Electronic Privacy Information Center v. Federal Trade Commission

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
____________________________________
)
ELECTRONIC PRIVACY )
INFORMATION CENTER, )
)
Plaintiff, )
)
v. ) Civil Action No. 12-0206 (ABJ)
)
FEDERAL TRADE COMMISSION, )
)
Defendant. )
____________________________________)
MEMORANDUM OPINION
Plaintiff Electronic Privacy Information Center (“EPIC”) brings this action against
defendant Federal Trade Commission (“the FTC”) seeking injunctive relief under the
Administrative Procedure Act (“APA”), 5 U.S.C. § 701, et seq. EPIC asks the Court to compel
the FTC to enforce a consent order the agency signed with Google, Inc. in October 2011 (“the
Consent Order”) concerning the company’s social networking service, Google Buzz.
Google announced in January 2012 that it would implement changes to its user privacy
policies for all of its services. EPIC contends that this intended policy change, which is
scheduled to take effect on March 1, 2012, will violate the Consent Order. Although EPIC is not
a party to the Consent Order, it filed a motion for temporary restraining order and preliminary
injunction on the grounds that the FTC has a “mandatory, nondiscretionary duty” to enforce it.
Compl. ¶ 63. The FTC opposed the motion [Dkt. # 7] and moved to dismiss the complaint [Dkt.
# 8]. The Court will deny EPIC’s motion for temporary restraining order and preliminary
injunction and grant the FTC’s motion to dismiss because enforcement decisions are committed
to agency discretion and are not subject to judicial review.
I. BACKGROUND
A. Factual Background
1. The Consent Order Concerning Google Buzz
The complaint alleges that on February 16, 2010, EPIC filed a complaint urging the FTC
to investigate whether Google’s social networking service, Google Buzz, violated the Federal
Trade Commission Act (“FTC Act”), 15 U.S.C. § 45 (2006). Compl. ¶ 26. The FTC
subsequently initiated an investigation, and on March 30, 2011, it announced a proposed Consent
Order with Google. Id. ¶ 33. After a period of public comment, the FTC approved a final
Consent Order on October 13, 2011. Id. ¶¶ 40–41; Ex. 9 to Mot. for TRO/PI. The Consent
Order, which contains nine parts, included the following relevant provisions:
“Part I prohibits Google from misrepresenting (a) the extent to which it ‘maintains and
protects the privacy and confidentiality’ of personal information, and (b) the extent to
which it complies with the U.S.-E.U. Safe Harbor Framework.” Compl. ¶ 44.
“Part II requires Google to obtain ‘express affirmative consent’ before ‘any new or
additional sharing by [Google] of the Google user’s identified information with any third
party . . . .” Id. ¶ 45 (brackets and ellipses in original).
“Part III requires Google to implement a ‘comprehensive privacy program’ that is
designed to address privacy risks and protect the privacy and confidentiality of personal
information.” Id. ¶ 46.
2. Google Announces New Privacy Policies
On January 24, 2012, Google announced that, effective March 1, 2012, the company
would implement new privacy policies that would alter the “use of personal information”
obtained from users. Id. ¶ 49. The complaint alleges that “[r]ather than keeping personal
information about a user of a given Google service separate from information gathered from
other Google services,” the new policies “will consolidate user data from across its services and
2
create a single merged profile for each user.” Id. ¶ 50. According to EPIC, these anticipated
changes would violate Parts I(a), I(b), II, and III of the Consent Order. Id. ¶¶ 7, 14, 54–57.
EPIC contends that the FTC has failed to take any action with respect to Google’s
announced new privacy policies, and that the agency has a “mandatory nondiscretionary
obligation” to enforce the Consent Order under the FTC Act. As a consequence of this alleged
non-enforcement, EPIC avers that the FTC has “plac[ed] the privacy interests of literally
hundreds of millions [sic] Internet users at grave risk.” Id. ¶ 12.
