly available data, such as name, email, phone number or content on social media sites, it can allow for deep insights into an individual. Despite the absence of traditional types of PII, such data poses significant privacy risks due to the potential for re-identification and the intimate details about individuals’ lives that it can divulge.

The FTC emphasizes the imperative for companies to recognize and treat browsing and location data as sensitive information and implement appropriate robust safeguards to protect consumer privacy. This is especially true when the data set includes information with the precision of those cited by the FTC in its proposed settlements.

Accountability and Consent

With browsing and location data, there is also a concern that the consumer may not be fully aware of how their data is used. For instance, Avast claimed to protect consumers’ browsing data and then sold that very same browsing information, often without notice to consumers. When Avast did inform customers of their practices, the FTC claims it deceptively stated any sharing would be “anonymous and aggregated.” Similarly, X-Mode claimed it would use location data for ad-personalization and location-based analytics. Consumers were unaware such location data was also sold to government contractors.

The FTC has recognized that a company may need to process an individual’s information to provide them with services or products requested by the individual. The FTC also holds that such processing does not mean the company is then free to collect, access, use, or transfer that information for other purposes (e.g., marketing, profiling, background screening, etc.). Essentially, purpose matters. As the FTC explains, a flashlight app provider cannot collect, use, store, or share a user’s precise geolocation data, or a tax preparation service cannot use a customer’s information to market other products or services.

If companies want to use consumer personal information for purposes other than providing the requested product or services, the FTC states that companies should inform consumers of such uses and obtain consent to do so.

The FTC aims to hold companies accountable for their data-handling practices and ensure that consumers are provided with meaningful consent mechanisms. Companies should handle consumer data only for the purposes for which data was collected and honor their privacy promises to consumers. The proposed settlements emphasize the importance of transparency, accountability, meaningful consent, and the prioritization of consumer privacy in companies’ data handling practices.

Implementing and Maintaining Safeguards

Data, especially specific data that provide insights and inferences about individuals, is extremely valuable to companies, but it is that same data that exposes such individuals’ privacy. Companies that sell or share information sometimes include limitations for the use of the data, but not all contracts have such restrictions or sufficient restrictions to safeguard individuals’ privacy.

For instance, the FTC alleges that some of Avast’s underlying contracts did not prohibit the re-identification of Avast’s users. Where Avast’s underlying contracts prohibited re-identification, the FTC alleges that purchasers of the data were still able to match Avast users’ browsing data with information from other sources if the information was not “personally identifiable.” Avast also failed to audit or confirm that purchasers of data complied with its prohibitions.

The proposed complaint against X-Mode recognized that at least twice, X-Mode sold location data to purchasers who violated restrictions in X-Mode’s contracts by reselling the data they bought from X-Mode to companies further downstream. The X-Mode example shows that even when restrictions are included in contracts, they may not prevent misuse by subsequent downstream parties.

Ongoing Commitment to Privacy Protection:

The FTC stresses the importance of obtaining informed consent before collecting or disclosing consumers’ sensitive data, as such data can violate consumer privacy and expose them to various harms, including stigma and discrimination. While privacy notices, consent, and contractual restrictions are important, the FTC emphasizes they need to be backed up by action. Accordingly, the FTC’s proposed orders require companies to design, implement, maintain, and document safeguards to protect the personal information they handle, especially when it is sensitive in nature.

What Does a Company Need To Do?

Given the recent enforcement actions by the FTC, companies should:

  1. Consider the data it collects and whether such data is needed to provide the services and products requested by the consumer and/or a legitimate business need in support of providing such services and products (e.g., billing, ongoing technical support, shipping);
  2. Consider browsing and location data as sensitive personal information;
  3. Accurately inform consumers of the types of personal information collected by the company, its uses, and parties to whom it discloses the personal information;
  4. Collect, store, use, or share consumers’ sensitive personal information (including browser and location data) only with such consumers’ informed consent;
  5. Limit the use of consumers’ personal information solely to the purposes for which it was collected and not market, sell, or monetize consumers’ personal information beyond such purpose;
  6. Design, Implement, maintain, document, and adhere to safeguards that actually maintain consumers’ privacy; and
  7. Audit and inspect service providers and third-party companies downstream with whom consumers’ data is shared to confirm they are (a) adhering to and complying with contractual restrictions and (b) implementing appropriate safeguards to protect such consumer data.
© 2024 Ward and Smith, P.A.. All Rights Reserved.
For more on the FTC, visit the NLR Communications, Media & Internet section.

