Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 1 of 18 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA UNITED STATES OF AMERICA, Plaintiff, v. FACEBOOK INC., Defendant. Civ. ActionNo. l:19-cv-02184 REPLY OF THE ELECTRONIC PRIVACY INFORMATION CENTER TO RESPONSES OF UNITED STATES AND FACEBOOK TO MOTION TO INTERVENE Neither the Government nor Facebook oppose EPIC’s motion to participate in this case as amici, or EPIC’s motion that the Court allow other interested parties the opportunity to participate in this case. The Government and Facebook also do not contest that the Court must closely scrutinize the proposed settlement. The only issues in dispute are (1) whether the Court should grant EPIC’s motion to join as an intervenor under FRCP 24 1 and (2) whether the Court should review the proposed Stipulated Order (“FTC-Facebook Consent Decree”) under the fairness and public interest standard established by the D.C. Circuit in Citizens for a Better Environment v. Gorsuch, 718 F.2d 1117, 1 125-26 (D.C. Cir. 1983), see also In re Idaho Conservation League, 811 F.3d 502, 515 (D.C. Cir. 2016) (citing Citizens for a Better Environment, 718 F.2d at 1 125-26), and hold a hearing on that issue. District courts have “wide latitude” to grant intervention, especially permissive intervention under Rule 24(b). In re Endangered Species Act Sec. 4 Deadline Litigation-MDL 1 Neither party opposes EPIC’s alternative request to participate as amicus. The Court should accordingly grant that relief and set a briefing schedule for amicus filings if it denies EPIC’s motion to intervene. 1 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 2 of 18 No. 2165, 704 F.3d 972, 980 (D.C. Cir. 2013) (quoting EEOC v. National Children ’s Ctr., Inc., 146 F.3d 1042 (D.C. Cir. 1998)). The Government incorrectly asserts that an “independent ground for subject-matter jurisdiction” is required. United States Opp’n 12. That is not the case, In re Endangered Species Act, 704 F.3d at 980, and, even if it were, EPIC does have Article III standing to challenge the Federal Trade Commission’s final agency action closing more than 26,000 open complaints (including EPIC’s complaints) against Facebook in an arbitrary, capricious, and unlawful manner. 5 U.S.C. § 706(2)(A). The Commission’s unprecedented decision to offer the largest social media company in the world immunity for all violations of the FTC Act and the prior Consent Order committed over a seven-year period raises significant fairness and arbitrariness concerns that justify EPIC’s intervention and the Court’s close scrutiny. The Court should accordingly grant EPIC’s motion for leave, set a briefing schedule for EPIC and other interested parties to address the fairness and adequacy of the Consent Decree, and hold a hearing to address those issues. I. The Court must evaluate the fairness, adequacy, and public interest of the proposed consent decree, and a hearing with full participation by interested parties would facilitate that evaluation. The Government fails in its opposition to address the requirement that courts “assess whether [a proposed consent decree] fairly and reasonably resolves the controversy in a manner consistent with the public interest.” United States v. District of Columbia, 933 F. Supp. 42, 46 (D.D.C. 1996) (citing Citizens for a Better Environment, 718 F.2d at 1 126). While it is true that a court does not “substitute its judgment for that of the parties to the decree,” the Court must “assure itself that the terms of the decree are fair and adequate and are not unlawful, unreasonable, or against public policy.” Id. (citation omitted). The consent decree must be (1) “both procedurally and substantively fair;” (2) “adequate, reasonable, and appropriate” “from an objective point of view,” focusing “on the extent to which the decree is confined to the dispute 2 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 3 of 18 between the parties and whether the decree adequately accomplishes its purported goal;” and (3) “consistent with the public interest.” Appalachian Voices v. McCarthy, 38 F. Supp. 3d 52, 55-57 (D.D.C. 2014). EPIC has raised concerns about the fairness, adequacy, and public interest in the proposed FTC-Facebook Consent Decree. In opposition, the Government focuses only on the public interest prong, asserting