B. The Lawsuit Before the Court
EPIC filed this suit on February 8, 2012, alleging one count under section 706(1) of the
APA, seeking “to compel agency action unlawfully withheld.” Id. ¶ 1. EPIC asserts that the
FTC has “failed to take any action regarding this matter,” Compl. ¶ 12; that the FTC’s “failure to
[a]ct constitutes a final agency action,” id. ¶ 62; and that “[t]he FTC has mandatory,
nondiscretionary duty to enforce” the Consent Order, id. ¶ 63.
EPIC filed a motion for temporary restraining order and preliminary injunction, asking
the Court to compel the FTC to “enforce the Commission’s consent order[.]” Mot. for TRO/PI at
1. Pursuant to the Court’s Minute Order on February 10, 2012, the FTC filed a pleading that
served as both its opposition to the motion for temporary restraining order and preliminary
injunction and a motion to dismiss pursuant to Fed. R. Civ. P. 12(b)(1) and 12(b)(6).
II. STANDARD OF REVIEW
A. Motion for a Temporary Restraining Order and Preliminary Injunction
When considering a motion for a temporary restraining order or preliminary injunction,
the Court must consider whether the movant has met its burden of demonstrating that “(1) it has
a substantial likelihood of succeeding on the merits; (2) it will suffer irreparable harm if the
3
injunction is not granted; (3) other interested parties will not suffer substantial harm if the
injunction is granted; and (4) the public interest would be furthered by the injunction.” Sea
Containers Ltd. v. Stena AB, 890 F.2d 1205, 1208 (D.C. Cir. 1989). “The court considers the
same factors in ruling on a motion for a temporary restraining order and a motion for a
preliminary injunction.” Morgan Stanley DW Inc. v. Rothe, 150 F. Supp. 2d 67, 72 (D.D.C.
2001). The likelihood of success requirement is the most important of these factors. See Biovail
Corp. v. FDA, 448 F. Supp. 2d 154, 159 (D.D.C. 2006). When plaintiff has failed to show a
likelihood of success on the merits, the “court need not proceed to review the other three
preliminary injunction factors.” Ark. Dairy Coop. Ass’n v. Dep’t of Agric., 573 F.3d 815, 832
(D.C. Cir. 2009); see also Apotex, Inc., v. FDA, 449 F.3d 1249, 1253–54 (D.C. Cir. 2006).
B. Motion to Dismiss
In evaluating a motion to dismiss under either Rule 12(b)(1) or 12(b)(6), the Court must
“treat the complaint’s factual allegations as true . . . and must grant plaintiff ‘the benefit of all
inferences that can be derived from the facts alleged.’” Sparrow v. United Air Lines, Inc., 216
F.3d 1111, 1113 (D.C. Cir. 2000), quoting Schuler v. United States, 617 F.2d 605, 608 (D.C. Cir.
1979) (citations omitted). Nevertheless, the Court need not accept inferences drawn by the
plaintiff if those inferences are unsupported by facts alleged in the complaint, nor must the Court
accept plaintiff’s legal conclusions. Browning v. Clinton, 292 F.3d 235, 242 (D.C. Cir. 2002).
Under Rule 12(b)(1), the plaintiff bears the burden of establishing jurisdiction by a
preponderance of the evidence. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992);
Shekoyan v. Sibly Int’l Corp., 217 F. Supp. 2d 59, 63 (D.D.C. 2002). Federal courts are courts of
limited jurisdiction and the law presumes that “a cause lies outside this limited jurisdiction.”
Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). When considering a
4
motion to dismiss for lack of jurisdiction, unlike when deciding a motion to dismiss under Rule
12(b)(6), the court “is not limited to the allegations of the complaint.” Hohri v. United States,
782 F.2d 227, 241 (D.C. Cir. 1986), vacated on other grounds, 482 U.S. 64 (1987). Rather, a
court “may consider such materials outside the pleadings as it deems appropriate to resolve the
question of whether it has jurisdiction in the case.” Scolaro v. D.C. Bd. of Elections & Ethics,
104 F. Supp. 2d 18, 22 (D.D.C. 2000), citing Herbert v. Nat’l Acad. of Scis., 974 F.2d 192, 197
(D.C. Cir. 1993); see also Jerome Stevens Pharms., Inc. v. FDA, 402 F.3d 1249, 1253 (D.C. Cir.
