Consumer Law & Policy Blog

Hoofnagle on FTC Regulation of Cybersecurity and Surveillance

Chris Jay Hoofnagle of Berkeley has written FTC Regulation of Cybersecurity and Surveillance, in The Cambridge Handbook of Surveillance Law (David Gray and Stephen Henderson, eds)(Cambridge University Press 2017). Here's the abstract:

The Federal Trade Commission (FTC) is the United States’ chief consumer protection agency. Through its mandate to prevent unfair and deceptive trade practices, it both regulates surveillance and creates cybersecurity law. This chapter details how the FTC regulates private-sector surveillance and elucidates several emergent properties of the agency’s activities. First, private-sector surveillance shapes individuals’ reasonable expectations of privacy, and thus regulation of the private-sector has effects on the government as surveillant. The FTC’s activities not only serve dignity interests in avoiding commercial inference in one’s life, they also affect citizens’ civil liberties posture with the state. Second, surveillance can make companies directly liable (for intrusive web monitoring, for tracking people offline, and for installing malware) or indirectly liable (for creating insecure systems, for using deception to investigate, and for mediating the surveillance of others) under the FTC Act. Third, the FTC’s actions substitute plaintiffs’ litigation for privacy, as the class action is burdened in novel ways. Fourth, the FTC’s actions increase the quality of consent necessary to engage in surveillance, and in so doing, the FTC has made some kinds of surveillance practically impossible to implement legally. Finally, the FTC’s actions make companies more responsible for their surveillance technologies in several ways—by making software vendors liable for users’ activities, by imposing substantive security duties, and by narrowing internet intermediary immunity.

 

Edwards Article: Arbitration's Dark Shadow

Benjamin P. Edwards of Nevada has written Arbitration's Dark Shadow, Nevada Law Journal, Forthcoming.  Here's the abstract:

Arbitration has expanded broadly, removing disputes involving entire industries from judicial review. The absence of judicial review plunges these disputes and industries into shadow. This shadow causes the public to lose sight of vital information about industry practices and arbitrators to gradually lose sight of the law. Federal intervention may be necessary to restore consumer protections, including customer choice, to bring these disputes out of the shadows.

Paper on the Right to Be Forgotten in the US

Patrick O'Callaghan of University College Cork has written The Chance 'to Melt into the Shadows of Obscurity': Developing a Right to Be Forgotten in the United States, A. Cudd & M. Navin (eds) Privacy: Core Concepts and Contemporary Issues (New York: Springer, 2018) (Forthcoming). Here is the abstract:

This chapter argues that there is some (limited) evidence of a right to be forgotten in the jurisprudence of U.S. courts. For the purposes of this argument, the right exists whenever interests in being forgotten and/or forgetting are understood as weighty enough to impose a duty on government and/or fellow citizens to respect those interests. Most of the relevant cases belong to the pre-digital era but nevertheless provide some doctrinal support for a right to be forgotten in the digital era. In particular, the chapter pays close attention to the privacy challenges associated with search engines and argues that it may be possible to implement a Google Spain-inspired right to be forgotten (in the sense of delisting or deindexing search results) in the United States.

Arbel Article Proposes that Administrative Agencies Sanction Filing of Baseless Claims Filed Against Consumers

Yonathan A. Arbel of Alabama has written Adminization: Gatekeeping Consumer Contracts, Vanderbilt Law Review, Forthcoming.  Here's the abstract:

Large companies and debt collectors frequently file unmeritorious claims against consumers. Recent high-profile actions brought by the Consumer Financial Protection Bureau (CFPB) against JP Morgan, Citibank, and large debt collectors illustrate the breadth and importance of this phenomenon. Due to the limited financial power of individuals, consumers often do not defend against such baseless claims, which results in the entry of millions of default judgments every year. To combat this problem, policymakers and scholars have explored a variety of solutions that would make it easier for consumers to defend in court, but these prove ineffectual.

To solve the problem of unmeritorious claiming, this Article proposes a budget-neutral solution called “Adminization.” This novel approach uses an administrative agency, potentially the CFPB, as a gatekeeper to civil litigation which detects and sanctions the filing of baseless claims. The main task of the agency is to select a sample of cases, audit them, and—where needed—issue fines. To effectively focus the agency’s attention, the sampling of cases for audit could rely on machine-learning algorithms—the same ones used by credit card companies to monitor fraud today. The audit will use agency investigators to gather and corroborate information relevant to the debt claim, and where wrongdoing is found, the agency will use its powers to levy fines against abusive plaintiffs. Unlike the current system, Adminization will subject every plaintiff to the risk of thorough investigation and large fines, thus undercutting the financial incentive to engage in wrongful behavior. The importance of Adminization lies in its cost-effectiveness, practicality, and political feasibility relative to “participation-based” approaches that dominate the discussion today.

