Administrative Law

The New Reefer Madness? New Laws Look to Regulate Hemp Products

October 11, 2024
Administrative Law, Food and Drug Law

Violet Butler, MJLST Staffer

In 2018, the federal government took a major step in shifting its policy towards the criminalization of marijuana. Included in the 2018 Farm Bill was a provision that legalized some hemp-derivative products, in particular CBD products with a low-level of THC.[1] While this was touted by the industry and activists as a major step forward, the move to increase regulations on these hemp products have recently gained steam.

But what exactly was legalized by the federal government? The 2018 Farm Bill legalized hemp and hemp derived products (including CBD) that contain no more than 0.3% THC.[2] It should be noted that most cannabis products are consumed for some form of intoxication[3] and, suffice it to say, intoxication does not arise from 0.3% THC. The 2018 Farm Bill legalized a very small subsection of cannabis products serving a limited range of uses. Under the law, if a product contains more than 0.3% THC it is legally classified as marijuana and is still illegal under the Controlled Substances Act. So, if these new products cannot be used as intoxicants, why is there a push for more regulations?

A reason for the push for further regulations gaining traction is the concern over synthetically produced cannabinoids. A report from the National Academy of Sciences, Engineering, and Medicine recently published a report urging the federal government to redefine what “hemp” means. This is in an effort to ban semi-synthetic cannabinoids derived from legal hemp products as these cannabinoids can mirror the intoxicating effects of marijuana.[4] By clamping down on these semi-synthetic products, the legal line between hemp, CBD, and marijuana can be more properly maintained.

Different states are taking different approaches to the new regulations on hemp products. One camp of lawmakers want to go back to the old regime where any miniscule trace of THC was illegal. This “total ban” approach is presently seen in new legislation passed in Arkansas. Arkansas’ Act 629 bans the “production and sale of products containing Delta 8, Delta 9 and Delta 10 and other THC isomers inside the state of Arkansas” in any capacity.[5] Currently on appeal in the Eighth Circuit, the act has been subject to a lawsuit from hemp companies claiming the state law is preempted by the 2018 Farm Bill.[6] Arkansas is not the only state to take a total ban approach. Missouri’s governor Mike Parsons recently signed an executive order banning all consumables containing “psychoactive cannabis products”—or hemp products containing even trace amounts of THC—outside of the state’s already regulated cannabis market.[7] While this is not as broad in scope as Arkansas’ ban, the wide-reaching ban restricts the sale of most non-marijuana cannabis products in the state.

However, some states have taken a different approach to regulating hemp products, particularly in its distribution. New Jersey recently banned any amount of THC from being sold to a person under the age of 21.[8] California governor Gavin Newsom took a similar approach, signing an emergency ban on all hemp products containing THC and restricting the sale of all other hemp products to the 21+ market.[9] Even the federal government might be looking to increase the regulations on hemp products. Senator Ron Wyden recently introduced a bill that would raise the age at which someone could buy hemp products to 21 and set more federal safety standards on the industry.[10]

So, why is there a push to change the laws around hemp now? It could come down to perceived health risks and a rise in hospitalizations. A study from the Nationwide Children’s Hospital found that there were over 3,000 calls to poison controls related to THC, including the those found in small doses of legal hemp products.[11] Although only about 16% of these calls resulted in hospitalizations, roughly half of admissions were for children under 6-years-old.[12] California Governor Newsom directly cited hospitalizations as one the principal reasons he signed his emergency order.[13]

People seem to be worried about the hemp products currently on the market, including CBD, but should they be? The jury is still out on the health effects of CBD. A report from the World Health Organization in 2018 said that CBD had a “good safety profile” and reported no evidence of detrimental effects from recreational consumption of pure CBD.[14] However, the AAMC notes that CBD is understudied and there could be adverse interactions if CBD is taken with other medications.[15]

Legislators and policy-makers need to be able to ensure the safety and well-being of their citizens without creating unnecessary barriers for a new and growing industry. One of the barriers that states are facing is— maybe ironically—the 2018 Farm Bill. The bill opened the door for hemp products that met the THC standards, and these state laws are running into friction with the federal law. While states are allowed (and expected) to regulate the hemp industry under the 2018 Farm Bill, the move by many states to put heavier restrictions on the amount of THC allowed in hemp products seems to be in conflict with federal law. The lawsuits from hemp producers so far have all revolved around the idea that these state regulations, which are more restrictive than the 2018 Farm Bill, are preempted by the federal legislation.[16] Under Article VI of the Constitution, federal laws are the “supreme law of the land” so the Farm Bill must preempt state law in some way, but the exact way it does so is unclear.[17] There are two different ideas on how the Farm Bill preempts state law. The first idea is that the hemp regulations laid out in the federal law are the most stringent that states can regulate. This is the interpretation that hemp producers prefer, and the theory that they are suing under. The second idea, the option preferred by states that are looking to increase regulations, is that the Farm Bill set the outer limit for regulations. In other words, states are free to increase the regulations on the industry, but the federal law provides a national baseline if states do not come up with their own regulation.

Court rulings on this issue may settle the debate, but there is always a risk of a circuit split forming as different Courts of Appeal hear and decide on different lawsuits. To clear confusion once and for all, the federal government could clarify the scope of regulatory power with new legislation, or the Supreme Court could decide the issue in its upcoming term. But, until then, the legal challenges are likely to keep mounting and leave the nascent hemp industry in lingo.

 

Notes

[1] Dennis Romero, Hemp Industry Expected to Blossom Under New Farm Bill, NBC News (Dec. 17, 2018, 4:02 PM), https://www.nbcnews.com/news/us-news/hemp-industry-expected-blossom-under-new-farm-bill-n947791. For clarification, CBD stands for cannabidiol, a product derived from hemp, often sold in gummy or oil form. THC stands for tetrahydrocannabinol, the psychoactive part of the marijuana plant that can get you high. THC often refers to what is known as delta-9 THC, a type of THC found in the marijuana plant.

[2] John Hudak, The Farm Bill, Hemp Legalization and the Status of CBD: An Explainer, Brookings Institution (Dec. 14, 2018), https://www.brookings.edu/articles/the-farm-bill-hemp-and-cbd-explainer/

[3] As the Brookings Institution points out, the extremely low levels of THC in now-legal hemp products means that these products cannot be used to get high.

[4] Sam Reisman, New Report Urges Feds to Take Larger Role in Pot Policy, Law360 (Sept. 26, 2024, 8:53 PM), https://plus.lexis.com/newsstand/law360/article/1883058/?crid=c6fd0d9a-971e-489f-a5c6-8c1725ffee87

[5] Dale Ellis, Federal Judge Blocks State’s New Law Banning Delta-8 THC Products, Arkansas Democrat Gazette (Sept. 7, 2023, 6:00 PM), https://www.arkansasonline.com/news/2023/sep/07/federal-judge-blocks-states-new-law-banning-delta-8-thc-products/

[6] Sam Reisman, Court Defers Ruling On Challenge To Arkansas Hemp Law, Law360 (Sept. 25, 2024, 6:50 PM), https://plus.lexis.com/newsstand/law360/article/1882683/?crid=48cd5145-0817-47a7-bf22-1fb3bf01cb5f

[7] Jonathan Capriel, Missouri Ban on Some Psychoactive Foods to Hit Sept. 1 (August 30, 2024, 8:47 PM), https://plus.lexis.com/newsstand/law360/article/1882683/?crid=48cd5145-0817-47a7-bf22-1fb3bf01cb5f;  Rebecca Rivas, Missouri Hemp Leaders File Suit to Halt Governor’s Ban on Hemp THC Products, Missouri Independent (August 30, 2024 5:55 AM), https://missouriindependent.com/2024/08/30/missouri-hemp-leaders-set-to-file-suit-to-halt-governors-ban-on-hemp-thc-products/

[8] Sophie Nieto-Munoz, Gov. Murphy Signs Controversial Bill Restricting Sales of Hemp Products, New Jersey Monitor (Sept. 13, 2024, 7:11 AM), https://newjerseymonitor.com/2024/09/13/gov-murphy-signs-controversial-bill-restricting-sales-of-hemp-products/

[9] Rae Ann Varona, Calif. Gov.’s Emergency Hemp Intoxicant Ban Wins Approval, Law360 (Sept. 24, 2024, 9:49 PM),  https://plus.lexis.com/newsstand/law360/article/1882121/?crid=642ddd2e-a29d-46d6-8ff4-b7f209fd6c7f&cbc=0,0

[10] Same Reisman, Wyden Pitches New Bill To Regulate Intoxicating Hemp, Law360 (Sept. 25, 2024, 7:06 PM), https://plus.lexis.com/newsstand/law360/article/1882226/?crid=ed53b57f-dd97-4a6a-8a89-f6028f95e523

[11] Nationwide Children’s, New Study Finds Increase in Exposures to Synthetic Tetrahydrocannabinols Among Young Children, Teens, and Adults, Nationwide Children’s Hospital (May 7, 2024), https://www.nationwidechildrens.org/newsroom/news-releases/2024/05/deltathc_clinicaltoxicology

[12] Id.

[13] Varona, supra note 9.

[14] World Health Organization, Cannabidiol (CBD) Critical Review Report 5 (2018).

[15] Stacy Weiner, CBD: Does It Work? Is It Safe? Is It Legal?, AAMC News (July 20, 2023), https://www.aamc.org/news/cbd-does-it-work-it-safe-it-legal

[16] Reisman, supra note 6; Varona, supra note 9.

[17] U.S. Const. art. VI, cl. 2

NEPA and Climate Change: Are Environmental Protections Hindering Renewable Energy Development?

October 9, 2024
Administrative Law, Climate Change, Energy Law, Environmental Law

Samuel Taylor, MJLST Staffer

The National Environmental Protection Act, or “NEPA”, has been essential in protecting America’s air and water, managing health hazards, and preserving environmental integrity. For decades, environmental activist groups, the government, and regular citizens relied on and benefitted from enforcing these NEPA against those looking to pollute, poison, or endanger Americans and their environment. NEPA, however, is proving to be less suitable for addressing the country’s  imminent environmental challenge: climate change. As proponents of green energy scramble to ditch fossil fuels, NEPA and its procedural requirements are accused of delaying or halting renewable energy projects. Environmental protection laws remain essential to stopping the dangers they were passed to stop, and many new green energy projects pose additional risks to the environment, but we also need to transition away from fossil fuels as fast as possible to avoid the worst consequences of climate change. The conflict between the need to address climate change and the need to maintain environmental protections has created a regulatory challenge that may not have a perfect solution.

Enacted in 1970, NEPA was the first major environmental protection measure taken in the US.[i] The “magna carta” of environmental laws applies to all “major federal actions significantly affecting the environment”.[ii] Major federal actions can include everything from infrastructure projects like proposed dams, bridges, highways, and pipelines, to housing developments, research projects, and wildlife management plans.[iii] Before a federal agency can act, there are a series of procedures they must follow which force them to consider the environmental impacts of the potential action. These procedures involve community outreach, the effects of past and future actions in the region, and providing the public with a detailed explanation of the agency’s findings, and often take years to fully complete.[iv] By requiring the government to follow these procedures “to the fullest extent possible,” NEPA aims to ensure that environmental concerns are given sufficient consideration before any harmful actions are taken.[v] Notably, NEPA is not a results-oriented statute, but a process-oriented one.[vi] No agency decision can be made until after its procedures are followed, but once they are, NEPA does not mandate a particular decision.[vii] NEPA does not even require that environmental concerns be given more weight than any other factors.[viii] Nevertheless, if an agency fails to properly follow NEPA procedures, all resulting decisions can be invalidated if challenged in the courts.[ix]

Though passing NEPA was the first step Congress took towards addressing environmental concerns, and decades of NEPA success stories have followed, there is growing concern about its  ability to adapt to the pressing challenges presented by global climate change.[x] NEPA, critics say, drastically slows the government’s ability to invest in green energy because each step of the procedure can be challenged in court.[xi] Corporate competitors in the renewable energy sector, environmental interest groups, concerned citizen groups, and Native American tribes have all challenged various projects’ compliance with NEPA requirements.[xii] Many of these groups have legitimate concerns about the projects, and NEPA allows them to stall or halt development while the government is forced to further consider their potential environmental impacts. This causes direct conflict between these valid concerns and efforts to reverse the country’s reliance on fossil fuels.[xiii] Collectively, the long procedures and potential legal challenges that accompany NEPA’s requirements present serious hurdles to the production of green energy.