A Closer Look at the FTC’s Final Non-Compete Rule

On April 23, 2024, the Federal Trade Commission (FTC) issued its Final Non-Compete Agreement Rule (Final Rule), banning non-compete agreements between employers and their workers. The Final Rule will go into effect 120 days after being published in the Federal Register. This Final Rule will impact most US businesses, specifically those that utilize non-compete agreements to protect their trade secrets, confidential business information, goodwill, and other important intangible assets.

The Final Rule prohibits employers from entering or attempting to enter into a non-compete agreement with “workers” (employees and independent contractors). Employers are also prohibited from even representing that a worker is subject to such a clause. The Final Rule provides that it is an unfair method of competition for employers to enter into non-compete agreements with workers and is therefore a violation of Section 5 of the FTC Act.

There are few exceptions under the Final Rule. For senior executives, existing non-compete agreements can remain in force. However, employers are barred from entering or attempting to enter into a non-compete agreement with a senior executive after the effective date of the Final Rule. The Final Rule defines “senior executive” as a worker who is both (1) earning more than $151,164 annually and (2) in a “policy-making position” for the business. For workers who are not senior executives, existing non-competes are not enforceable after the effective date. If not invalidated all together, the Final Rule will likely have extensive litigation related to “policy-making position.” According to the current commentary on the Final Rule, the FTC will likely take the position that “senior executive” is a very limited definition.

Further, the Final Rule does not apply to non-competes entered into pursuant to a “bona fide sale of a business entity, of the person’s ownership interest in [a] business entity, or of all or substantially all of a business entity’s operating assets.” As a result, parties entering into transactions can continue to use non-compete agreements in the sale of a business. But transactional lawyers should note that any non-compete in a subsequent employment agreement with a seller will likely be subject to the Final Rule. The Final Rule also does not prohibit employers from enforcing non-compete clauses where the cause of action related to the non-compete clause occurred prior to the effective date of the Final Rule.

The Final Rule also states that agreements that “penalize” or “function to prevent” an employee from working for a competitor are banned and unlawful. For example, a non-disclosure agreement may be viewed as a non-compete when it is so broad that it functions to prevent workers from seeking or accepting other work or starting a business after they leave their job. Similarly, non-solicitation agreements may also be banned under the new rule “where they function to prevent a worker from seeking or accepting other work or starting a business after their employment ends.” The commentary makes clear that the enforceability and legality of these types of agreements will need to be analyzed on a case-by-case basis.

Under the Final Rule, employers are required to provide clear and conspicuous notice to workers who are subject to a prohibited non-compete. This notice must be sent in an individualized communication (text message, hand delivery, mailed to last known address, etc.) and indicate that the worker’s non-compete clause will not be enforced.

The Final Rule has already been challenged in at least two lawsuits, both filed in the state of Texas. The US Chamber of Commerce filed suit in the US District Court for the Eastern District of Texas seeking a declaratory judgment and an injunction to prevent the enactment of the Final Rule. A second suit, filed by Ryan, LLC, a tax services firm, was filed in the US District Court for the Northern District of Texas. Both suits raise similar arguments: (1) the FTC lacks authority to enact the rule due to the major questions doctrine; (2) the Final Rule is inconsistent with the FTC Act; (3) the retroactive nature of the Final Rule exceeds the FTC’s authority and raises Fifth Amendment concerns; and (4) the Final Rule is arbitrary and capricious. The US Chamber of Commerce has also filed a motion to stay the effective date of the Final Rule pending resolution of the lawsuit.

The very nature of how business entities protect their intangible assets is at risk, and the Final Rule will change the contractual dynamic of the employer-employee relationship.

© 2024 Jones Walker LLP
For more on the FTC Non-Compete Rule, visit the NLR Labor & Employment section.

FTC Moves to Strike Most Noncompetes: Considerations for Cannabis Companies

As Bradley previously reported, the Federal Trade Commission at the beginning of last year issued a notice of proposed rulemaking to effectively ban employee noncompete provisions as an unfair method of competition in violation of Section 5 of the FTC Act. Following a 16-month administrative process that drew more than 26,000 public comments, the FTC on April 23, 2024, issued its final rule that will, according to the FTC, “promote competition by banning noncompetes nationwide, protecting the fundamental freedom of workers to change jobs, increasing innovation, and fostering new business formation.”