that there is no disagreement about the public interest in the proposed consent decree. But EPIC does disagree that the proposed consent decree is in the public interest. And the Government’s reliance on United States v. Western Electric Company, 900 F.2d 283 (D.C. Cir. 1990), is misplaced because they have quoted the decision out of context. The operative test in the D.C. Circuit for a court reviewing a proposed consent decree is the fairness and public interest test outlined in Citizens for a Better Environment, 718 F.2d at 1 125-26. The court in Western Electric did not call this standard into question. Indeed, the court was not reviewing a new agency consent decree at all, but instead was considering whether to modify an earlier consent decree under the terms established by a judge in the original antitrust case against AT&T. Western Electric , 900 F.2d at 289. The phrase “within the reaches of the public interest” refers to the more relaxed standard that the court found could be applied to certain types of modifications to antitrust consent decrees. Id. at 302. That test is simply not applicable here. The Government also claims that EPIC’s request for a hearing should be disallowed because it calls for judicial review similar to that in the class action context. But courts are routinely required to assess the fairness, adequacy, and public interest of agency consent decrees, and routinely hold hearings to assist in that assessment, outside of class action. See, e.g., Citizens for a Better Environment, 718 F.2d at 1 120; City of Colton v. Am. Promotional Events, Inc., 281 3 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 4 of 18 F. Supp. 3d 1099, 1010 (C.D. Cal. 2017); In re: Volkswagen "Clean Diesel” Marketing, Sales Practices, and Products Liab. Litig., MDL No. 2672, 2017 WL 2214655 (N.D. Cal. May 17, 2017); United States v. Google Inc., No. 12-04177, 2012 WL 5833994 (N.D. Cal. Nov. 16, 2012); Turtle Island Restoration Network v. U.S. Dep’t of Commerce, 834 F. Supp. 2d 1004, 1004 (D. Haw. 2011); Northeast Iowa Citizens for Clean Water v. AgriProcessors, Inc., 469 F. Supp. 2d 666, 671 (N.D. Iowa 2006); Envtl. Tech. Council v. Browner, Nos. 94-2119, 94-2346, 1995 WL 238328, *1 (D.D.C. Mar. 8, 1995). A hearing would aid the Court and interested persons in understanding the implications of the settlement. For instance, the effect of the settlement on complaints brought under certain statutory provisions, such as COPPA, is currently unclear. II. EPIC satisfies all requirements to intervene as of right under FRCP 24(a). A. EPIC has a legally protected interest that would be invaded by approval of the Stipulated Order. Contrary to the Government and Facebook’s assertions, EPIC does not claim a right to enforce the FTC Act or the 2012 Consent Order. EPIC does, however, have a right to challenge agency action under the Administrative Procedures Act (“APA”). Under the APA, courts have an obligation to “hold unlawful and set aside agency action, findings, and conclusions found to be . . . arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. § 706(2)(A). EPIC’s legal interest here is twofold: (1) the FTC’s decision to grant Facebook immunity for unlawful business practices that EPIC identified in complaints to the agency without addressing those practices in the Consent Decree, or even acknowledging them in the complaint, is arbitrary and capricious and harms both EPIC as an organization and the privacy interests of its members; and (2) the FTC’s decision to characterize the Stipulated Order as an amendment to the 2012 Consent Order, and not as a new consent agreement requiring the 4 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 5 of 18 Commission to seek public comment, 16 CFR § 2.34(c) (“Public comment: Promptly after its acceptance of the consent agreement, the Commission will place the order contained in the consent agreement, the complaint, and the consent agreement on the public record for a period of 30 days, or such other period as the Commission may specify, for the receipt of comments or views from any interested person. At the same time, the Commission will place on the public record an explanation of the provisions of the order and the relief to be obtained thereby and any other infonnation that it believes may help interested persons understand the order. The Commission also will publish the explanation in the Federal Register.”) is an unlawful agency action that deprives EPIC and others of the opportunity to comment on the proposed Consent Decree. 