Legal experts disagree, perhaps not surprisingly, over the extent to which NEPA hinders the production of green energy sources. Some groups believe the rhetoric surrounding NEPA’s deficiencies is an exaggeration, citing data that shows only a very small percentage of green energy projects actually require the production of EISs.[xiv] Others present NEPA and other environmental protection laws as serious hurdles preventing the production of renewable energy at the pace we need to avoid the worst effects of climate change.[xv] They argue that this data is not properly representative of all clean energy projects, ignores the delays caused by litigation, and does not properly account for the likelihood that delays will get worse in the future.[xvi] Because there is little consensus regarding the extent of the problem, there is likewise almost no agreement on a potential solution.

 Lawmakers and legal scholars have proposed a range of approaches to the NEPA problem. Most drastically, a bill introduced to the U.S. House Committee on Natural Resources by Representative Bruce Westerman would largely eradicate most NEPA provisions by limiting consideration of new scientific evidence, allowing some projects to go exempt from NEPA’s requirements, and drastically limiting community instigated judicial review.[xvii] Other proposals are more modest, including permitting reform to favor green energy projects, placing some limits on judicial review, and collecting more comprehensive data on NEPA issues.[xviii] Still others are staunchly against most reforms, arguing that weakening any NEPA provisions would open the door for greater environmental abuses.[xix] The differing opinions on the scope of the problem and the wide range of proposed solutions amount to a problem that will not be easy to solve.

The legal community is divided on the efficacy of existing NEPA regulations that have, for decades, promoted environmental protection. In the face of climate change and the accompanying need for renewable energy, it must be determined whether NEPA is truly hindering the switch to green energy. The United States must build more renewable energy infrastructure if we are to avoid the worst consequences of global climate change, but with concern growing that our own environmental protection laws are hindering progress, it will be challenging to move forward in a manner that balances the need for green energy production against the necessity of strong environmental protection laws.

 

Notes

[i] Sam Kalen, NEPA’s Trajectory: Our Waning Environmental Charter From Nixon to Trump, 50 Environmental Law Reporter 10398, 10398 (2020).

[ii] Id.; Mark A. Chertok, Overview of the National Environmental Policy Act: Environmental Impact Assessments and Alternatives (2021); 42 U.S.C. §§ 4321–70.

[iii] Elly Pepper, Never Eliminate Public Advice: NEPA Success Stories, Natural Resources Defense Council (Feb. 1, 2015), https://www.nrdc.org/resources/never-eliminate-public-advice-nepa-success-stories#:~:text=The%20NEPA%20process%20has%20saved,participated%20in%20important%20federal%20decisions.

[iv] Chertok, supra note ii; 42 U.S.C. §§ 4321–70.

[v] Chertok, supra note ii; Catron County v. U.S.F.W.S., 75 F.3d 1429, 1437 (10th Cir. 1996).

[vi] Chertok, supra note ii; Catron County at 1434.

[vii] Chertok, supra note ii.

[viii] Balt. Gas & Elec. Co. v. Nat. Res. Def. Council, Inc., 462 U.S. 87, 97 (1983).

[ix] Chertok, supra note ii (citing Lands Council v. Powell, 395 F.3d 1019, 1027 (9th Cir. 2005)).

[x] Pepper, supra note iii; Aidan Mackenzie & Santi Ruiz, No, NEPA Really Is a Problem for Clean Energy, Institute For Progress (Aug. 17, 2023), https://ifp.org/no-nepa-really-is-a-problem-for-clean-energy/#nepa-will-harm-clean-energy-projects-even-more-in-the-future; Darian Woods & Adrian Ma, Environmental Laws Can Be an Obstancel in Building Green Energy Infrastructure, NPR (Apr. 13, 2022), https://www.npr.org/2022/04/13/1092686675/environmental-laws-can-be-an-obstacle-in-building-green-energy-infrastructure.

[xi] Mackenzie & Ruiz, supra note x; See, e.g. Ocean Advocates v. U.S. Army Corps of Engineers, 402 F.3d 846 (9th Cir. 2005) (where the agency finding of no significant impact was challenged by an environmental protection group); Sierra Club v. Bosworth, 510 F.3d 1016 (9th Cir. 2007) (where the agency’s EIS analysis was challenged by the Sierra Club).

[xii] Niina H. Farah, Tribes Sue Over NEPA Review for Oregon Offshore Wind Auction, Politico (Sep. 18, 2024), https://www.eenews.net/articles/tribes-sue-over-nepa-review-for-oregon-offshore-wind-auction/; Christine Billy, Update: Congestion Pricing: A Case Study on Interstate Air Pollution Disputes, New York State Bar Association (Sep. 23, 2024), https://nysba.org/update-congestion-pricing-a-case-study-on-interstate-air-pollution-disputes/; Jonathan D. Brightbill & Madalyn Brown Feiger, Environmental Challenges Seek to Block Renewable Projects, Winston & Strawn LLP (Sep. 1, 2021), https://www.winston.com/en/blogs-and-podcasts/winston-and-the-legal-environment/environmental-challenges-seek-to-block-renewable-projects.

[xiii] Farah, supra note xii; Brightbill & Feiger, supra note xiv.

[xiv] Ann Alexander, Renewable Energy and Environmental Protection Is Not an Either/Or, Natural Resources Defense Council (Jan. 18, 2024), https://www.nrdc.org/bio/ann-alexander/renewable-energy-and-environmental-protection-not-eitheror.

[xv] Mackenzie & Ruiz, supra note x.

[xvi] Alexander, supra note xiv; Mackenzie & Ruiz, supra note x.

[xvii] Defenders of Wildlife, Defenders Slams Bill Aiming to Rollback NEPA and Gut Environmental Protections, (Sep. 10, 2024), https://defenders.org/newsroom/defenders-slams-bill-aiming-rollback-nepa-and-gut-environmental-protections.

[xviii] Brian Potter, Arnab Datta & Alec Stapp, How to Stop Environmental Review from harming the Environment, Institute For Progress (Sep. 13, 2022), https://ifp.org/environmental-review/.

[xix] Alexander, supra note xiv; Sierra Club

 

 

 

 

Moderating Social Media Content: A Comparative Analysis of European Union and United States Policy

September 24, 2024
Administrative Law, EU Law, Internet, Social Media

Jaxon Hill, MJLST Staffer

In the wake of the Capitol Hill uprising, former president Donald Trump had several of his social media accounts suspended.1 Twitter explained that their decision to suspend Trump’s account was “due to the risk of further incitement of violence.”2 Though this decision caught a lot of attention in the public eye, Trump was not the first figure in the political sphere to have his account suspended.3 In response to the social media platforms alleged censorship, some states, mainly Florida and Texas, attempted to pass anti-censorship laws which limit the ability for social media companies to moderate content.4 

Now, as litigation ensues for Trump and social media companies fighting the Texas and Florida legislation, the age-old question rears its ugly head: what is free speech?5 Do social media companies have a right to limit free speech? Social media companies are not bound by the First Amendment.6 Thus, barring valid legislation that says otherwise, they are allowed to restrict or moderate content on their platforms. But should they, and, if so, how? How does the answer to these questions differ for public officials on social media? To analyze these considerations, it is worthwhile to look beyond the borders of the United States. This analysis is not meant to presuppose that there is any wrongful conduct on the part of social media companies. Rather, this serves as an opportunity to examine an alternative option to social media content moderation that could provide more clarity to all interested parties. 

  In the European Union, social media companies are required to provide clear and specific information whenever they restrict the content on their platform.7 These statements are called “Statements of Reasons” (“SoRs”) and they must include some reference to whatever law the post violated.8 All SoRs  are  made publicly available to ensure transparency between the users and the organization.9 

An analysis of these SoRs yielded mixed results as to their efficacy but it opened up the door for potential improvements.10 Ultimately, the analysis showed inconsistencies among the various platforms in how or why they moderate content, but those inconsistencies can potentially open up an ability for legislators to clarify social media guidelines.11 

Applying this same principle domestically could allow for greater transparency between consumers, social media companies, and the government. By providing publicly available rationale behind any moderation, social media companies could continue to remove illegal content while not straddling the line of censorship. It is worth noting that there are likely negative financial implications for this policy, though. With states potentially implementing vastly different policies, social media companies may have to increase costs to ensure they are in compliance wherever they operate.12 Nevertheless, absorbing these costs up front may be preferable to “censorship” or “extremism, hatred, [or] misinformation and disinformation.”13 

In terms of the specific application to government officials, it may seem this alternative fails to offer any clarity to the current state of affairs. This assertion may have some merit as government officials have still been able to post harmful social media content in the EU without it being moderated.14 With that being said, politicians engaging with social media is a newer development—domestically and internationally—so more research needs to be conducted to conclude best practices. Regardless, increasing transparency should bar social media companies from making moderation choices unfounded in the law.

 

Notes

1 Bobby Allyn & Tamara Keith, Twitter Permanently Suspends Trump, Citing ‘Risk Of Further Incitement Of Violence’, Npr (Jan. 8, 2021), https://www.npr.org/2021/01/08/954760928/twitter-bans-president-trump-citing-risk-of-further-incitement-of-violence.

2 Id.

3 See Christian Shaffer, Deplatforming Censorship: How Texas Constitutionally Barred Social Media Platform Censorship, 55 Tex. Tech L. Rev. 893, 903-04 (2023) (giving an example of both conservative and liberal users that had their accounts suspended).

4 See Daveed Gartenstein-Ross et al., Anti-Censorship Legislation: A Flawed Attempt to Address a Legitimate Problem, Lawfare (July 27, 2022), https://www.lawfaremedia.org/article/anti-censorship-legislation-flawed-attempt-address-legitimate-problem (explaining the Texas and Florida legislation in-depth).

5 See e.g. Trump v. United States, 219 L.E.2d 991, 1034 (2024) (remanding the case to the lower courts); Moody v. NetChoice, LLC, 219 L.E.2d. 1075, 1104 (2024) (remanding the case to the lower courts).

6 Evelyn Mary Aswad, Taking Exception to Assessments of American Exceptionalism: Why the United States Isn’t Such an Outlier on Free Speech, 126 Dick. L. R. 69, 72 (2021).

7 Chiara Drolsbach & Nicolas Pröllochs, Content Moderation on Social Media in the EU: Insights From the DSA Transparency Database (2023), https://arxiv.org/html/2312.04431v1/#bib.bib56.

8  Id.

9 Id.

10 Id. This analysis showed that (1) content moderation varies across platforms in number, (2) content moderation is most often applied to videos and text, whereas images are moderated much less, (3) most rule-breaking content is decided via automated means (except X), (4) there is much variation among how often the platforms choose to moderate illegal content, and (5) the primary reasons for moderation include falling out of the scope of the platform’s services, illegal or harmful speech, and sexualized content. Misinformation was very rarely cited as the reason for moderation.

11 Id.

12 Perkins Coie LLP, More State Content Moderation Laws Coming to Social Media Platforms (November 17, 2022), https://perkinscoie.com/insights/update/more-state-content-moderation-laws-coming-social-media-platforms (recommending social media companies to hire counsel to ensure they are complying with various state laws). 