Fed Study of Fintech Lending and Consumers

Julapa Jagtiani and Catharine Lemieux of the Fed have written Fintech Lending: Financial Inclusion, Risk Pricing, and Alternative Information. Here's the abstract:

Fintech has been playing an increasing role in shaping financial and banking landscapes. Banks have been concerned about the uneven playing field because fintech lenders are not subject to the same rigorous oversight. There have also been concerns about the use of alternative data sources by fintech lenders and the impact on financial inclusion. In this paper, we explore the advantages/disadvantages of loans made by a large fintech lender and similar loans that were originated through traditional banking channels. Specifically, we use account-level data from the Lending Club and Y-14M bank stress test data. We find that Lending Club’s consumer lending activities have penetrated areas that could benefit from additional credit supply, such as areas that lose bank branches and those in highly concentrated banking markets. We also find a high correlation with interest rate spreads, Lending Club rating grades, and loan performance. However, the rating grades have a decreasing correlation with FICO scores and debt-to income ratios, indicating that alternative data is being used and performing well so far. Lending Club borrowers are, on average, more risky than traditional borrowers given the same FICO scores. The use of alternative information sources has allowed some borrowers who would be classified as subprime by traditional criteria to be slotted into “better” loan grades and therefore get lower priced credit. Also, for the same risk of default, consumers pay smaller spreads on loans from the Lending Club than from traditional lending channels.

(HT: Matt Bruckner, Consumer Finance Monitor)

Jean Sternlight Article: Consumer Arbitration as a Poster Child for Regulation

Jean R. Sternlight of the University of Nevada, Las Vegas has written Hurrah for the Consumer Financial Protection Bureau: Consumer Arbitration As a Poster Child for Regulation, 48 St. Mary's Law Journal 343 (2016).  Here is the abstract:

Drawing on economic, psychological and philosophical considerations, this Essay considers whether consumers should be "free" to "agree" to contractually trade their opportunity to litigate in a class action for the opportunity to bring an arbitration claim against a company. The Essay suggests that by looking at the CFPB's regulation through these three lenses, one sees that the regulation is desirable—even a poster child—for the potential value of regulation when market forces are not sufficient to protect individual or public interests.

Klass Paper Critiques Restatement of Consumer Contracts Treatment of Privacy Policies

Gregory Klass of Georgetown critiques the draft Restatement of Consumer Contracts treatment of privacy policies in The Quantitative Study of Privacy-Policy Decisions in the Draft Restatement of Consumer Contracts.  Here is the abstract:

The draft Restatement of the Law of Consumer Contracts includes six quantitative studies of judicial decisions, each used to support a rule or comment. This article examines the Reporters’ study of courts’ treatment of privacy policies. The Reporters use this study to support a Comment stating that courts generally treat a business’s privacy policy as a term in its contract with the consumer. This article finds that the Reporters’ data do not support their conclusions.

Of the fifty-one decisions in the Reporters’ dataset, this study finds that only fifteen reach a holding on their question. All are from trial courts, most on a motion to dismiss. Among those fifteen decisions, the ratio of decisions holding that the privacy policy is a contract term to decisions holding that it is not a term is slightly less than 3:1, much less than the 7:1 ratio the Reporters find. Given the small sample size, it is not clear that this result is sufficiently strong either to predict case outcomes or to infer the rule courts are applying. This study also shows that there is not a strong trend toward greater enforcement in contract. The trend the Reporters observe might be an artifact of their decision to include more decisions in their study, particularly cases in which the business invoked its privacy policy as a defense against a noncontractual privacy violation. The decisions in those cases, however, turn on consent rules drawn from tort law, not contract. Finally, an examination of citations indicates that decisions treating privacy policies as contract terms have not been more influential than those denying enforcement in contract, again contrary to the Reporters’ observations.

In addition to presenting these results, the article discusses why coding privacy-policy decisions can be especially difficult, and the results of that coding sometimes indeterminate. The numbers in quantitative studies of case outcomes can mask the many interpretive judgment calls needed to support them. The article also argues that the Restatement process might not be suited to producing large-scale quantitative studies of case outcomes.

Who Are the "leading scholars" Who Senator Crapo Said Have Criticized the CFPB Arbitration Study "as biased and inadequate"?

by Jeff Sovern

Yesterday, the Senate Banking Committee released a press release that said in part:

Today, U.S. Senate Committee on Banking, Housing and Urban Affairs Chairman Mike Crapo (R-Idaho) and Republican colleagues will file a Congressional Review Act (CRA) Joint Resolution of Disapproval in the Senate against the Consumer Financial Protection Bureau’s (CFPB) arbitration rule.