1. The Stipulated Order is arbitrary and capricious because the Commission seeks to grant Facebook immunity from any unlawful practices in prior consumer complaints, without addressing or even identifying the prior complaints. The FTC’s decision to grant a broad liability release to Facebook, after having received thousands of complaints alleging that the company engaged in unfair and deceptive business practices, is a final agency action subject to judicial review. This is not a “decision not to initiate an enforcement action” exempt from judicial review under Heckler v. Chaney, 470 U.S. 821 (1985). The proposed Consent Decree, if adopted, would fundamentally alter the legal rights and responsibilities of Facebook and of EPIC and other complainants who previously identified business practices that violated the FTC Act and the 2012 Consent Agreement. The Consent Decree, like a refusal to initiate rulemaking, is “less frequent, more apt to involve legal as opposed to factual analysis, and subject to special formalities, including a public explanation.” Mass. v. EPA, 549 U.S. 497, 527 (2007). Like the petition denial in Mass. v. EPA, the proposed Consent Decree also arises out of complaints that EPIC and others “had an undoubted procedural 5 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 6 of 18 right to file in the first instance.” Id.; see 16 C.F.R. § 2.2. The FTC’s decision to issue the stipulated Consent Decree is therefore subject to judicial review, and the agency must establish that it had a “reasoned explanation” for its actions. Mass. v. EPA, 549 U.S. at 534. A “fundamental requirement of administrative law is that an agency set forth its reasons for decision; an agency’s failure to do so constitutes arbitrary and capricious agency action” and warrants reversal. Amerijet Intern., Inc. v. Pistole, 753 F.3d 1343, 1350 (D.C. Cir. 2014) (internal quotation omitted); accord Am. Horse Prot. Ass’n, Inc. v. Lyng, 812 F.2d 1, 4-5 (D.C. Cir. 1987). When denying a petition, an agency must give “[pjrompt notice . . . accompanied by a brief statement of the grounds for denial.” 5 U.S.C. § 555(e) (2012). This Court has recently reaffirmed that a Section 555(e) statement must include, at minimum, an explanation of why the agency “chose to do what it did.” Amerijet, 753 F.3d at 1350 (internal quotation omitted). The Court must ensure that an agency “has adequately explained the facts and policy concerns it relied on” in the order, and the Court must be satisfied “that those facts have some basis in the record.” Defs. of Wildlife v. Gutierrez, 532 F.3d 913, 919 (D.C. Cir. 2008). The Stipulated Order contains a blanket release of liability for business practices that are not addressed, or even discussed, in the Complaint. This liability waiver is a substantial departure from past practice, see Dissenting Statement of Commissioner Rebecca Slaughter, In re Facebook, Inc., Commission File No. 1823109 at 14 (July 24, 2019)2, and is “arbitrary and capricious” with regard to the thousands of consumer privacy complaints currently pending before the Commission. Fox Television Stations, Inc. v. FCC, 280 F.3d 1027, 1047 (D.C. Cir. 2002) (“although the [National Television Station Ownership] Rule is not unconstitutional, the Commission's decision to retain it was arbitrary and capricious and contrary to law because the 2 https://www.ftc.gOv/public-statements/2019/07/dissenting-statement-commissioner-rebecca-kelly-slaughter- regarding-matter. 