13 See e.g. Shaffer, supra note 3 (detailing the harms of censorship); Gartenstein-Ross, supra note 4 (outlining the potential harms of restrictive content moderation).

14 Goujard et al., Europe’s Far Right Uses TikTok to Win Youth Vote, Politico (Mar. 17, 2024), https://www.politico.eu/article/tiktok-far-right-european-parliament-politics-europe/ (“Without evidence, [Polish far-right politician, Patryk Jaki] insinuated the person who carried out the attack was a migrant”).

 

A Digital Brick in the Trump-Biden Wall

April 21, 2024
Administrative Law, Immigration

Solomon Steen, MJLST Staffer

“Alexander explained to a CBP officer at the limit line between the U.S. and Mexico that he was seeking political asylum and refuge in the United States; the CBP officer told him to “get the fuck out of here” and pushed him backwards onto the cement, causing bruising. Alexander has continued to try to obtain a CBP One appointment every day from Tijuana. To date, he has been unable to obtain a CBP One appointment or otherwise access the U.S. asylum process…”>[1]

Alexander fled kidnapping and threats in Chechnya to seek security in the US.[2] His is a common story of migrants who have received a similar welcome. People have died and been killed waiting for an appointment to apply for asylum at the border.[3] Children with autism and schizophrenia have had to wait, exposed to the elements.[4] People whose medical vulnerabilities should have entitled them to relief have instead been preyed upon by gangs or corrupt police.[5] What is the wall blocking these people from fleeing persecution and reaching safety in the US?

The Biden administration’s failed effort to pass bipartisan legislation to curb access to asylum is part of a broader pattern of Trump-Biden continuity in immigration policy.[6] This continuity is defined by bipartisan support for increased funding for Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE) for enforcement of immigration law at the border and in the interior, respectively.[7] Successive Democratic and Republican administrations have increased investment in interior and border enforcement.[8] That investment has expanded technological mechanisms to surveil migrants and facilitate administration of removal.

As part of their efforts to curtail access to asylum, the Biden administration promulgated their Circumvention of Lawful Pathways rule.[9] This rule revived the Trump administration’s entry and transit bans.[10] The transit ban bars migrants from applying for asylum if they crossed through a third country en route to the US.[11] The entry ban bars asylum applicants who did not present themselves at a port of entry.[12] In East Bay Sanctuary Covenant v. Biden, the Ninth Circuit determined the rule was unlawful for directly contradicting Congressional intent in the INA granting a right of asylum to any migrant in the US regardless of manner of entry.[13] The Trump entry ban was similarly found unlawful for directly contravening the same language in the INA.[14] The Biden ban remains in effect to allow litigation regarding its legality to reach its ultimate conclusion.

The Circumvention of Lawful Pathways rule effecting the entry ban gave rise to a pattern and practice of metering asylum applicants, or requiring applicants to present at a port of entry having complied with specific conditions to avoid being turned back.[15] To facilitate the arrival of asylum seekers within a specific appointment window, DHS launched the CBP One app.[16] The app would ostensibly allow asylum applicants to schedule an appointment at a port of entry to present themselves for asylum.[17]

Al Otro Lado (AOL), Haitian Bridge, and other litigants have filed a complaint alleging the government lacks the statutory authorization to force migrants to seek an appointment through the app and that its design frustrates their rights.[18] AOL notes that by requiring migrants to make appointments to claim asylum via the app, the Biden administration has imposed a number of extra-statutory requirements on migrants entitled to claim asylum, which include that they:

(a) have access to an up-to-date, well-functioning smartphone;
(b) fluently read one of the few languages currently supported by CBP One;
(c) have access to a sufficiently strong and reliable mobile internet connection and electricity to submit the necessary information and photographs required by the app;
(d) have the technological literacy to navigate the complicated multi-step process to create an account and request an appointment via CBP One;
(e) are able to survive in a restricted area of Mexico for an indeterminate period of time while trying to obtain an appointment; and
(f) are lucky enough to obtain one of the limited number of appointments at certain POEs.[19]

The Civil Rights Education and Enforcement Center (CREEC) and the Texas Civil Rights Project have similarly filed a complaint with Department of Homeland Security’s Office of Civil Rights and Civil Liberties alleging CBP One is illegally inaccessible to disabled people and this has consequently violated other rights they have as migrants.[20] Migrants may become disabled as a consequence of the immigration process or the persecution they suffered that establish their prima facie claim to asylum.[21] The CREEC complaint specifically cites Section 508 of the Rehabilitation Act, which says disabled members of the public must enjoy access to government tech “comparable to the access” of everyone else.[22]

CREEC and AOL – and the other service organizations joining their respective complaints – note that they have limited capacity to assist asylum seekers.[23] Migrants without such institutional or community support would be more vulnerable being denied access to asylum and subject to opportunistic criminal predation while they wait at the border.[24]

There are a litany of technical problems with the app that can frustrate meritorious asylum claims. The app requires applicants to submit a picture of their face.[25] The app’s facial recognition software frequently fails to identify portraits of darker-skinned people.[26] Racial persecution is one of the statutory grounds for claiming asylum.[27] A victim of race-based persecution can have their asylum claim frustrated on the basis of their race because of this app. Persecution on the basis of membership in a particular social group can also form the basis for an asylum claim.[28] An applicant could establish membership in a particular social group composed of certain disabled people.[29] People with facial disabilities have also struggled with the facial recognition feature.[30]

The mere fact that an app has substituted a human interaction contributes to frustration of disabled migrants’ statutory rights. Medically fragile people statutorily eligible to enter the US via humanitarian parole are unable to access that relief electronically.[31] Individuals with intellectual disabilities have also had their claims delayed by navigating CBP One.[32] Asylum officers are statutorily required to evaluate if asylum seekers lack the mental competence to assist in their applications and, if so, ensure they have qualified assistance to vindicate their claims.[33]

The entry ban has textual exceptions for migrants whose attempts to set appointments are frustrated by technical issues.[34] CBP officials at many ports have a pattern and practice of ignoring those exceptions and refusing all migrants who lack a valid CBP One appointment.[35]

AOL seeks relief in the termination of the CBP One turnback policy: essentially, ensuring people can exercise their statutory right to claim asylum at the border without an appointment.[36] CREEC seeks relief in the form of a fully accessible CBP One app and accommodation policies to ensure disabled asylum seekers can have “meaningful access” to the asylum process.[37]

Comprehensively safeguarding asylum seeker’s rights would require more than abandoning CBP One. A process that ensures medically vulnerable persons can access timely care and persons with intellectual disabilities can get legal assistance would require deploying more border resources, such as co-locating medical and resettlement organization staff with CBP. Meaningfully curbing racial, ethnic, and linguistic discrimination by CBP, ICE, and Asylum Officers would require expensive and extensive retraining. However, it is evident that the CBP One is not serving the ostensible goal of making the asylum process more efficient, though it may serve the political goal of reinforcing the wall.

Notes

[1] Complaint, at 9, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[2] Id. at 46.

[3] Ana Lucia Verduzco & Stephanie Brewer, Kidnapping of Migrants and Asylum Seekers at the Texas-Tamaulipas Border Reaches Intolerable Levels, (Apr. 4, 2024) https://www.wola.org/analysis/kidnapping-migrants-asylum-seekers-texas-tamaulipas-border-intolerable-levels.

[4] Letter from the Texas Civil Rights Project & the Civil Rights Education & Enforcement Center (CREEC), to U.S. Dept. Homeland Sec., Off. Civ. Rts. & Civ. Liberties (Mar. 25, 2024), at 28, https://4b16d9e9-506a-4ada-aeca-7c3e69a4ed29.usrfiles.com/ugd/4b16d9_e98ae77035514157bc1c4c746b5545e6.pdf.

[5] Linda Urueña Mariño & Christina Asencio, Human Rights First Tracker of Reported Attacks During the Biden Administration Against Asylum Seekers and Migrants Who Are Stranded in and/or Expelled to Mexico, Human Rights First, (Jan. 13, 2022),  at 10, 16, 19, https://humanrightsfirst.org/wp-content/uploads/2022/02/AttacksonAsylumSeekersStrandedinMexicoDuringBidenAdministration.1.13.2022.pdf.

[6] Actions – H.R.815 – 118th Congress (2023-2024): National Security Act, 2024, H.R.815, 118th Cong. (2024), https://www.congress.gov/bill/118th-congress/house-bill/815/all-actions, (failing to pass the immigration language on 02/07/24).

[7] American Immigration Council,The Cost of Immigration Enforcement and Border Security, (Jan. 20, 2021), at 2, https://www.americanimmigrationcouncil.org/sites/default/files/research/the_cost_of_immigration_enforcement_and_border_security.pdf.

[8] Id. at 3-4.

[9] Fact Sheet: Circumvention of Lawful Pathways Final Rule, Dept. Homeland Sect’y., (May 11, 2023), https://www.dhs.gov/news/2023/05/11/fact-sheet-circumvention-lawful-pathways-final-rule.

[10] E. Bay Sanctuary Covenant v. Biden, 993 F.3d 640, 658 (9th Cir. 2021).

[11] Complaint, at 22, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[12] E. Bay Sanctuary Covenant v. Biden, 993 F.3d 640, 658 (9th Cir. 2021).

[13] Id. at 669-70.

[14] E. Bay Sanctuary Covenant v. Trump, 349 F. Supp. 3d 838, 844.

[15] Complaint, at 2, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[16] Fact Sheet: Circumvention of Lawful Pathways Final Rule, Dept. Homeland Sect’y., (May 11, 2023), https://www.dhs.gov/news/2023/05/11/fact-sheet-circumvention-lawful-pathways-final-rule.

[17] Id.

[18] Complaint, at 57, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[19] Complaint, at 3, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[20] Letter from the Texas Civil Rights Project & the Civil Rights Education & Enforcement Center (CREEC), to U.S. Dept. Homeland Sec., Off. Civ. Rts. & Civ. Liberties (Mar. 25, 2024), at 2, https://4b16d9e9-506a-4ada-aeca-7c3e69a4ed29.usrfiles.com/ugd/4b16d9_e98ae77035514157bc1c4c746b5545e6.pdf; see also 29 U.S.C.A. § 794d (a)(1)(A)(ii) (West).

[21] Ruby Ritchin, “I Felt Not Seen, Not Heard”: Gaps in Disability Access at USCIS for People Seeking Protection, 12, (Sep. 19, 2023) https://humanrightsfirst.org/library/i-felt-not-seen-not-heard-gaps-in-disability-access-at-uscis-for-people-seeking-protection.

[22] Letter from the Texas Civil Rights Project & the Civil Rights Education & Enforcement Center (CREEC), to U.S. Dept. Homeland Sec., Off. Civ. Rts. & Civ. Liberties (Mar. 25, 2024), at 6, https://4b16d9e9-506a-4ada-aeca-7c3e69a4ed29.usrfiles.com/ugd/4b16d9_e98ae77035514157bc1c4c746b5545e6.pdf; see also 29 U.S.C.A. § 794d (a)(1)(A)(ii) (West).

[23] Letter from the Texas Civil Rights Project & the Civil Rights Education & Enforcement Center (CREEC), to U.S. Dept. Homeland Sec., Off. Civ. Rts. & Civ. Liberties (Mar. 25, 2024), at 2, https://4b16d9e9-506a-4ada-aeca-7c3e69a4ed29.usrfiles.com/ugd/4b16d9_e98ae77035514157bc1c4c746b5545e6.pdf; see also Complaint, at 4, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[24] Dara Lind, CBP’s Continued ‘Turnbacks’ Are Sending Asylum Seekers Back to Lethal Danger, (Aug. 10, 2023), https://immigrationimpact.com/2023/08/10/cbp-turnback-policy-lawsuit-danger.

[25] Complaint, at 31, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[26] Id.