2005).
“To survive a [Rule 12(b)(6)] motion to dismiss a complaint must contain sufficient
factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v.
Iqbal, 556 U.S. 662, 129 S. Ct. 1937, 1949 (2009) (internal quotation marks omitted); see also
Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the
pleaded factual content “allows the court to draw the reasonable inference that the defendant is
liable for the misconduct alleged.” Iqbal, 129 S. Ct. at 1949. “The plausibility standard is not
akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant
has acted unlawfully.” Id. A pleading must offer more than “labels and conclusions” or a
“formulaic recitation of the elements of a cause of action,” id. at 1949, quoting Twombly, 550
U.S. at 570, and “the tenet that a court must accept as true all of the allegations contained in a
complaint is inapplicable to legal conclusions.” Id. In ruling upon a motion to dismiss, a court
may ordinarily consider only “the facts alleged in the complaint, documents attached as exhibits
or incorporated by reference in the complaint, and matters about which the Court may take
judicial notice.” Gustave-Schmidt v. Chao, 226 F. Supp. 2d 191, 196 (D.D.C. 2002) (citations
omitted).
5
III. ANALYSIS
Although there is a strong presumption that agency action is subject to judicial review,
see Citizens to Pres. Overton Park, Inc., v. Volpe, 401 U.S. 402, 410 (1971), the APA codifies
the traditional exception that agency action is not reviewable when it is “committed to agency
discretion by law.” 5 U.S.C. § 701(a). EPIC brings its claim under section 706(1) of the APA,
which allows courts to “compel action unlawfully withheld or unreasonably delayed.” 5 U.S.C.
§ 706(1). But a claim under section 706(1) can proceed only where a plaintiff asserts that an
agency failed to take a discrete agency action that it is required to take.” Norton v. S. Utah
Wilderness Alliance, 542 U.S. 55, 64 (2004) (emphasis in original).
The FTC argues that under the Supreme Court’s decision in Heckler v. Chaney, 470 U.S.
821 (1985), the enforcement action EPIC seeks to compel is not subject to judicial review
because it is committed to agency discretion. FTC Opp./MTD [Dkt. # 7 and # 8] at 6. In
Chaney, a group of prison inmates sought to compel the Food and Drug Administration to
initiate an enforcement action with respect to the drugs used for capital punishment. Id. at 823.
The Court held that “an agency’s decision not to prosecute or enforce, whether through civil or
criminal process, is a decision generally committed to an agency’s absolute discretion” and is
therefore unreviewable under the APA. Id. at 831.
The Court explained that the availability of judicial review is determined by the
legislature in the first instance, and that if the Congress has not provided courts with “law to
apply,” agency action will be considered to be committed to the agency’s discretion. Id. at 834.
If [Congress] has indicated an intent to circumscribe agency enforcement
discretion, and has provided meaningful standards for defining the limits of that
discretion, there is “law to apply” under §701(a)(2), and courts may require that
the agency follow that law; if it has not, then an agency refusal to institute
proceedings is a decision “committed to agency discretion by law” within the
meaning of that section.
6
Id. The Court determined that the action at issue in Chaney was committed to the agency’s
discretion because the statute was “drawn so that a court would have no meaningful standard
against which to judge the agency’s exercise of discretion.” Id. at 830. The Court reasoned:
[A]n agency decision not to enforce involves a complicated balancing of a
number of factors which are peculiarly within its expertise. Thus, the agency
must not only assess whether a violation has occurred, but whether agency
resources are best spent on this violation or another, whether the agency is likely
to succeed if it acts, whether the particular enforcement action requested best fits
the agency’s overall policies, and, indeed, whether the agency has enough
resources to undertake the action at all . . . . The agency is far better equipped than
the courts to deal with the many variables involved in the proper ordering of its
priorities.