6 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 7 of 18 Commission failed to give an adequate reason for its decision, . . .”) opinion modified on reh ’g on other grounds, 293 F.3d 537 (D.C. Cir. 2002); see also Hermes Consol., LLC v. EPA, 787 F.3d 568, 576 (D.C. Cir. 2015) (“An agency must ‘provide reasoned explanation for its action,’ which normally requires ‘that it display awareness that it is changing position.’”). The FTC has not provided any reasoned explanation for rejecting the complaints that EPIC and other consumer groups submitted, nor has the Commission offered any reasoned explanation for granting a broad immunity to Facebook for past violations. It is arbitrary and capricious for the Commission to indemnify Facebook for violations, currently pending before the Commission, that the Commission has failed to acknowledge. In her dissent to the proposed settlement, Commissioner Slaughter noted that “in every recent major federal settlement, if there was a liability release, it was cabined to the offenses described in the complaint.” Dissenting Statement of Commissioner Rebecca Slaughter, In re Facebook, Inc., Commission File No. 1823109 at 14 (July 24, 2019). Commissioner Slaughter cited to six prior consent decrees that limit the scope of liability release to the conduct described in the complaint. Consent Decree ]fl[ 61, 64, In re: Oil Spill by the Oil Rig “ Deepwater Horizon ” in the Gulf of Mexico on April 20, 2010, No. 2:10-md-02179-CJB-SS (E.D. La. filed Oct. 5, 20 1 5);3 Stipulation and Order of Settlement and Dismissal with Prejudice at 3, United States v. Wells Fargo Bank, No. 1 : 12-cv-07527-JMF (S.D.N.Y. filed Apr. 8, 2016)4; Stipulation and Order of Settlement and Dismissal at 3, 6, 10, United States ex rel. Hunt v. Citigroup, No. l:ll-cv-05473-VM (S.D.N.Y. filed Feb. 15, 2012)5; Settlement Agreement at 2-5, 8-11, United States ex rel. Thorpe v. GlaxoSmithKline, No. 1 1-10398-RWZ (D. Mass, filed July 2, 2012)6; 3 https://www.epa.gov/sites/production/files/2016-02/documents/deepwaterhorizon-cd.pdf 4 https://www.justice.gov/opa/file/839796/download. 5 https://www.jiistice.gov/archive/usao/nys/pressreleases/Febmaiyl2/citi/citimortgageincsettlementagreement.pdf 6 https://www.justice.gov/sites/default/files/opa/legacy/2012/07/02/avandia-agreement.pdf. 7 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 8 of 18 Consent Judgment at Ex. E ]{ B, CFPB v. Ocwen Fin., No. 1 : 13-cv-02025-RMC (D.D.C. filed Feb. 26, 20 14)7; Consent Decree 203-204, 211, United States v. Chevron U.S.A., No. 3:03- cv-04650-CRB (N.D. Cal. fded June 29, 2005).8 The statement from Chairman Simons, Commissioner Phillips, and Commissioner Wilson attempt to respond to this argument with the assertion that “Releases are a practical reality of settlements and are used as bargaining chips during negotiations to extract the desired relief from a defendant.” Statement of Statement of Chairman Joe Simons and Commissioners Noah Joshua Phillips and Christine S. Wilson, In re Facebook, Inc., Commission File No. 1823109 at 7 (July 24, 20 19). 9 This statement alone is insufficient to support such a broad release. Reasoned decisionmaking requires more than a simple statement of an agency’s determination. “[Cjonclusory statements will not do; an agency’s statement must be one of reasoning.” Amerijet, 753 F.3d at 1350 (internal quotation omitted). Sparse, conclusory statements are “insufficient to assure a reviewing court that the agency’s refusal to act was the product of reasoned decisionmaking.” Am. Horse, 812 F.2d at 6. In addition, an agency’s “reasons for action or inaction must conform to the authorizing statute.” Massachusetts v. EPA, 549 U.S. 497, 533 (2007). Neither of the prior releases referenced in the majority statement are as broad as the Facebook release. The release in Barclays Capital was limited to conduct alleged in the complaint and similar conduct related to other residential mortgage-backed securities deals. Agreement for Compromise Settlement and Release, United States v. Barclays Capital, Inc., No. 16-CV-7057(KAM/JO) (E.D.N.Y. Apr. 24, 2018), ECF No. 137. Similarly, the release in Wells 1 https://files.consumei'fmance.gov/f/201403_cfpb_entered-judgment-with-exhibits_ocwen.pdf 8 https://www.epa.gov/sites/prodiiction/files/documents/chevron-cd.pdf. 9 https://www.ftc.gOv/piiblic-statements/2019/07/statement-chairman-joe-simons-commissioners-noah-joshua- phillips-christine. Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 9 of 18 Fargo was limited to conduct alleged in the complaint and similar conduct relating to single¬ family residential FHA loans. United States v. Wells Fargo Bank, N.A., No. 12CIV7527JMFJCF (S.D.N.Y. Apr. 8, 2016), ECF No. 320. Indeed, Commissioner Slaughter cited the Wells Fargo case in dissent because the Commission in that case did limit the scope of conduct released. Dissenting Statement of Commissioner Rebecca Slaughter, In re Facebook, Inc., Commission File No. 1823109 at 14 note 36 (July 24, 2019). 