[27] 8 U.S.C.A. § 1101(a)(42)(A) (West).

[28] Id.

[29] Hernandez Arellano v. Garland, 856 F. App’x 351, 353 (2d Cir. 2021).

[30] Letter from the Texas Civil Rights Project & the Civil Rights Education & Enforcement Center (CREEC), to U.S. Dept. Homeland Sec., Off. Civ. Rts. & Civ. Liberties (Mar. 25, 2024), at 9, https://4b16d9e9-506a-4ada-aeca-7c3e69a4ed29.usrfiles.com/ugd/4b16d9_e98ae77035514157bc1c4c746b5545e6.pdf.

[31] Id.

[32] Id.

[33] Complaint, at 9, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[34] Complaint, at 22, Al Otro Lado and Haitian Bridge Alliance v. Mayorkas, (S.D. Cal. Jul. 26, 2023), No. 3:23-CV-01367-AGS-BLM.

[35] Id. at 23.

[36] Id. at 65-66.

[37] Letter from the Texas Civil Rights Project & the Civil Rights Education & Enforcement Center (CREEC), to U.S. Dept. Homeland Sec., Off. Civ. Rts. & Civ. Liberties (Mar. 25, 2024), at 10-11, https://4b16d9e9-506a-4ada-aeca-7c3e69a4ed29.usrfiles.com/ugd/4b16d9_e98ae77035514157bc1c4c746b5545e6.pdf.

The Stifling Potential of Biden’s Executive Order on AI

April 1, 2024
Administrative Law, Artificial Intelligence

Christhy Le, MJLST Staffer

Biden’s Executive Order on “Safe, Secure, and Trustworthy” AI

On October 30, 2023, President Biden issued a landmark Executive Order to address concerns about the burgeoning and rapidly evolving technology of AI. The Biden administration states that the order’s goal is to ensure that America leads the way in seizing the promising potential of AI while managing the risks of AI’s potential misuse.[1] The Executive Order establishes (1) new standards for AI development, and security; (2) increased protections for Americans’ data and privacy; and (3) a plan to develop authentication methods to detect AI-generated content.[2] Notably, Biden’s Executive Order also highlights the need to develop AI in a way that ensures it advances equity and civil rights, fights against algorithmic discrimination, and creates efficiencies and equity in the distribution of governmental resources.[3]

While the Biden administration’s Executive Order has been lauded as the most comprehensive step taken by a President to safeguard against threats posed by AI, its true impact is yet to be seen. The impact of the Executive Order will depend on its implementation by the agencies that have been tasked with taking action. The regulatory heads tasked with implementing Biden’s Executive Order are the Secretary of Commerce, Secretary of Energy, Secretary of Homeland Security, and the National Institute of Standards and Technology.[4] Below is a summary of the key calls-to-action from Biden’s Executive Order:

  • Industry Standards for AI Development: The National Institute of Science and Tech (NIST), Secretary of Commerce, Secretary of Energy, Secretary of Homeland Secretary, and other heads of agencies selected by the Secretary of Commerce will define industry standards and best practices for the development and deployment of safe and secure AI systems.
  • Red-Team Testing and Reporting Requirements: Companies developing or demonstrating an intent to develop potential dual-use foundational models will be required to provide the Federal Government, on an ongoing basis, with information, reports, and records on the training and development of such models. Companies will also be responsible for sharing the results of any AI red-team testing conducted by the NIST.
  • Cybersecurity and Data Privacy: The Department of Homeland Security shall provide an assessment of potential risks related to the use of AI in critical infrastructure sectors and issue a public report on best practices to manage AI-specific cybersecurity risks. The Director of the National Science Foundation shall fund the creation of a research network to advance privacy research and the development of Privacy Enhancing Technologies (PETs).
  • Synthetic Content Detection and Authentication: The Secretary of Commerce and heads of other relevant agencies will provide a report outlining existing methods and the potential development of further standards/techniques to authenticate content, track its provenance, detect synthetic content, and label synthetic content.
  • Maintaining Competition and Innovation: The government will invest in AI research by creating at least four new National AI Research Institutes and launch a pilot distributing computational, data, model, and training resources to support AI-related research and development. The Secretary of Veterans Affairs will also be tasked with hosting nationwide AI Tech Sprint competitions. Additionally, the FTC will be charged with using its authorities to ensure fair competition in the AI and semiconductor industry.
  • Protecting Civil Rights and Equity with AI: The Secretary of Labor will publish a report on effects of AI on the labor market and employees’ well-being. The Attorney General shall implement and enforce existing federal laws to address civil rights and civil liberties violations and discrimination related to AI. The Secretary of Health and Human Services shall publish a plan to utilize automated or algorithmic systems in administering public benefits and services and ensure equitable distribution of government resources.[5]

Potential for Big Tech’s Outsized Influence on Government Action Against AI

Leading up to the issuance of this Executive Order, the Biden administration met repeatedly and exclusively with leaders of big tech companies. In May 2023, President Biden and Vice President Kamala Harris met with the CEOs of leading AI companies–Google, Anthropic, Microsoft, and OpenAI.[6] In July 2023, the Biden administration celebrated their achievement of getting seven AI companies (Amazon, Anthropic, Google, Inflection, Meta, Microsoft, and Open AI) to make voluntary commitments to work towards developing AI technology in a safe, secure, and transparent manner.[7] Voluntary commitments generally require tech companies to publish public reports on their developed models, submit to third-party testing of their systems, prioritize research on societal risks posed by AI systems, and invest in cybersecurity.[8] Many industry leaders criticized these voluntary commitments for being vague and “more symbolic than substantive.”[9] Industry leaders also noted the lack of enforcement mechanisms to ensure companies follow through on these commitments.[10] Notably, the White House has only allowed leaders of large tech companies to weigh in on requirements for Biden’s Executive Order.

While a bipartisan group of senators[11] hosted a more diverse audience of tech leaders in their AI Insights Forum, the attendees for the first and second forum were still largely limited to CEOs or Cofounders of prominent tech companies, VC executives, or professors at leading universities.[12] Marc Andreessen, a co-founder of Andreessen Horowitz, a prominent VC fund, noted that in order to protect competition, the “future of AI shouldn’t be dictated by a few large corporations. It should be a group of global voices, pooling together diverse insights and ethical frameworks.”[13] On November 3rd, 2023 a group of prominent academics, VC executives, and heads of AI startups published an open letter to the Biden administration where they voiced their concern about the Executive Order’s potentially stifling effects.[14] The group also welcomed a discussion with the Biden administration on the importance of developing regulations that allowed for robust development of open source AI.[15]

Potential to Stifle Innovation and Stunt Tech Startups

While the language of Biden’s Executive Order is fairly broad and general, it still has the potential to stunt early innovation by smaller AI startups. Industry leaders and AI startup founders have voiced concern over the Executive Order’s reporting requirements and restrictions on models over a certain size.[16] Ironically, Biden’s Order includes a claim that the Federal Trade Commission will “work to promote a fair, open, and competitive ecosystem” by helping developers and small businesses access technical resources and commercialization opportunities.

Despite this promise of providing resources to startups and small businesses, the Executive Order’s stringent reporting and information-sharing requirements will likely have a disproportionately detrimental impact on startups. Andrew Ng, a longtime AI leader and cofounder of Google Brain and Coursera, stated that he is “quite concerned about the reporting requirements for models over a certain size” and is worried about the “overhyped dangers of AI leading to reporting and licensing requirements that crush open source and stifle innovation.”[17] Ng believes that regulating AI model size will likely hurt the open-source community and unintentionally benefit tech giants as smaller companies will struggle to comply with the Order’s reporting requirements.[18]

Open source software (OSS) has been around since the 1980s.[19] OSS is code that is free to access, use, and change without restriction.[20] The open source community has played a central part in developing the use and application of AI, as leading AI generative models like ChatGPT and Llama have open-source origins.[21] While both Llama and ChatGPT are no longer open source, their development and advancement heavily relied on using open source models like Transformer, TensorFlow, and Pytorch.[22] Industry leaders have voiced concern that the Executive Order’s broad and vague use of the term “dual-use foundation model” will impose unduly burdensome reporting requirements on small companies.[23] Startups typically have leaner teams, and there is rarely a team solely dedicated to compliance. These reporting requirements will likely create barriers to entry for tech challengers who are pioneering open source AI, as only incumbents with greater financial resources will be able to comply with the Executive Order’s requirements.

While Biden’s Executive Order is unlikely to bring any immediate change, the broad reporting requirements outlined in the Order are likely to stifle emerging startups and pioneers of open source AI.

Notes

[1] https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/.

[2] Id.

[3] Id.

[4] https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/.

[5] https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/.

[6] https://www.whitehouse.gov/briefing-room/statements-releases/2023/05/04/readout-of-white-house-meeting-with-ceos-on-advancing-responsible-artificial-intelligence-innovation/.

[7] https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/21/fact-sheet-biden-harris-administration-secures-voluntary-commitments-from-leading-artificial-intelligence-companies-to-manage-the-risks-posed-by-ai/.

[8] https://www.whitehouse.gov/wp-content/uploads/2023/07/Ensuring-Safe-Secure-and-Trustworthy-AI.pdf.

[9] https://www.nytimes.com/2023/07/22/technology/ai-regulation-white-house.html.

[10] Id.

[11] https://www.heinrich.senate.gov/newsroom/press-releases/read-out-heinrich-convenes-first-bipartisan-senate-ai-insight-forum.

[12] https://techpolicy.press/us-senate-ai-insight-forum-tracker/.

[13] https://www.schumer.senate.gov/imo/media/doc/Marc%20Andreessen.pdf.

[14] https://twitter.com/martin_casado/status/1720517026538778657?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1720517026538778657%7Ctwgr%5Ec9ecbf7ac4fe23b03d91aea32db04b2e3ca656df%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcointelegraph.com%2Fnews%2Fbiden-ai-executive-order-certainly-challenging-open-source-ai-industry-insiders.

[15] Id.

[16] https://www.cnbc.com/2023/11/02/biden-ai-executive-order-industry-civil-rights-labor-groups-react.html.

[17] https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/.

[18] https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/.

[19] https://www.brookings.edu/articles/how-open-source-software-shapes-ai-policy/.

[20] Id.

[21] https://www.zdnet.com/article/why-open-source-is-the-cradle-of-artificial-intelligence/.

[22] Id.

[23] Casado, supra note 14.

Payment Pending: CFPB Proposes to Regulate Digital Wallets

November 27, 2023
Administrative Law, Business Law

Kevin Malecha, MJLST Staffer

Federal regulators are increasingly concerned about digital wallets and person-to-person payment (P2P) apps like Apply Pay, Google Pay, Cash App, and Venmo, and how such services might impact the rights of financial consumers. As many as three-quarters of American adults use digital wallets or payment apps and, in 2022, the total value of transactions was estimated at $893 billion, expected to increase to $1.6 trillion by 2027.[1] In November of 2023, the Consumer Financial Protection Bureau proposed a rule that would expand its supervisory powers to cover certain nonbank providers of these services. The CFPB, an independent federal agency within the broader Federal Reserve System, was created by the Dodd-Frank Act in response to the 2007-2008 financial crisis and subsequent recession. The Bureau is tasked with protecting consumers in the financial space by promulgating and enforcing rules governing a wide variety of financial activities like mortgage lending, debt collection, and electronic payments.[2]

The CFPB has identified digital wallets and payment apps as products that threaten consumer financial rights and well-being.[3] First, because these services collect mass amounts of transaction and financial data, they pose a substantial risk to consumer data privacy.[4] Second, if the provider ceases operations or faces a “bank” run, any funds held in digital accounts may be lost because Federal Deposit Insurance Corporation (FDIC) protection, which insures deposits up to $250,000 in traditional banking institutions, is often unavailable for digital wallets.[5]

Enforcement and Supervision

The CFPB holds dual enforcement and supervisory roles. As one of the federal agencies charged with “implementing the Federal consumer financial laws,”[6] the enforcement powers of the CFPB are broad, but enforcement actions are relatively uncommon. In 2022, the Bureau brought twenty enforcement actions.[7] By contrast, the Commodity Futures Trading Commission (CFTC), which is also tasked in part with protecting financial consumers, brought eighty-two enforcement actions in the same period.[8] In contrast to the limited and reactionary nature of enforcement actions, the CFPB’s supervisory authority requires regulated entities to disclose certain documents and data, such as internal policies and audit reports, and allows CFPB examiners to proactively review their actions to ensure compliance.[9] The Bureau describes its supervisory process as a tool for identifying issues and addressing them before violations become systemic or cause significant harm to consumers.[10]

The CFPB already holds enforcement authority over all digital wallet and payment app services via its broad power to adjudicate violations of financial laws wherever they occur.[11] However, the Bureau has so far enjoyed only limited supervisory authority over the industry.[12] Currently, the CFPB only supervises digital wallets and payment apps when those services are provided by banks or when the provider falls under another CFPB supervision rule.[13] As tech companies like Apple and Google – which do not fall under other CFPB supervision rules – have increasingly entered the market, they have gone unsupervised.