Id. at 831–32. A plaintiff may overcome the presumption that agency enforcement decisions are
non-reviewable by showing that “the substantive statute has provided guidelines for the agency
to follow in exercising its enforcement powers.” Id. at 833.
In this case, plaintiff cannot point to any indication that Congress intended courts to
monitor the FTC’s enforcement of its own consent decrees; the statute is devoid of any “law to
apply” or “guidelines” that would signal that judicial review may be undertaken or that set out
the governing standards. EPIC insists nonetheless that Chaney is not controlling because the
FTC has a “mandatory, nondiscretionary duty” to enforce the Consent Order. Compl. ¶ 63.
EPIC points to two provisions of the FTC Act: 15 U.S.C. § 45(a)(2) and § 45(l). Id.
¶ 59; Mot. for TRO/PI at 9–10. The first provision generally establishes the agency’s mission
and states that the FTC is “empowered and directed to prevent persons, partnerships, or
corporations . . . from using unfair methods of competition in or affecting commerce and unfair
or deceptive acts or practices in or affecting commerce.” 15 U.S.C. § 45(a)(2). The second
provision provides:
7
Any person, partnership, or corporation who violates an order of the Commission
after it has become final, and while such order is in effect, shall forfeit and pay to
the United States a civil penalty of not more than $10,000 for each violation,
which shall accrue to the United States and may be recovered in a civil action
brought by the Attorney General of the United States.
Id. § 45(l).
Even if the Court gives the sections of the statute cited by EPIC the most liberal reading
possible, they do not create a mandatory duty to enforce the Consent Order that can be policed
by this Court. EPIC places enormous emphasis on the mandatory language used in the statute,
particularly in the provision that states that violators “shall forfeit a penalty to the United States.”
15 U.S.C. § 45(l) (emphasis added). But that language is not directed at something the agency
must do. Rather, any binding obligations created by that language run to a party in violation of
the Act. 1 Furthermore, as the Supreme Court in Chaney pointed out, many criminal statutes
employ language similar to the words used in the FTC Act. Chaney, 470 U.S. at 835, citing, e.g.,
18 U.S.C. § 1001 (providing that “whoever . . . knowingly and willfully . . . makes any
materially false, fictitious, or fraudulent statement . . . shall be fined [and] imprisoned not more
than five years”). The use of mandatory language in those criminal statutes has never been
interpreted to confer an enforceable duty on the Executive Branch under the APA to prosecute
1 EPIC argues that the use of both mandatory and permissive language in section 45(l)
indicates that Congress intended to create a mandatory duty when it said that “any person . . .
shall forfeit and pay,” because it knew how to create a permissive obligation by stating that a
“penalty . . . may be recovered by the Attorney General.” EPIC Reply/Opp. to MTD at 5–6.
EPIC cites a recent case from the D.C. Circuit in support of this proposition, Sierra Club v.
Jackson, 648 F.3d 848 (D.C. Cir. 2011), in which the court found that “‘shall’ is usually
interpreted as ‘the language of command . . . when a statute uses both ‘may’ and ‘shall,’ the
normal inference is that each is used in its usual sense – the one act being permissive, the other
mandatory.’” Id. at 856 (quotation marks and internal citations omitted). The Court does not
quarrel with the well-settled proposition that the word “shall” creates a mandatory duty. EPIC’s
problem in this case is not the verb in the statute, but the subject of the verb, and the cited
provision simply does not command the FTC to do anything.
8
every arguable violation of the statute. See Chaney, 470 U.S. at 835. Plaintiff has not pointed to
anything that would justify a different result here. 2
The FTC also argues that EPIC has failed to overcome the presumption of non-
reviewability set forth in Chaney because it has not pointed to any guidelines in the FTC Act “for
the agency to follow in exercising its enforcement powers.” Id. at 833. When there is no law to
apply, “the courts have no legal norms pursuant to which to evaluate the challenged action, and
thus no concrete limitations to impose on the agency’s exercise of discretion.” Drake v. FAA,
291 F.3d 59, 70 (D.C. Cir. 2002); see also Padula v. Webster, 822 F.2d 97, 100 (D.C. Cir. 1987)
(“[A]n agency, even one that enjoys broad discretion, must adhere to voluntarily adopted,
binding policies that limit its discretion.”).
