The Federal Trade Commission has a well-documented history of asserting regulatory powers beyond anything granted to it by Congress. Just last year, in AMG Capital Management, LLC v. FTC, the Supreme Court unanimously rejected the Commission’s decades-long claim that it can seek equitable monetary relief, like restitution and disgorgement, in enforcement actions.
The Commission recently announced a proposed consent agreement with Drizly, the alcoholic beverage delivery company, and its CEO, James Cory Rellas, for alleged consumer data breaches. Under the current proposal, for the next ten years, Mr. Rellas is personally required to “ensure” that any business that he is a majority owner of or works for in a “senior” capacity maintains an information security program dictated by the Commission. Put another way, the Commission has decided that it will follow enforcement targets to future corporate endeavors and control those individuals and companies based on conduct that occurred at an entirely different company.
This proposed order marks a dramatic departure from Commission practice and presumes a right to control companies and their future conduct that have never been before it for any infraction. FTC has no such power—it only wishes it had. FTC, a repeat offender in conjuring up oversight powers and enforcement remedies from thin air, has outdone itself.
Just two weeks ago, the Commission was before the Supreme Court again in a case called Axon Enterprise, Inc. v. FTC, in which the FTC objected to Axon’s acquisition of a competing small maker of police bodycams. While the Axon case focuses on the technical issue of whether regulated parties may sue agencies in federal district court for constitutional challenges—a similar issue at the core of Michelle Cochran’s challenge to the Securities and Exchange Commission and argued on the same day—was propelled into court by an outrageous demand by the FTC that in order to avoid suit, it must not only divest the company, but that it had to turn over its intellectual property to what would now be a competitor. Otherwise, FTC would sue Axon in its infamous in-house courts where the Commission wins 100% of the time.
The Commission has become the hungry hungry hippo of the administrative state, inventing regulatory power it lacks, and jurisdiction over aspects and sectors of the economy it has no power to regulate. No act of Congress authorizes FTC’s self-conferred regulatory expansion.
Not only has Congress not enacted a comprehensive data protection and practices regime—the record shows that it has rejected such proposed legislation for years—nothing in its existing powers authorizes the Commission to substitute its judgment about internal business operations of private companies which, as far as the Commission knows, have never done anything wrong.
The Commission also runs headlong into the First Amendment. Because the proposed order requires Mr. Rellas to “ensure” compliance with FTC’s view of data security, he, and any future companies he may work for or own, will be compelled to propound the Commission’s content- and viewpoint-favoring speech and be forced to expend financial resources constructing such a regime. FTC’s edict necessarily dictates not only the content and viewpoint of his future speech but also that of any companies he works for in the future. Effectively, it requires him and companies he may work for or own to adopt the Commission’s view that it not only has the power to regulate information security practices but also how that goal should be achieved—a decision which belongs to Congress alone.
The Commission is accepting comments regarding the proposed settlement through December 1.