Proposed Rule

Under the organic statute, CFPB’s existing supervisory authority covers nonbank persons that offer certain financial services including real estate and mortgage loans, private education loans, and payday loans.[14] In addition, the statute allows the Bureau to promulgate rules to cover other entities that are “larger participant[s] of a market for other consumer financial products or services.”[15] The proposed rule takes advantage of the power to define “larger participants” and expands the definition to include providers of “general-use digital consumer applications,” which the Bureau defines as funds transfer or wallet functionality through a digital application that the consumer uses to make payments for personal, household, or family purposes.[16] An entity is a “larger participant” if it (1) provides general-use digital consumer payment applications with an annual volume of at least five million transactions and (2) is not a small business as defined by the Small Business Administration.[17] The Bureau will make determinations on an individualized basis and may request documents and information from the entity to determine if it satisfies the requirements, which the entity can then dispute.

Implications for Digital Wallet and Payment App Providers

Major companies like Apple and Google can easily foresee that the CFPB intends to supervise them under the new rule. The Director of the CFPB recently compared the two American companies to Chinese tech companies Alibaba and WeChat that offer similar products and that, in the Director’s view, pose a similar risk to consumer data privacy and financial security.[18] For smaller firms, predicting the Bureau’s intentions is challenging, but existing regulations indicate that the Bureau will issue a written communication to initiate supervision.[19] The entity will then have forty-five days to dispute the finding that they meet the regulatory definition of a “larger participant.”[20] In their response, entities may include a statement of the reason for their objection and records, documents, or other information. Then the Assistant Director of the CFPB will review the response and make a determination. The regulation gives the Assistant Director the ability to request records and documents from the entity prior to the initial notification of intended supervision and throughout the determination process.[21] The Assistant Director also may extend the timeframe for determination beyond the forty-five-day window.[22]

If an entity becomes supervised, the Bureau will contact it for an initial conference.[23] The examiners will then determine the scope of future supervision, taking into consideration the responses at the conference, any records requested prior to or during the conference, and a review of the entity’s compliance management program.[24] The Bureau prioritizes its supervisory activities based on entity size, volume of transactions, size and risk of the relevant market, state oversight, and other market information to which the Bureau has access.[25] Ongoing supervision is likely to vary based on these factors, as well, but may include on-site or remote examination, review of documents and records, testing accounts and transactions for compliance with federal statutes and regulations, and continued review of the compliance management system.[26] The Bureau may then issue a confidential report or letter stating the examiner’s opinion that the entity has violated or is at risk of violating a statute or regulation.[27] While these findings are not final determinations, they do outline specific steps for the entity to regain or ensure compliance and should be taken seriously.[28] Supervisory reports or letters are distinct from enforcement actions and generally do not result in an enforcement action.[29] However, violations may be referred to the Bureau’s Office of Enforcement, which would then launch its own investigation.[30]

The likelihood of the proposed rule resulting in an enforcement action is, therefore, relatively low, but the exposure for regulated entities is difficult to measure because the penalties in enforcement actions vary widely. From October 2022 to October 2023, amounts paid by regulated entities ranged from $730,000 paid by a remittance provider that violated Electronic Funds Transfer rules,[31] to $3.7 billion in penalties and redress paid by Wells Fargo for headline-making violations of the Consumer Financial Protection Act.[32]

Notes

[1] Analysis of Deposit Insurance Coverage on Funds Stored Through Payment Apps, Consumer Fin. Prot. Bureau (Jun. 1, 2023), https://www.consumerfinance.gov/data-research/research-reports/issue-spotlight-analysis-of-deposit-insurance-coverage-on-funds-stored-through-payment-apps/full-report.

[2] Final Rules, Consumer Fin. Prot. Bureau, https://www.consumerfinance.gov/rules-policy/final-rules (last visited Nov. 16, 2023).

[3] CFPB Proposes New Federal Oversight of Big Tech Companies and Other Providers of Digital Wallets and Payment Apps, Consumer Fin. Prot. Bureau (Nov. 7, 2023), https://www.consumerfinance.gov/about-us/newsroom/cfpb-proposes-new-federal-oversight-of-big-tech-companies-and-other-providers-of-digital-wallets-and-payment-apps.

[4] Id.

[5] Id.

[6] 12 U.S.C. § 5492.

[7] Enforcement by the numbers, Consumer Fin. Prot. Bureau (Nov. 8, 2023), https://www.consumerfinance.gov/enforcement/enforcement-by-the-numbers.

[8] CFTC Releases Annual Enforcement Results, Commodity Futures Trading Comm’n (Oct. 20, 2022), https://www.cftc.gov/PressRoom/PressReleases/8613-22.

[9] CFPB Supervision and Examination Manual, Consumer Fin. Prot. Bureau at Overview 10 (Mar. 2017), https://files.consumerfinance.gov/f/documents/cfpb_supervision-and-examination-manual_2023-09.pdf.

[10] An Introduction to CFPB’s Exams of Financial Companies, Consumer Fin. Prot. Bureau 4 (Jan. 9, 2023), https://files.consumerfinance.gov/f/documents/cfpb_an-introduction-to-cfpbs-exams-of-financial-companies_2023-01.pdf.

[11] 12 U.S.C. §5563(a).

[12] CFPB Proposes New Federal Oversight of Big Tech Companies and Other Providers of Digital Wallets and Payment Apps, Consumer Fin. Prot. Bureau (Nov. 7, 2023), https://www.consumerfinance.gov/about-us/newsroom/cfpb-proposes-new-federal-oversight-of-big-tech-companies-and-other-providers-of-digital-wallets-and-payment-apps.

[13] Id.

[14] 12 U.S.C. § 5514.

[15] Id.

[16] Defining Larger Participants of a Market for General-Use Digital Consumer Payment, Consumer Fin. Prot. Bureau 3 (Nov. 7, 2023), https://files.consumerfinance.gov/f/documents/cfpb_nprm-digital-payment-apps-lp-rule_2023-11.pdf.

[17] Id. at 4.

[18] Rohit Chopra, Prepared Remarks of CFPB Director Rohit Chopra at the Brookings Institution Event on Payments in a Digital Century, Consumer Fin. Prot. Bureau (Oct. 6, 2023), https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-at-the-brookings-institution-event-on-payments-in-a-digital-century.

[19] 12 CFR § 1090.103(a).

[20] 12 CFR § 1090.103(b).

[21] 12 CFR § 1090.103(c).

[22] 12 CFR § 1090.103(d).

[23] Defining Larger Participants of a Market for General-Use Digital Consumer Payment, Consumer Fin. Prot. Bureau 6 (Nov. 7, 2023), https://files.consumerfinance.gov/f/documents/cfpb_nprm-digital-payment-apps-lp-rule_2023-11.pdf.

[24] Id.

[25] Id. at 5.

[26] Id. at 6.

[27] An Introduction to CFPB’s Exams of Financial Companies, Consumer Fin. Prot. Bureau 3 (Jan. 9, 2023), https://files.consumerfinance.gov/f/documents/cfpb_an-introduction-to-cfpbs-exams-of-financial-companies_2023-01.pdf.

[28] Id.

[29] Id.

[30] Id.

[31] CFPB Orders Servicio UniTeller to Refund Fees and Pay Penalty for Failing to Follow Remittance, Consumer Fin. Prot. Bureau (Dec. 22, 2022), https://www.consumerfinance.gov/enforcement/actions/servicio-uniteller-inc.

[32] CFPB Orders Wells Fargo to Pay $3.7 Billion for Widespread Mismanagement of Auto Loans, Mortgages, and Deposit Accounts, Consumer Fin. Prot. Bureau (Dec. 20, 2022), https://www.consumerfinance.gov/enforcement/actions/wells-fargo-bank-na-2022.

Conflicts of Interest and Conflicting Interests: The SEC’s Controversial Proposed Rule

November 27, 2023
Administrative Law, Artificial Intelligence, New Technology

Shaadie Ali, MJLST Staffer

A controversial proposed rule from the SEC on AI and conflicts of interest is generating significant pushback from brokers and investment advisers. The proposed rule, dubbed “Reg PDA” by industry commentators in reference to its focus on “predictive data analytics,” was issued on July 26, 2023.[1] Critics claim that, as written, Reg PDA would require broker-dealers and investment managers to effectively eliminate the use of almost all technology when advising clients.[2] The SEC claims the proposed rule is intended to address the potential for AI to hurt more investors more quickly than ever before, but some critics argue that the SEC’s proposed rule would reach far beyond generative AI, covering nearly all technology. Critics also highlight the requirement that conflicts of interest be eliminated or neutralized as nearly impossible to meet and a departure from traditional principles of informed consent in financial advising.[3]

The SEC’s 2-page fact sheet on Reg PDA describes the 239-page proposal as requiring broker-dealers and investment managers to “eliminate or neutralize the effect of conflicts of interest associated with the firm’s use of covered technologies in investor interactions that place the firm’s or its associated person’s interest ahead of investors’ interests.”[4] The proposal defines covered technology as “an analytical, technological, or computational function, algorithm, model, correlation matrix, or similar method or process that optimizes for, predicts, guides, forecasts, or directs investment-related behaviors or outcomes in an investor interaction.”[5] Critics have described this definition of “covered technology” as overly broad, with some going so far as to suggest that a calculator may be “covered technology.”[6] Despite commentators’ insistence, this particular contention is implausible – in its Notice of Proposed Rulemaking, the SEC stated directly that “[t]he proposed definition…would not include technologies that are designed purely to inform investors.”[7] More broadly, though, the SEC touts the proposal’s broadness as a strength, noting it “is designed to be sufficiently broad and principles-based to continue to be applicable as technology develops and to provide firms with flexibility to develop approaches to their use of technology consistent with their business model.”[8]

This move by the SEC comes amidst concerns raised by SEC chair Gary Gensler and the Biden administration about the potential for the concentration of power in artificial intelligence platforms to cause financial instability.[9] On October 30, 2023, President Biden signed an Executive Order that established new standards for AI safety and directed the issuance of guidance for agencies’ use of AI.[10] When questioned about Reg PDA at an event in early November, Gensler defended the proposed regulation by arguing that it was intended to protect online investors from receiving skewed recommendations.[11] Elsewhere, Gensler warned that it would be “nearly unavoidable” that AI would trigger a financial crisis within the next decade unless regulators intervened soon.[12]