EPIC does not directly respond to this argument but it claims that the Court has been
provided with “law to apply.” EPIC Reply/Opp. to MTD at 2–3. EPIC maintains that the
Consent Order itself provides the necessary guidance because it is “precise, made final through a
public-rulemaking, directly tied to the agency’s enforcement power, and explicitly described in
the agency’s enforcement provision.” EPIC Reply/Opp. to MTD at 3. Putting aside the fact that
the Consent Order is not a directive from Congress, the order issued by the agency only governs
Google; it does not provide any “meaningful standards against which to judge the agency’s
exercise of discretion.” See Chaney, 470 U.S. at 830 (emphasis added); and Ex. 9 to Mot. for
TRO/PI at 3, 4, 5, 6, and 7 (“respondent shall . . . “) (emphasis added). Although the termination
provision reflects that the FTC may at some point file a complaint in federal court alleging that
2 EPIC also argues that Chaney does not preclude judicial review because the FTC Act is
“more precise” than the enforcement statute in Chaney. EPIC Reply/Opp. MTD at 5. Even if
the Court agreed with that assessment, it would not alter the conclusion that the statute only
mandates that violators of the Act take certain actions when a violation has occurred, and it
requires nothing of the agency. See 15 U.S.C. § 45(1).
9
the Consent Order has been violated, nothing in the Consent Order could be construed as
creating a mandatory duty for the FTC to do that. See Ex. 9 to Mot. for TRO/PI at 7. Notably,
EPIC fails to identify any specific language that it believes creates such a duty. 3
EPIC also attempts to distinguish Chaney by arguing that the holding was limited to the
initiation of enforcement actions and that EPIC has “not asked the FTC to institute proceedings.”
EPIC Reply/Opp. to MTD at 4 (internal quotation marks omitted). Instead, “it has asked the
agency to enforce a final order that resulted from the agency’s own prior investigation and
enforcement actions.” Id. This is a distinction without a difference and not supported by the
clear holding in Chaney that an “agency’s decision not to prosecute or enforce . . . is a decision
generally committed to an agency’s absolute discretion.” Chaney, 470 at 831. Nothing in the
Supreme Court’s reasoning suggests that it intended to limit its holding only to the initiation of
enforcement actions. Even if the distinction that EPIC made was justified by Chaney, this Court
disagrees with EPIC’s characterization that it is only asking the FTC continue or resume
enforcement of action already begun. The complaint expressly asks the Court to “order
defendant to take all steps within the Commission’s authority to enforce the October 13, 2011
3 Even if plaintiff could somehow point to a mandatory duty on the part of the agency, the
Court has serious doubts as to whether plaintiff has properly alleged final agency action and
whether this matter is ripe. EPIC conceded during the conference with the Court that it has not
even asked the agency to act. Moreover, the Court can hardly conclude that the agency – which
has informed the Court that its review of the matter is underway – has already reached a final
decision on whether to institute a suit alleging that the new policy violates the Consent Order
when the new policy was first announced only two weeks before this action was filed, and it has
not yet even gone into effect. And, even if the new policy would automatically violate the
Consent Order if implemented, no sanctionable violation has occurred to date.
Under the APA, a court can only review final agency action, which occurs when “[f]irst,
the action [] mark[s] the consummation of the agency’s decisionmaking process . . . [and]
second, the action [is] one by which rights or obligations have been determined, or from which
legal consequences will flow.” Bennett v. Spear, 520 U.S. 154, 177–78 (1997) (internal
quotation marks and citations omitted). EPIC has not alleged that either of those things has
occurred here.
10
consent order.” Compl. at 8 (prayer for relief) (emphasis added). It does not ask the Court to
order the FTC to continue or resume its enforcement of a prior investigation.