Key Features of the Final Rule

Key features of the final rule include:

  • Defining “noncompete clauses” as a term or condition of employment that either “prohibits” a worker from, “penalizes” a worker for, or “functions to prevent” a worker from (a) seeking or accepting work in the United States with a different person where such work would begin after the conclusion of the employment that includes the term or condition; or (b) operating a business in the United States after the conclusion of the employment that includes the term or condition.
  • Treating existing noncompetes differently depending on the category of worker.
    • For “senior executives,” existing noncompetes may remain in force. The term “senior executive” refers to workers earning more than $151,164 who are in a “policy-making position.” As so defined, the FTC estimates that senior executives represent less than 0.75% of all workers.
    • For all other categories of workers, existing noncompetes will be unenforceable following the effective date (i.e., 120 days following its publication on the Federal Register).
  • Banning new noncompetes for all workers following the effective date.
  • Requiring employers to provide “clear and conspicuous notice” to workers who are not senior executives and are subject to existing noncompetes that such provisions are no longer enforceable. The FTC included model language in the final rule that satisfies the notice requirements.
  • Excluding banks but not bank affiliates. Because the FTC does not have regulatory authority over banks, it does not apply to banks. The rule does apply to bank affiliates however as those entities are within FTC jurisdiction.
  • Excluding nonprofit entities. The final rule does not apply to nonprofit entities, such as nonprofit hospitals, as they fall outside of the jurisdiction of the FTC Act. The FTC notes, however, that not all entities that claim tax-exempt status in their tax filings are automatically outside of the scope of the final rule. Rather, the FTC applies a two-part test to determine whether the purported nonprofit is within the scope of the FTC Act, focusing on the source of the entity’s income and the destination of the income.
  • Excluding noncompetes in the sale of business context. The final rule generally does not apply to business owners upon the “bona fide” sale of a business. The final rule expanded the sale of business exception found in the proposed rule.
  • The final rule does not apply where a cause of action related to a noncompete accrued prior to the effective date of the final rule.

What Does the New Rule Mean for the Cannabis Industry in Particular?

The FTC contends that the final rule will benefit the U.S. economy by, among other things, increasing worker earnings, reducing healthcare costs, spurring new business formation, and enhancing innovation. But what will it mean for the U.S. cannabis industry specifically?

As we’ve written about before, there’s a significant amount of proprietary information that may give players in the cannabis space a competitive edge – e.g., customer lists, grow processes, or unique cannabinoid extracts, plants, and products. Because marijuana is still a Schedule I substance under the Controlled Substance Act, however, there are open questions about whether an entity engaged in marijuana-related commercial activity can avail itself of federal law protections, such as U.S. patent and trademark laws. If an entity cannot avail itself of those federal law protections, the ability to turn to state contract law becomes even more important to protect its investments. That’s where noncompetes could come in — going a long way to protect an individual from taking and utilizing a company’s or individual’s investments. The FTC final rule largely would put an end to the ability to use noncompete protections, save for the exceptions outlined above. That may be an even bigger blow to the cannabis industry as compared to other industries who can readily utilize federal law protections. On the other hand, the cannabis industry is largely transient and collaborative, and many cannabis companies and individuals in the industry may be willing to take the good with the bad when it comes to the absence of noncompete rules.

What’s Next?

First, the final rule is not yet in effect. It will go into effect 120 days after its publication in the Federal Register.

Second, we expect there will be significant legal challenges and efforts to halt the implementation of the rule.

The final rule was issued following a 3-2 vote by the commissioners, with the two newly appointed Republican commissioners – Melissa Holyoak and Andrew Ferguson – voting against the rule. In their prepared remarks, the dissenting commissioners questioned the FTC’s legal authority to take such sweeping action.

The final rule has already prompted a legal challenge. Shortly after the FTC’s public meeting approving the final rule, the U.S. Chamber of Commerce released a statement indicating its intent to “sue the FTC to block this unnecessary and unlawful rule and put other agencies on notice that such overreach will not go unchecked.” True to its word, the Chamber filed yesterday a Complaint for Declaratory Judgment and Injunctive Relief in U.S. District Court for the Eastern District of Texas (Chamber of Commerce of the United States of America v. Federal Trade Commission, Case No. 6:24-cv-00148 (E.D.Tex. filed April 24, 2024)). The lawsuit mounts a number of legal challenges to the final rule.

© 2024 Bradley Arant Boult Cummings LLP
For more on FTC Noncompete Ban, visit the NLR Labor & Employment section.