Gensler’s explanatory comments have done little to curb criticism by industry groups, who have continued to submit comments via the SEC’s notice and comment process long after the SEC’s October 10 deadline.[13] In addition to highlighting the potential impacts of Reg PDA on brokers and investment advisers, many commenters questioned whether the SEC had the authority to issue such a rule. The American Free Enterprise Chamber of Commerce (“AmFree”) argued that the SEC exceeded its authority under both its organic statutes and the Administrative Procedures Act (APA) in issuing a blanket prohibition on conflicts of interest.[14] In their public comment, AmFree argued the proposed rule was arbitrary and capricious, pointing to the SEC’s alleged failure to adequately consider the costs associated with the proposal.[15] AmFree also invoked the major questions doctrine to question the SEC’s authority to promulgate the rule, arguing “[i]f Congress had meant to grant the SEC blanket authority to ban conflicts and conflicted communications generally, it would have spoken more clearly.”[16] In his scathing public comment, Robinhood Chief Legal and Corporate Affairs Officer Daniel M. Gallagher alluded to similar APA concerns, calling the proposal “arbitrary and capricious” on the grounds that “[t]he SEC has not demonstrated a need for placing unprecedented regulatory burdens on firms’ use of technology.”[17] Gallagher went on to condemn the proposal’s apparent “contempt for the ordinary person, who under the SEC’s apparent world view [sic] is incapable of thinking for himself or herself.”[18]

Although investor and broker industry groups have harshly criticized Reg PDA, some consumer protection groups have expressed support through public comment. The Consumer Federation of America (CFA) endorsed the proposal as “correctly recogniz[ing] that technology-driven conflicts of interest are too complex and evolve too quickly for the vast majority of investors to understand and protect themselves against, there is significant likelihood of widespread investor harm resulting from technology-driven conflicts of interest, and that disclosure would not effectively address these concerns.”[19] The CFA further argued that the final rule should go even further, citing loopholes in the existing proposal for affiliated entities that control or are controlled by a firm.[20]

More generally, commentators have observed that the SEC’s new prescriptive rule that firms eliminate or neutralize potential conflicts of interest marks a departure from traditional securities laws, wherein disclosure of potential conflicts of interest has historically been sufficient.[21] Historically, conflicts of interest stemming from AI and technology have been regulated the same as any other conflict of interest – while brokers are required to disclose their conflicts, their conduct is primarily regulated through their fiduciary duty to clients. In turn, some commentators have suggested that the legal basis for the proposed regulations is well-grounded in the investment adviser’s fiduciary duty to always act in the best interest of its clients.[22] Some analysts note that “neutralizing” the effects of a conflict of interest from such technology does not necessarily require advisers to discard that technology, but changing the way that firm-favorable information is analyzed or weighed, but it still marks a significant departure from the disclosure regime. Given the widespread and persistent opposition to the rule both through the note and comment process and elsewhere by commentators and analysts, it is unclear whether the SEC will make significant revisions to a final rule. While the SEC could conceivably narrow definitions of “covered technology,” “investor interaction,” and “conflicts of interest,” it is difficult to imagine how the SEC could modify the “eliminate or neutralize” requirement in a way that would bring it into line with the existing disclosure-based regime.

For its part, the SEC under Gensler is likely to continue pursuing regulations on AI regardless of the outcome of Reg PDA. Gensler has long expressed his concerns about the impacts of AI on market stability. In a 2020 paper analyzing regulatory gaps in the use of generative AI in financial markets, Gensler warned, “[e]xisting financial sector regulatory regimes – built in an earlier era of data analytics technology – are likely to fall short in addressing the risks posed by deep learning.”[23] Regardless of how the SEC decides to finalize its approach to AI in conflict of interest issues, it is clear that brokers and advisers are likely to resist broad-based bans on AI in their work going forward.

Notes

[1] Press Release, Sec. and Exch. Comm’n., SEC Proposes New Requirements to Address Risks to Investors From Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Jul. 26, 2023).

[2] Id.

[3] Jennifer Hughes, SEC faces fierce pushback on plan to police AI investment advice, Financial Times (Nov. 8, 2023), https://www.ft.com/content/766fdb7c-a0b4-40d1-bfbc-35111cdd3436.

[4] Sec. Exch. Comm’n., Fact Sheet: Conflicts of Interest and Predictive Data Analytics (2023).

[5] Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers,  88 Fed. Reg. 53960 (Proposed Jul. 26, 2021) (to be codified at 17 C.F.R. pts. 240, 275) [hereinafter Proposed Rule].

[6] Hughes, supra note 3.

[7] Proposed Rule, supra note 5.

[8] Id.

[9] Stefania Palma and Patrick Jenkins, Gary Gensler urges regulators to tame AI risks to financial stability, Financial Times (Oct. 14, 2023), https://www.ft.com/content/8227636f-e819-443a-aeba-c8237f0ec1ac.

[10] Fact Sheet, White House, President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence (Oct. 30, 2023).

[11] Hughes, supra note 3.

[12] Palma, supra note 9.

[13] See Sec. Exch. Comm’n., Comments on Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (last visited Nov. 13, 2023), https://www.sec.gov/comments/s7-12-23/s71223.htm (listing multiple comments submitted after October 10, 2023).

[14] Am. Free Enter. Chamber of Com., Comment Letter on Proposed Rule regarding Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Oct. 10, 2023), https://www.sec.gov/comments/s7-12-23/s71223-270180-652582.pdf.

[15] Id. at 14-19.

[16] Id. at 9.

[17] Daniel M. Gallagher, Comment Letter on Proposed Rule regarding Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Oct. 10, 2023), https://www.sec.gov/comments/s7-12-23/s71223-271299-654022.pdf.

[18] Id. at 43.

[19] Consumer Fed’n. of Am., Comment Letter on Proposed Rule regarding Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Oct. 10, 2023), https://www.sec.gov/comments/s7-12-23/s71223-270400-652982.pdf.

[20] Id.

[21] Ken D. Kumayama et al., SEC Proposes New Conflicts of Interest Rule for Use of AI by Broker-Dealers and Investment Advisers, Skadden (Aug. 10, 2023), https://www.skadden.com/insights/publications/2023/08/sec-proposes-new-conflicts.

[22] Colin Caleb, ANALYSIS: Proposed SEC Regs Won’t Allow Advisers to Sidestep AI, Bloomberg Law (Aug. 10, 2023), https://news.bloomberglaw.com/bloomberg-law-analysis/analysis-proposed-sec-regs-wont-allow-advisers-to-sidestep-ai.

[23] Gary Gensler and Lily Bailey, Deep Learning and Financial Stability (MIT Artificial Intel. Glob. Pol’y F., Working Paper 2020) (in which Gensler identifies several potential systemic risks to the financial system, including overreliance and uniformity in financial modeling, overreliance on concentrated centralized datasets, and the potential of regulators to create incentives for less-regulated entities to take on increasingly complex functions in the financial system).

Cracking the Code: Navigating New SEC Rules Governing Cybersecurity Disclosure

November 13, 2023
Administrative Law, Cyber Security, Securities Law

Noah Schottenbauer, MJLST Staffer

In response to the dramatic impact cybersecurity incidents have on investors through the decline of stock value and sizeable costs to companies in rectifying breaches,  the SEC adopted new rules governing cybersecurity-related disclosures for public companies, covering both the disclosure of individual cybersecurity incidents as well as periodic disclosures of a company’s procedures to assess, identify, and manage material cybersecurity risks, management’s role in assessing and managing cybersecurity risks, and the board of directors’ oversight of cybersecurity risks.[1]

Before evaluating the specifics of the new SEC cybersecurity disclosure requirements, it is important to understand why information about cybersecurity incidents is important to investors. In recent years, data breaches have led to an average decline in stock value of 7.5% amongst publicly traded companies, with impacts being felt long after the date of the breach, as demonstrated by companies experiencing a significant data breach underperforming the NASDAQ by an average of 8.6% after one year.[2] One of the forces driving this decline in stock value is the immense costs associated with rectifying a data breach for the affected company. In 2022, the average cost of a data breach for U.S. companies was $9.44 million, drawn from ransom payments, disruptions in business operations, legal and audit fees, and other associated expenses.[3]

Summary Of Required Disclosures

  • Material Cybersecurity Incidents (Form 8-K, Item 1.05)

Amendments to Item 1.05 of Form 8-K require that reporting companies disclose any cybersecurity incident deemed to be material.[4] When making such disclosures, companies are required to “describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.”[5]

So, what is a material cybersecurity incident? The SEC defines cybersecurity incident as “an unauthorized occurrence . . . on or conducted through a registrant’s information systems that jeopardizes the confidentiality, integrity, or availability of a registrant’s information systems or any information residing therein.”[6]

The definition of material, on the other hand, lacks the same degree of clarity. Based on context offered by the SEC through the rulemaking process, material is to be used in a way that is consistent with other securities laws.[7] Under this standard, information, or, in this case, a cybersecurity incident, would be considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important.”[8] This determination is made based on a “delicate assessment of the inferences a ‘reasonable shareholder’ would draw from a given set of facts and the significance of those inferences to him.”[9] Even with this added context, what characteristics of a cybersecurity incident make it material remain unclear, but considering the fact that the rules are being implemented with the intent of protecting investor interests, the safest course of action would be to disclose a cybersecurity incident when in doubt of its materiality.[10]

It is important to note that this disclosure mandate is not limited to incidents that occur within the company’s own systems. If a material cybersecurity incident happens on third-party systems that a company utilizes, that too must be disclosed.[11] However, in these situations, companies are only expected to disclose information that is readily accessible, meaning they are not required to go beyond their “regular channels of communication” to gather pertinent information.[12]

Regarding the mechanics of the disclosure, the SEC stipulates that companies must file an Item 1.05 of Form 8-K within four business days of determining that a cybersecurity incident is material.[13] However, delaying disclosure may be allowed in limited circumstances where the United States Attorney General determines that immediate disclosure may seriously threaten national security or public safety.[14]

If there are any changes in the initially-disclosed information or if new material information is discovered that was not available at the time of the first disclosure, registrants are obligated to update their disclosure by filing an amended Form 8-K, ensuring that all relevant information related to the cybersecurity incident is available to the public and stakeholders.[15]

  • Risk Management & Strategy (Regulation S-K, Item 106(b))

Under amendments to Item 106(b) of Regulation S-K, reporting companies are obligated to describe their  “processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.”[16] When detailing these processes, companies must specifically address three primary points. First, they need to indicate how and if the cybersecurity processes described in Item 106(b) fall under the company’s overarching risk management system or procedures. Second, companies must clarify whether they involve assessors, consultants, auditors, or other third-party entities in relation to these cybersecurity processes. Third,  they must describe if they possess methods to monitor and access significant risks stemming from cybersecurity threats when availing the services of any third-party providers.[17]

In addition to the three enumerated elements under Item 106(b), companies are expected to furnish additional information to ensure a comprehensive understanding of their cybersecurity procedures for potential investors. This supplementary disclosure should encompass “whatever information is necessary, based on their facts and circumstances, for a reasonable investor to understand their cybersecurity processes.”[18] While companies are mandated to reveal if they collaborate with third-party service providers concerning their cybersecurity procedures, they are not required to disclose the specific names of these providers or offer a detailed description of the services these third-party entities provide, thus striking a balance between transparency and confidentiality and ensuring that investors have adequate information.[19]

  • Governance (Regulation S-K, Item 106(c))

Amendments to Regulation S-K, Item 106(c) require that companies: (1) describe the board’s oversight of the risks emanating from cybersecurity threats, and (2) characterize management’s role in both assessing and managing material risks arising from such threats.[20]

When detailing management’s role concerning these cybersecurity threats, there are a number of issues that should be addressed. First, companies should clarify which specific management positions or committees are entrusted with the responsibility of assessing and managing these risks. Additionally, the expertise of these designated individuals or groups should be outlined in such detail as necessary to comprehensively describe the nature of their expertise. Second, a description of the processes these entities employ to stay informed about, and to monitor, the prevention, detection, mitigation, and remediation of cybersecurity incidents should be included. Third, companies should indicate if and how these individuals or committees convey information about such risks to the board of directors or potentially to a designated committee or subcommittee of the board.[21]