At bottom, the FTC’s decision whether to take action with respect to a potential violation
of the Consent Order is a quintessential enforcement decision that is committed to the agency’s
discretion and is not subject to judicial review. See Massachusetts v. EPA, 549 U.S. 497, 527
(2007) (“[Agency] discretion is at its height when the agency decides not to bring an
enforcement action.”). The FTC is in the best position to evaluate whether Google’s new
policies will in fact violate the Consent Order, and if so, what course of action the agency should
pursue. See Chaney, 470 U.S. at 831–32. 4
The Court wishes to underscore that this decision should not be interpreted as expressing
any opinion about the merits of EPIC’s challenge to Google’s new policies. Since judicial
review is unavailable here, the Court has not reached the question of whether the new policies
would violate the Consent Order or if they would be contrary to any other legal requirements.
EPIC – along with many other individuals and organizations – has advanced serious concerns
that may well be legitimate, and the FTC, which has advised the Court that the matter is under
review, may ultimately decide to institute an enforcement action. See Minute Order, Feb. 9,
4 EPIC cites several cases for the proposition that “enforcement actions” are subject to
review, see Reply/Opp. to MTD at 1 n.1, but it does not accurately characterize those precedents.
Mistick PBT v. Chao, 440 F.3d 503 (D.C. Cir. 2006), did not involve an agency’s discretionary
decision to enforce the law or its own consent decree; the court found that the Department of
Labor’s application of its wage conformance regulations was subject to judicial review. And
Abbott Labs v. Gardner, 387 U.S. 136 (1967), authorized judicial review of regulations
promulgated by the Commissioner of Food and Drugs to “enforce” recent amendments of the
Food, Drug, and Cosmetic Act, not of an “enforcement action.”
EPIC also relies heavily on United States v. Daniel Chapter One, 793 F. Supp. 2d 157(D.D.C. 2011) and announces, “[t]he court in Daniel Chapter One had no difficulty assessing a
complex Modified Final Order and determining that ‘interim injunctive relief is warranted.’”
EPIC Reply/Opp. to MTD at 12. But what EPIC conveniently neglects to point out is that
Daniel Chapter One was an enforcement action brought by the government; it does not stand in
any way for the proposition that the Court can reach out and order the FTC to file such a case.
11
2012; FTC Opp./MTD at 10 n.5. So neither EPIC, nor Google, nor any party with an interest in
internet privacy should draw any conclusions about the Court’s views on those matters from this
opinion.
IV. CONCLUSION
Because the FTC’s decision whether to enforce the Consent Order is committed to
agency discretion and is not subject to judicial review, plaintiff has failed to show a likelihood of
success on the merits. The Court need not consider the three factors remaining factors for
injunctive relief. See Ark. Dairy Coop. Ass’n Inc., 573 F.3d at 832. For the same reason, the
complaint fails to state a claim upon which relief can be granted.
Accordingly, the Court will deny EPIC’s motion for temporary restraining order and
preliminary injunction [Dkt. # 2] and will grant the FTC’s motion to dismiss [Dkt. # 7]. 5 This
case will be dismissed with prejudice. A separate order will issue.
AMY BERMAN JACKSON
United States District Judge
DATE: February 24, 2012
5 The FTC moved to dismiss under Fed. R. Civ. P 12(b)(1) for lack of subject matter
jurisdiction and 12(b)(6) for failure to state a claim. The Court grants the motion to dismiss
pursuant to Rule 12(b)(6) because the D.C. Circuit has clarified that “a plaintiff who challenges
[an action committed to agency discretion] cannot state a claim under the APA.” Oryszak v.
Sullivan, 576 F.3d 522, 525 (D.C. Cir. 2009). It does not reach the FTC’s argument that the case
should be dismissed under Rule 12(b)(1) because it is “so attenuated and unsubstantial as to
absolutely devoid of merit.” FTC Opp./MTD at 4, citing Hagans v. Lavine, 415 U.S. 528, 536–
37 (1974).
12