“Members of Congress previously expressed concerns with the proposed version of the rulemaking – concerns that were not addressed in the final rule,” said Chairman Crapo. “The rule is based on a flawed study that leading scholars have criticized as biased and inadequate, noting that it could leave consumers worse off by removing access to an important dispute resolution tool. * * *

Actually, the CFPB rule does not remove access to a dispute resolution tool. Consumers will still be able to use arbitration to resolve disputes. But ignoring that, who are the "leading scholars"? My guess is it's Jason Scott Johnston of Virginia and Todd J. Zywicki of George Mason who have written The Consumer Financial Protection Bureau's Arbitration Study: A Summary and Critique. I wrote about what I see as serious flaws in an aspect of their paper here.   (HT: Adam Zimmerman)

 

Critic of CFPB Structure Neomi Rao Nominee to Head OIRA

by Jeff Sovern

OIRA is the Office of Information and Regulatory Affairs (formerly headed by Cass Sunstein). It presides over the issuance of regulations by executive agencies, but not independent agencies (at least, not yet) like the CFPB.  President Trump has nominated for its director George Mason Professor Neomi Rao, a former clerk for Justice Thomas and counsel to the Senate Judiciary Committee under Senator Orrin G. Hatch; she also served in the Bush II administration. The Times has more here.   As for her views on the CFPB, Professor Rao has an article, Administrative Collusion: How Delegation Diminishes the Collective Congress, 90 N.Y.U.L. Rev. 1463 (2015), in which she states that "Reporting about the CFPB reflects the common understanding that the CFPB responds primarily to Senator Elizabeth Warren, who developed and helped to establish the Bureau," and "[A]gency officials and congressional staffers understand that Senator Elizabeth Warren and her staff exercise substantial influence and control over the CFPB, the agency she helped design." I've omitted the cites, but you can click on the linked article to find them if you want. Here's the article's abstract:

This Article identifies a previously unexplored problem with the delegation of legislative power by focusing not on the discretion given to executive agencies, but instead on how delegations allow individual congressmen to control administration. Delegations create administrative discretion, discretion that members of Congress can influence through a variety of formal and informal mechanisms. Members have persistent incentives for delegation to agencies, because it is often easier to serve their interests through shaping administration than by passing legislation. To understand the particular problem of delegation, I introduce the concept of the “collective Congress.” Collective decisionmaking is a fundamental characteristic of the legislative power. The collective Congress serves an important separation of powers principle by aligning the ambitions of legislators with the power of Congress as an institution. Although members represent distinct interests, the Constitution allows members of Congress to exercise power only collectively and specifically precludes them from exercising any type of individual or executive power. Delegation, however, provides opportunities for individual legislators to influence administration and poses a serious separation of powers concern by fracturing the collective Congress. This insight undermines the conventional view that delegations will be self-correcting because Congress will jealously guard its lawmaking power from the executive. Instead, members of Congress will often prefer to collude and to share administrative power with the executive. As a result, delegation destroys the Madisonian checks and balances against excessive delegation. This structural failure suggests a need to reconsider judicial enforcement of the nondelegation doctrine and to implement political reforms to realign Congress with its collective power.

 

Dadush Article on Identity Harm

Sarah Dadush of Rutgers has written Identity Harm, 89 University of Colorado Law Review (Forthcoming).  Here is the abstract:

In September 2015, the world learned that Volkswagen had rigged millions of its “clean diesel” vehicles with illegal software designed to cheat emissions tests. Contrary to what had been advertised, the vehicles are anything but clean. The fraud, referred to as “Dieselgate,” lasted for over seven years. When affected owners learned that their cars were much more toxic than advertised, what were they upset about? Was it that their cars were now worth fewer dollars? Or that they had been deceived into being bad global citizens, when they thought they were being good?

Coverage of Dieselgate strongly suggests that affected car-owners experienced both kinds of disappointment, economic and non-economic, and in heavy doses at that. But while the first kind of harm is relatively easy to recognize and address, this article shows that our protective regime is ill equipped to shield consumers from the second, a kind of “identity harm.” Identity harm refers to the distress experienced by consumers who learn that the companies they bought from did not honor their environmental or social promises. It arises when consumers realize that they have become unwittingly implicated in commercial arrangements that harm the planet and/or other human beings.

Today, an ever-growing number of consumers and corporations are becoming sensitized to sustainability challenges. They are also becoming more expressive about their commitment to addressing those challenges. As the “market for virtue” expands, so too does exposure to identity harm. This article introduces identity harm and argues for its deeper legal recognition.