The disclosures required under Item 106(c) are aimed at balancing investor accessibility to information with the company’s ability to maintain autonomy in determining cybersecurity practices in the context of organizational structure; therefore, disclosures do not need to be overly detailed.[22]

  • Foreign Private Issuers (Form 6-K & Form 20-F)

The rules addressed above only apply to domestic companies, but the SEC imposed parallel cybersecurity disclosure requirements for foreign private issuers under Form 6-K (incident reporting) and Form 20-K (periodic reporting).[23]

Key Dates

The SEC’s final rules are effective as of September 5, 2023, but the Form 8-K and Regulation S-K reporting requirements have yet to take effect. The key compliance dates for each are as follows:

  • Form 8-K Item 1.05(a) Incident Reporting – December 18, 2023
  • Regulation S-K Periodic Reporting – Fiscal years ending on or after December 15, 2023

Smaller reporting companies are provided with an extra 180 days to comply with Form 8-K Item 1.05. Under this grant, small companies will be expected to begin incident reporting on June 15, 2024. No such extension was granted to smaller reporting companies with regard to Regulation S-K Periodic Reporting.[24]

Potential Impact On Cybersecurity Policy

The actual impact of the SEC’s new disclosure requirements will likely remain unclear for some time, yet the regulations compel companies to adopt a greater sense of discipline and transparency in their cybersecurity practices. Although the primary intent of these rules is investor protection, they may also influence how companies formulate their cybersecurity strategies, given the requirement to discuss such policies in their annual disclosures. This heightened level of accountability, regarding defensive measures and risk management strategies in response to cybersecurity threats, may encourage companies to implement more robust cybersecurity practices or, at the very least, ensure that cybersecurity becomes a regular topic of discussion amongst senior leadership. Consequently, the SEC’s initiative may serve as a catalyst for strengthening cybersecurity policies within corporate entities, while also providing investors with essential information for making informed decisions in the marketplace.

Further Information

The overview of the new SEC rules governing cybersecurity disclosures provided above is precisely that: an overview. For more information regarding the requirements and applicability of these rules please refer to the official rules and the SEC website.

Notes

[1] Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Exchange Act Release No. 33-11216, Exchange Act Release No. 34-97989 (July 26, 2023) [hereinafter Final Rule Release], https://www.sec.gov/files/rules/final/2023/33-11216.pdf.

[2] Keman Huang et al., The Devastating Business Impact of a Cyber Breach, Harv. Bus Rev., May 4, 2023, https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach.

[3] Id.

[4] Final Rule Release, supra note 1, at 12

[5] Id. at 49.

[6] Id. at 76.

[7] Id. at 14.

[8] TSC Indus. v. Northway, 426 U.S. 438, 449 (1976).

[9] Id. at 450.

[10] Id. at 448.

[11] Final Rule Release, supra note 1, at 30.

[12] Id. at 31.

[13] Id. at 32.

[14] Id. at 28.

[15] Id. at 50–51.

[16] Id. at 61.

[17] Id. at 63.

[18] Id.

[19] Id. at 60.

[20] Id. at 12.

[21] Id. at 70.

[22] Id.

[23] Id. at 12.

[24] Id. at 107.

The Double-Helix Dilemma: Navigating Privacy Pitfalls in Direct-to-Consumer Genetic Testing

November 7, 2023
Administrative Law, Biotechnology, Data, Ethics, Food and Drug Law, Health Law, Healthcare, Privacy

Ethan Wold, MJLST Staffer

Introduction

On October 22, direct-to-consumer genetic testing (DTC-GT) company 23andME sent emails to a number of its customers informing them of a data breach into the company’s “DNA Relatives” feature that allows customers to compare ancestry information with other users worldwide.[1] While 23andMe and other similar DTC-GT companies offer a number of positive benefits to consumers, such as testing for health predispositions and carrier statuses of certain genes, this latest data breach is a reminder that before choosing to opt into these sorts of services one should be aware of the potential risks that they present.

Background

DTC-GT companies such as 23andMe and Ancestry.com have proliferated and blossomed in recent years. It is estimated over 100 million people have utilized some form of direct-to-consumer genetic testing.[2] Using biospecimens submitted by consumers, these companies sequence and analyze an individual’s genetic information to provide a range of services pertaining to one’s health and ancestry.[3] The October 22 data breach specifically pertained to 23andMe’s “DNA Relatives” feature.[4] The DNA Relatives feature can identify relatives on any branch of one’s family tree by taking advantage of the autosomal chromosomes, the 22 chromosomes that are passed down from your ancestors on both sides of your family, and one’s X chromosome(s).[5] Relatives are identified by comparing the customer’s submitted DNA with the DNA of other 23andMe members who are participating in the DNA Relatives feature.[6] When two people are found to have an identical DNA segment, it is likely they share a recent common ancestor.[7] The DNA Relatives feature even uses the length and number of these identical segments to attempt to predict the relationship between genetic relatives.[8] Given the sensitive nature of sharing genetic information, there are often privacy concerns regarding practices such as the DNA Relatives feature. Yet despite this, the legislation and regulations surrounding DTC-GT is somewhat limited.

Legislation

The Health Insurance Portability and Accountability Act (HIPAA) provides the baseline privacy and data security rules for the healthcare industry.[9] HIPAA’s Privacy Rule regulates the use and disclosure of a person’s “protected health information” by a “covered entity.[10] Under the Act, the type of genetic information collected by 23andMe and other DTC-GT companies does constitute “protected health information.”[11] However, because HIPAA defines a “covered entity” as a health plan, healthcare clearinghouse, or health-care provider, DTC-GT companies do not constitute covered entities and therefore are not under the umbrella of HIPAA’s Privacy Rule.[12]

Thus, the primary source of regulation for DTC-GT companies appears to be the Genetic Information Nondiscrimination Act (GINA). GINA was enacted in 2008 for the purpose of protecting the public from genetic discrimination and alleviating concerns about such discrimination and thereby encouraging individuals to take advantage of genetic testing, technologies, research, and new therapies.[13] GINA defines genetic information as information from genetic tests of an individual or family members and includes information from genetic services or genetic research.[14] Therefore, DTC-GT companies fall under GINA’s jurisdiction. However, GINA only applies to the employment and health insurance industries and thus neglects many other potential arenas where privacy concerns may present.[15] This is especially relevant for 23andMe customers, as signing up for the service serves as consent for the company to use and share your genetic information with their associated third-party providers.[16] As a case in point, in 2018 the pharmaceutical giant GlaxoSmithKline purchased a $300 million stake in 23andMe for the purpose of gaining access to the company’s trove of genetic information for use in their drug development trials.[17]

Executive Regulation

In addition to the legislation above, three different federal administrative agencies primarily regulate the DTC-GT industry: the Food and Drug Administration (FDA), the Centers of Medicare and Medicaid services (CMS), and the Federal Trade Commission (FTC). The FDA has jurisdiction over DTC-GT companies due to the genetic tests they use being labeled as “medical devices”[18] and in 2013 exercised this authority over 23andMe by sending a letter to the company resulting in the suspending of one of its health-related genetic tests.[19] However, the FDA only has jurisdiction over diagnostic tests and therefore does not regulate any of the DTC-GT services related to genealogy such as 23andMe’s DNA Relatives feature.[20] Moreover, the FDA does not have jurisdiction to regulate the other aspects of DTC-GT companies’ activities or data practices.[21] CMS has the ability to regulate DTC-GT companies through enforcement of the Clinical Laboratory Improvements Act (CLIA), which requires that genetic testing laboratories ensure the accuracy, precision, and analytical validity of their tests.[22] But, like the FDA, CMS only has jurisdiction over tests that diagnose a disease or assess health.[23]

Lastly, the FTC has broad authority to regulate unfair or deceptive business practices under the Federal Trade Commission Act (FTCA) and has levied this authority against DTC-GT companies in the past. For example, in 2014 the agency brought an action against two DTC-GT companies who were using genetic tests to match consumers to their nutritional supplements and skincare products.[24] The FTC alleged that the companies’ practices related to data security were unfair and deceptive because they failed to implement reasonable policies and procedures to protect consumers’ personal information and created unnecessary risks to the personal information of nearly 30,000 consumers.[25] This resulted in the companies entering into an agreement with the FTC whereby they agreed to establish and maintain comprehensive data security programs and submit to yearly security audits by independent auditors.[26]

Potential Harms

As the above passages illustrate, the federal government appears to recognize and has at least attempted to mitigate privacy concerns associated with DTC-GT. Additionally, a number of states have passed their own laws that limit DTC-GT in certain aspects.[27] Nevertheless, given the potential magnitude and severity of harm associated with DTC-GT it makes one question if it is enough. Data breaches involving health-related data are growing in frequency and now account for 40% of all reported data breaches.[28] These data breaches result in unauthorized access to DTC-GT consumer-submitted data and can result in a violation of an individual’s genetic privacy. Though GINA aims to prevent it, genetic discrimination in the form of increasing health insurance premiums or denial of coverage by insurance companies due to genetic predispositions remains one of the leading concerns associated with these violations. What’s more, by obtaining genetic information from DTC-GT databases, it is possible for someone to recover a consumer’s surname and combine that with other metadata such as age and state to identify the specific consumer.[29] This may in turn lead to identity theft in the form of opening accounts, taking out loans, or making purchases in your name, potentially damaging your financial well-being and credit score. Dealing with the aftermath of a genetic data breach can also be expensive. You may incur legal fees, credit monitoring costs, or other financial burdens in an attempt to mitigate the damage.

Conclusion

As it sits now, genetic information submitted to DTC-GT companies already contains a significant volume of consequential information. As technology continues to develop and research presses forward, the volume and utility of this information will only grow over time. Thus, it is crucially important to be aware of risks associated with DTC-GT services.

This discussion is not intended to discourage individuals from participating in DTC-GT. These companies and the services they offer provide a host of benefits, such as allowing consumers to access genetic testing without the healthcare system acting as a gatekeeper, thus providing more autonomy and often at a lower price.[30] Furthermore, the information provided can empower consumers to mitigate the risks of certain diseases, allow for more informed family planning, or gain a better understanding of their heritage.[31] DTC-GT has revolutionized the way individuals access and understand their genetic information. However, this accessibility and convenience comes with a host of advantages and disadvantages that must be carefully considered.

Notes

[1] https://www.reuters.com/world/us/23andme-notifies-customers-data-breach-into-its-dna-relatives-feature-2023-10-24/#:~:text=%22There%20was%20unauthorized%20access%20to,exposed%20to%20the%20threat%20actor.%22

[2] https://www.ama-assn.org/delivering-care/patient-support-advocacy/protect-sensitive-individual-data-risk-dtc-genetic-tests#:~:text=Use%20of%20direct%2Dto%2Dconsumer,November%202021%20AMA%20Special%20Meeting

[3] https://go-gale-com.ezp3.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[4] https://www.reuters.com/world/us/23andme-notifies-customers-data-breach-into-its-dna-relatives-feature-2023-10-24/#:~:text=%22There%20was%20unauthorized%20access%20to,exposed%20to%20the%20threat%20actor.%22

[5] https://customercare.23andme.com/hc/en-us/articles/115004659068-DNA-Relatives-The-Genetic-Relative-Basics

[6] Id.

[7] Id.

[8] Id.

[9] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[10] https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf

[11] Id.

[12] Id; https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[13] https://www.eeoc.gov/statutes/genetic-information-nondiscrimination-act-2008

[14] Id.