10 If the commission were to follow the precedent of the two cases cited, it would cabin the release to certain allegations or conduct, such as violations related to facial recognition, explicitly described in the Stipulated Order. But instead, the stipulated order resolves all claims that Facebook violated the 2012 Consent Order and all consumer-protection claims that Facebook violated Section 5 of the FTC Act known by the FTC prior to June 12, 2019. Stipulated Order, ECF No. 2-1, regardless of whether the agency actually investigated the claims it had received. The unjustifiably broad release grants Facebook immunity for behavior described in the EPIC complaints without addressing the behavior in the Complaint or Stipulated Order. For example, the FTC did not address EPIC’s complaint concerning Facebook's manipulation of users’ News Feeds for psychological research. Complaint, In re Facebook, Inc. (July 3, 20 14). 11 The FTC also did not address EPIC’s complaints concerning WhatsApp. Complaint, In re WhatsApp, Inc. (Mar. 6, 2014). 12 Complaint, In re WhatsApp, Inc. (Aug 29, 2016). 13 The Commission’s arbitrary and capricious release of Facebook’s liability for the business practices 10 https://www.ftc.gov/public-statements/2019/07/dissenting-statement-commissioner-rebecca-kelly-slaughter- regarding-matter. 11 https://epic.org/privacy/internet/ftc/facebook/psycho/Facebook-Sbidy-Complaint.pdf. 12 https://epic.org/privacy/ftc/whatsapp/WhatsApp-Complaint.pdf. 13 https://epic.org/privacy/ftc/whatsapp/EPIC-CDD-FTC-WhatsApp-Complaint-2016.pdf. 9 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 10 of 18 identified in EPIC’s complaints is an invasion of EPIC’s legally protected interests under the APA. 2. The Stipulated Order is unlawful because it contains a new consent agreement that does not adhere to APA comment and review process The FTC’s own regulations require the Commission to place consent agreements on the public record for a thirty-day comment period. 16 C.F.R. § 2.34(c) (“Public Comment”). The proposed Stipulated Order in this case is both monetary penalty for violations of the 2012 Consent Order and a new consent agreement (described as a “modification”). The FTC in its Complaint alleges new violations of Section 5 by Facebook — e.g. Count 6 of the Complaint alleges that Facebook engaged in deceptive practices regarding use of covered information provided for account security. The FTC cannot simply sidestep the public comment process by routing its consent order through a settlement agreement. EPIC routinely comments on FTC consent agreements, making recommendations on changes to the agreement that would improve user privacy. EPIC submitted comments to urge the FTC to strengthen the original Facebook order. EPIC, Comments In re Facebook, Inc., FTC File No. 092 3184 (201 1). 14 Specifically, EPIC's recommended that the FTC require Facebook to (1) allow users to access all of the data that Facebook keeps about them; (2) cease creating facial recognition profiles without users' affirmative consent; (3) make Facebook's privacy audits publicly available to the greatest extent possible; and (4) cease secret post-log out tracking of users across websites. But the FTC adopted the order without any modifications to the order. However, the FTC has modified other orders concerning privacy in response to public 14 https://epic.org/privacy/facebookyFacebook-FTC-Settlement-Comments-FINAL.pdf 10 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 11 of 18 comments. In the Matter ofUber Technologies, Inc. Decision and Order, Docket No. C-4662 (Oct. 25, 2018). 15 The FTC’s attempt to circumvent the public comment process is unlawful and denies EPIC and others the opportunity to submit comments on the consent agreement. B. EPIC has Article III standing to intervene as of right. Because EPIC has demonstrated a legally protected interest under Rule 24(a), EPIC also has Article III standing. See, e.g., Wildearth Guardians v. Salazar, 272 F.R.D. 4, 13 n. 5 (D.D.C. 2010) (“[W]hen a putative intervenor has a ‘legally protected’ interest under Rule 24(a), it will also meet constitutional standing requirements, and vice versa. ”). EPIC can also meet the requirements of Article III standing because it will (1) suffer an injury in fact, (2) that is fairly