FTC Updates (May 15 – May 19, 2023)

This week, the FTC filed a lawsuit to block a large biopharmaceutical acquisition, launched a refund claims process for aggrieved consumers, and issued a warning that increasing use of biometric identifier technologies raises significant consumer privacy and data security concerns. These stories and more after the jump.

May 16, 2023

Bureau of Consumer Protection: Deceptive/Misleading Conduct, Credit and Loans, Automobiles, Discrimination

• The FTC is sending payments totaling more than $3.3 million to over 18,000 customers of Passport Auto, a Washington D.C.-area auto dealer. In October 2022, the FTC charged Passport Auto with adding hundreds to thousands of dollars in illegal junk fees to car prices and for discriminating against Black and Latino consumers by charging them higher fees and financing costs. The FTC's suit against Passport Auto, its president, Everett Hellmuth, and its vice president, Jay Klein, charged that the defendants' junk fees caused consumers to pay more than the advertised price or lose any discounts they had negotiated.

Bureau of Competition: Merger, Pharmaceuticals

• The FTC filed a lawsuit in federal court to block biopharmaceutical company Amgen Inc. from acquiring Horizon Therapeutics plc, saying that the deal would enable Amgen to use rebates on its existing blockbuster drugs to pressure insurance companies and pharmacy benefit managers (PBMs) to favor Horizon's two monopoly products – Tepezza, used to treat thyroid eye disease, and Krystexxa, used to treat chronic refractory gout. Neither of the treatments have any competition in the pharmaceutical marketplace. The proposed acquisition was the largest pharmaceutical transaction announced in 2022. The FTC argues that protecting and growing Tepezza and Krystexxa monopoly revenues is central to the deal valuation. The value of the rebates that Amgen can offer on its high-volume drugs as part of its cross-market bundles may make it difficult or impossible for smaller rivals who are developing drugs to compete against Tepezza and Krystexxa to match the level of rebates that Amgen would be able to offer, effectively depriving patients, doctors, and health plans from the benefits of competition and access to critical new options for treatment of thyroid eye disease and chronic refractory gout. The Commission's vote to authorize staff to seek a temporary restraining order and preliminary injunction was 3-0.

May 17, 2023

Bureau of Consumer Protection: Funerals

• The FTC will hold a public workshop on September 7, 2023 seeking input on proposed changes to the Funeral Rule. The Funeral Rule requires funeral providers to furnish consumers who visit funeral homes in-person with itemized price information. Since this rule was first issued in the 1980s, it has not required funeral homes to provide price information online or via other electronic means like email or text message. The Commission issued an Advance Notice of Proposed Rule Making on November 2, 2022. The workshop will explore many of the issues raised in the notice, including whether and how funeral providers should be required to display or distribute their price information online or through electronic means. The workshop may cover topics such as online or electronic disclosures of price information, new forms of disposition of human remains, the general price list mandated by the rule, the disclosures required by the rule, whether third-party crematory fees and other third-party fees should be disclosed in the general price list, and whether funeral providers should be required or permitted to give out general price lists in languages other than English in certain circumstances. The public can submit comments on these topics until October 10, 2023. The Commission voted 3-0 to submit the notice regarding the workshop to the Federal Register.

Bureau of Consumer Protection: Clothing and Textiles, Advertising and Marketing, Endorsements, Influencers, and Reviews

• The FTC has launched a refund claims process for consumers who bought products from Fashion Nova, an online fashion retailer that blocked negative reviews from being posted on its website, according to an FTC action announced in January 2022. In the consent order, Fashion Nova agreed to pay $4.2 million to settle charges that the company misled consumers by representing that the reviews on its website reflected the view of all customers who submitted reviews, when in fact, it suppressed reviews with ratings lower than four stars out of five. The FTC is using the money paid by Fashion Nova to provide payments to customers affected by Fashion Nova's conduct. Fashion Nova customers can apply for a payment from this settlement if they meet certain criteria, and the claims period will be open until August 15, 2023.

Bureau of Consumer Protection: Health Care, Consumer Privacy, Tech

• The FTC announced a proposed order settling allegations that fertility app Premom violated the Health Breach Notification Rule (HBNR). Premom, operated by Easy Healthcare Corporation, allegedly deceived users by sharing their sensitive personal information with third parties, disclosing users' sensitive health data to AppsFlyer and Google, and failing to notify consumers of these unauthorized disclosures in violation of the HBNR. The rule requires a vendor of personal health records to notify users, the FTC, and in some cases the media, when there has been an unauthorized acquisition of unsecured individually identifiable health information. The Premom app helps users track ovulation, periods, and other health information, and also sells ovulation test kits. The app encourages users to provide information about their menstrual cycles, fertility, and pregnancy as well as to import their data from other apps such as Apple Health. In a complaint filed by the Department of Justice, the FTC alleges that Easy Healthcare Corporation repeatedly and deceptively promised users in its privacy policies that it would not share their health information with third parties without users' consent and that any data it did collect was non-identifiable and only used for its own analytics or advertising. The FTC alleges that Premom failed to fully disclose its data sharing practices and violated direct promises to users, which lead to the unauthorized disclosure of consumers' health information. The proposed order would bar Easy Healthcare Corporation from sharing users' personal health data with third parties for advertising, require them to obtain users' consent before sharing health data for any other purpose, and would require them to tell consumers how their personal data will be used. It would also require Easy Healthcare Corporation to pay a $100,000 civil penalty for violating the HBNR. The Commission voted 3-0 to refer the complaint and stipulated final order to the Department of Justice for filing.

May 18, 2023

Bureau of Consumer Protection: Health Privacy, Data Security

• The FTC is seeking comment on proposed changes to the Health Breach Notification Rule that include clarifying the rule's applicability to health apps and other similar technologies. The rule requires vendors of personal health records (PHR) and related entities that are not covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals, the FTC, and in some cases the media, of a breach of unsecured personally identifiable health data. It also requires third party service providers to vendors of PHRs and PHR-related entities to provide notification to such vendors and PHR-related entities following the discovery of a breach. The Commission has proposed to revise several definitions to clarify the rule's application to health apps and similar technologies, clarify that a "breach of security" under the rule includes an unauthorized acquisition of identifiable health information that occurs as a result of a data security breach or unauthorized disclosure, revise the definition of "PHR related entity," clarify what it means for a personal health record to draw PHR identifiable health information from multiple sources, expand the required content that should be provided in the notice to consumers, and more. The public will have 60 days after the notice is published in the Federal Register to submit comments on the proposed changes to the rule.

Bureau of Consumer Protection: Technology, Artificial Intelligence, Privacy and Security

• The FTC issued a warning that the increasing use of consumers' biometric information and related technologies raises significant consumer privacy and data security concerns and the potential for bias and discrimination. In a policy statement, the Commission said the agency is committed to combatting unfair or deceptive acts and practices related to the collection and use of consumers' biometric information and the marketing and use of biometric information technologies. The statement warns that false or unsubstantiated claims about the accuracy or efficacy of biometric information technologies or about the collection and use of biometric information may violate the FTC Act. The statement also lists that it will consider several factors in determining whether a business's use of biometric information could be unfair in violation of the FTC Act.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.