[15] https://europepmc.org/backend/ptpmcrender.fcgi?accid=PMC3035561&blobtype=pdf

[16] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[17] https://news.yahoo.com/news/major-drug-company-now-access-194758309.html

[18] https://uscode.house.gov/view.xhtml?req=(title:21%20section:321%20edition:prelim)

[19] https://core.ac.uk/download/pdf/33135586.pdf

[20] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[21] Id.

[22] https://www.law.cornell.edu/cfr/text/42/493.1253

[23] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[24] https://www.ftc.gov/system/files/documents/cases/140512genelinkcmpt.pdf

[25] Id.

[26] Id.

[27] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[28] Id.

[29] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[30] Id.

[31] Id.

The Inaccessible Cure: the Struggle With Feline Infectious Peritonitis and Thoughts on the Underlying Law

October 10, 2023
Administrative Law, Food and Drug Law, Health Law, Intellectual Property, Patents

Lan Gan, MJLST Staffer

For fellow feline fanatics, you may share some of my traits. I care for my cat’s health as I care for my own. Besides giving her nutritiously balanced meals, I take notes when she’s unwell and schedule annual physicals for her, just like I would for myself. I also browse online discussions posts of cats. Some make me laugh, some give me new understanding of cat behaviors, but the ones about feline infectious peritonitis are always grim.

Feline Infectious Peritonitis, or FIP, is a severe disease that typically develops in young cats when they are infected with feline enteric coronavirus (FeCV) which later mutates into FIPV and causes inflammations.[1] The mutations happen about ten percent of the time, and, until recently, have almost always been deadly.[2]

In 2018, researchers at the School of Veterinary Medicine at UC Davis partnered with Gilead Sciences and published an article about the discovery of GS-441524, which, through their experiments with cats that were infected with FIPV in an in vitro process, “caused a rapid reversal of disease signs and return to normality with as little as two weeks of treatment in 10/10 cats and with no apparent toxicity.”[3] Another paper, published in 2019, also by researchers of the two institutions, revealed that GS-441524 was an effective treatment for cats with naturally occurring FIP.[4]

This gave cat rescuers and cat owners hope. But despite promising experiment results, Niels Pederson, who partook in the studies and was a long-time researcher devoted to FIP, warned that the development was “proof-of-concept,” showing possibility in terms of science but not immediately translating into commercially available products.[5] Subsequently, GS-441524 did not move forward to become an FDA-approved drug to treat cats.[6] Instead, it seemed to be set aside as Gilead prioritized another drug, remdesivir, which is identical to GS-441524 in part of its structural formula and has the same mechanism of inhibiting coronavirus.[7] When Gilead failed to obtain FDA approval to use remdesivir to treat Ebola, they changed course to study its effects on the then-rising Covid-19 pandemic.[8] GS-441524, with its studies on animals halted, was also part of the race and was argued by some scientists to have more efficacy in treating Covid-19 than remdesivir.[9]

The much-needed cure became inaccessible. In as early as 2019, anxious people were turning to the black market for help. GS-441524 that circulated on the black market had murky origins: potential leaks from lab orders for research, personnel that synthesized the compound themselves in overseas locations such as China.[10] The benefits of the drug, while still salient, based on surveys of cat owners who utilized them, were potentially compromised by the disparity in quality of the black market drugs, and lack of veterinary expertise involved.[11]

Pharmaceutical companies are more than incentivized to patent their research products. A search on World Intellectual Property Organization (WIPO)’s database revealed 66 patents applied for by Gilead, from as early as 2009 to as recently as July 2023.[12] The list of patents documented development in Gilead’s GS-441524 research.[13] Gilead patented GS-441524’s treatment for cats in 2018 and 2020[14], but those accounted for only 3 of the 66 patents they obtained; the rest were regarding human use.[15] Patents benefit their owners by giving them a cause of action against future infringement. They are about owning, not sharing. Patents are the culmination of a strenuous journey of scientific research. But this celebratory landmark might not go any further. Many patents do not make their way onto the market; having one is not itself an incentive for doing so.

Next comes the approval process as stipulated in federal law. 21 U.S.C. § 360b governs the approval process of new animal drugs.[16] The statute lays the burden on pharmaceutical companies – referred to as drug sponsors – of contacting the FDA after initial research of the drug, making the decision to pursue approval for the drug, and conducting tests to ensure the effectiveness and safety of the drug.[17] Additionally, the Generic Animal Drug and Patent Term Restoration Act (GADPTRA) of 1988 provides an abbreviated process for generic copies of approved new animal drugs;[18] the Minor Use and Minor Species Animal Health Act (the “Mums Act”) of 2004 paves paths for drugs affecting a small population of major species of animals (defined as horses, dogs, cats, cattle, pigs, turkeys and chickens) and minor species (those that are not major species) that have few drugs available to them.[19] In 2018, the Animal Drug and Animal Generic Drug User Fee Amendments expanded the eligibility for conditional approval of non-MUMS drugs intending to treat a serious or life-threatening disease or condition or address an unmet animal or human health need, for which a demonstration of effectiveness would require a complex or particularly difficult study or studies.[20]

How has GS-441524 escaped the statutory provisions when they have been amended to be more inclusive? There may be various reasons. It may not qualify for conditional approval under 21 U.S.C. § 360ccc(a)(1)(ii) because peer-reviewed articles have already demonstrated the drug’s effectiveness. It may be hard to quantify the FIP-affected cat population to meet the “minor use” threshold set out in the Mums Act because of the difficulty of FIP testing. Current testing cannot differentiate between FeCV and the mutated FIPV, and an FIP diagnosis is often assumed for young cats based on their higher infection rate.[21] Lastly, no matter which approval process GS-441524 is eligible to take, the process wouldn’t start unless Gilead decides to contact the FDA and set forth the drug for approval. Current statutes create paths, but no incentives to do so. The market may provide some monetary incentives, as treatment costs via the black market can be up to $10,000 for 12 weeks[22], but this is singularly held back by the decision to prioritize approval for human treatment, and the presumption that the approval process of an animal drug would negatively impact the approval process of a similar drug for humans.[23]

The black market is not a long-term solution for FIP treatment. Though the U.S. has yet to adjudicate the circulation of unlicensed FIP treatment, in July 2023, a woman in China was sentenced to 15 years in prison and fined with more than $5 million in damages for producing and selling fake, substandard products pursuant to China’s criminal law statutes.[24] Gilead also holds the exclusive patents on feline treatments. Facing unclear prospects for legitimate FIP treatment, subsequent statutory amendments need to create actual incentives to spur innovation in animal drugs, in addition to the creation of paths. The law should also create safeguards to promote transparency and fairness in the application review process in order to reduce bias against animal drugs.

Notes

[1] Feline Infectious Peritonitis, Cornell Feline Health Center, https://www.vet.cornell.edu/departments-centers-and-institutes/cornell-feline-health-center/health-information/feline-health-topics/feline-infectious-peritonitis (last visited Oct. 2, 2023).

[2] Id.

[3] B.G. Murphy et al., The Nucleoside Analog GS-441524 Strongly Inhibits Feline Infectious Peritonitis (FIP) Virus in Tissue Culture and Experimental Cat Infection Studies, 219 Veterinary Microbology 226, 226 (2018).

[4] Niels C Pedersen, Efficacy and Safety of the Nucleoside Analog GS-441524 for Treatment of cats with Naturally Occurring Feline Infectious Peritonitis, 21(4) J. of Feline Med. & Surgery 271, 271 (2019).

[5] Human Antiviral ‘GS-441524’ Shows Great Promise Against Infectious Disease in Cats, Science Daily (Feb. 13, 2019), https://www.sciencedaily.com/releases/2019/02/190213100442.htm.

[6] Sarah Zhang, A Much-Hyped COVID-19 Drug Is Almost Identical to a Black-Market Cat Cure, The Atlantic (May 8, 2020), https://www.theatlantic.com/science/archive/2020/05/remdesivir-cats/611341/.

[7] Id.

[8] Kai Kupferschmidt & Jon Cohen, WHO Launches Global Megatrial of the Four Most Promising Coronavirus Treatments, Science (Mar. 22, 2020), https://www.science.org/content/article/who-launches-global-megatrial-four-most-promising-coronavirus-treatments.

[9] E.g., Victoria C. Yan & Florian L. Muller, Advantages of the Parent Nucleoside GS-441524 over Remdesivir for Covid-19 Treatment, 11 ACS Med. Chemistry Letters 1361, 1361 (2020).

[10] See Sarah Zhang, A Much-Hyped COVID-19 Drug Is Almost Identical to a Black-Market Cat Cure, The Atlantic (May 8, 2020), https://www.theatlantic.com/science/archive/2020/05/remdesivir-cats/611341/; see also Sarah Jones et al., Unlicensed GS-441524-Like Antiviral Therapy Can Be Effective for at-Home Treatment of Feline Infectious Peritonitis, 11 Animals 2257, 2258 (2021).

[11] Sarah Jones et al., Unlicensed GS-441524-Like Antiviral Therapy Can Be Effective for at-Home Treatment of Feline Infectious Peritonitis, 11 Animals 2257, 2264–67 (2021).

[12] CHEM:(BRDWIEOJOWJCLU-LTGWCKQJSA-N), WIPO, https://patentscope.wipo.int/search/en/result.jsf?_vid=P22-LN8EIR-06824 (last visited Oct. 2, 2023).

[13] Id.

[14] See World Patent No. 169,946 (filed Mar. 13, 2018); see also U.S. Patent No. 0,296,584 (filed Mar. 13, 2018); see also U.S. Patent No. 0,376,014 (filed Apr. 17, 2020).

[15] See CHEM:(BRDWIEOJOWJCLU-LTGWCKQJSA-N), WIPO, https://patentscope.wipo.int/search/en/result.jsf?_vid=P22-LN8EIR-06824 (last visited Oct. 2, 2023).

[16] 21 U.S.C. § 360b.

[17] From an Idea to the Marketplace: The Journey of an Animal Drug through the Approval Process, FDA (Aug. 14, 2020), https://www.fda.gov/animal-veterinary/animal-health-literacy/idea-marketplace-journey-animal-drug-through-approval-process.

[18] Generic Animal Drug and Patent Term Restoration Act (GADPTRA), FDA (Apr. 24, 2023), https://www.fda.gov/animal-veterinary/guidance-regulations/generic-animal-drug-and-patent-term-restoration-act-gadptra.

[19] Conditional Approval Explained: A Resource for Veterinarians, FDA (Sept. 17, 2020), https://www.fda.gov/animal-veterinary/resources-you/conditional-approval-explained-resource-veterinarians.

[20] 21 U.S.C. § 360ccc (a)(1)(ii).

[21] Feline Infectious Peritonitis, Cornell Feline Health Center, https://www.vet.cornell.edu/departments-centers-and-institutes/cornell-feline-health-center/health-information/feline-health-topics/feline-infectious-peritonitis (last visited Oct. 2, 2023).

[22] Sarah Jones et al., Unlicensed GS-441524-Like Antiviral Therapy Can Be Effective for at-Home Treatment of Feline Infectious Peritonitis, 11 Animals 2257, 2264–67 (2021).

[23] Id.

[24] Wu Shubin (吴淑斌), Zhishou Maoyao Yishen Huoxing 15 Nian: Maoquan “Jiumingyao” de Yinmi Shengyi (制售猫药一审获刑15年:猫圈“救命药” 的隐秘生意) [Sentenced at Trial for 15 Years for Manufacturing and Selling Medicine for Cats: The Secret Business of Life-Saving Drugs in Cat-loving Communities], Sanlian Shenghuo Zhoukan (三联生活周刊) [Sanlian Lifeweek] (July 20, 2023), https://mp.weixin.qq.com/s/VKJO_AIVBy3Hm6GhWUOnWA.

Home | Contact Publishing Services | Report Web Accessibility Issues