traceable to entrance of the Stipulate Order, and (3) that is likely to be redressed by a favorable decision by this Court. Spokeo v. Robins, 136 S. Ct. 1540, 1547 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). As an organization, EPIC “can assert standing on its own behalf, on behalf of its members or both.” PETA v. USDA, 797 F.3d 1087, 1093 (D.C. Cir. 2015). Here, EPIC, as an organization, will suffer two injuries if the Stipulated Order is entered: (1) EPIC will be prevented from seeking redress through the administrative complaint process for Facebook’s violations of Section 5 of the FTC Act contained in the proposed settlement’s broad liability release; and (2) EPIC will be deprived of the opportunity to submit comments on the proposed settlement, as required by the FTC’s regulations. As a preliminary matter, the Government’s assertion that the decision to settle with Facebook is “generally not reviewable” and thus cannot result in injury to EPIC does not comport with Circuit precedent on judicial approval of agency consent decrees, as discussed in 15 https://www.ftc.gov/system/files/documents/cases/152_3054_c- 4662_uber_technologies_revised_decision_and_order.pdf 11 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 12 of 18 Section I above. This Court is required to review proposed consent decrees for fairness, adequacy, and consistency with the public interest. Citizens for a Better Env’t, 718 F. 2d at 1 126 (citing United States v. Trucking Employers, Inc., 561 F.2d 313, 317 (D.C. Cir. 1977). While “the function of the reviewing court is not to substitute its judgment for that of the parties to the decree,” United States v. District of Columbia , 933 F. Supp. at 46-47, the Court “must eschew any rubber stamp approval in favor of an independent evaluation.” Id. at 47 (quoting United States v. Hooker Chemicals and Plastics Corporation, 540 F. Supp. 1067, 1072 (W.D.N.Y. 1982), affd, 749 F.2d 968 (2d Cir. 1984)). Under this standard, this Court must assure itself that the proposed settlement is consistent with the APA, as it is difficult to see how a settlement that violates the APA could be fair, adequate, or consistent with the public interest. Thus, the standard of review does not deprive EPIC of a legal interest in this case. Adoption of the Stipulated Order will cause EPIC, as an organization, to suffer a “concrete and demonstrable injury to [its] activities,” that goes beyond “a mere setback to [EPIC's] abstract social interests.” PETA, 797 F.3d at 1093. The FTC’s proposed Consent Decree grants Facebook broad immunity for past violations of the FTC Act and the 2012 Consent Order without addressing the claims that provide the basis for the release of liability. If the release goes into force, then EPIC will be unable to file future complaints concerning Facebook’s unlawful business practices during the period of 2012 to 2019. The FTC’s proposed Consent Decree also bypasses the APA’s comment and review process, injure EPIC’s interests, and cause EPIC to “use[] its resources to counteract that harm.” Id. First, the overly broad liability release impedes EPIC’s ability to prevent invasions of privacy through the administrative complaint process. EPIC’s mission is to “protect privacy, 12 Case l:19-cv-02184-TJK Document 13 Filed 08/12/19 Page 13 of 18 freedom of expression, and democratic values in the information age.” EPIC, About (20 19). 16 EPIC routinely submits complaints to the FTC concerning the privacy-violating behavior of Facebook and other businesses, and the FTC often acts upon these complaints in enforcement actions. The grant of immunity here means that the FTC has foreclosed, forever, any enforcement action on the matters detailed in EPIC’s previously-submitted complaints, as well as those contained in 26,000 other consumer complaints. The release also immunizes Facebook from any new complaints that EPIC might seek to file regarding unlawful past conduct. As a result of the FTC’s release, EPIC, as an organization, would suffer an injury similar to the one in PETA, where this Circuit found that PETA had organizational standing because the USDA’s refusal to apply the Animal Welfare Act to birds “precluded PETA from preventing cruelty to and inhumane treatment of these animals through its nonnal process of submitting USD A complaints.” /