Regulatory

What Happens to Your Genetic Data in a Sale or Acquisition?

November 4, 2024
Data, Data Privacy, New Technology, Privacy, Regulatory

Colin Loyd, MJLST Staffer

Remember 23andMe—the genetic testing company that once skyrocketed in publicity in the 2010s due to its relatively inexpensive access to genetic testing? It’s now heading toward disaster. This September, its board of directors saw all but one member tender their resignation.[1] At the close of that day’s trading, 23andMe’s share price was $0.35, representing a 99.9% decline in valuation from its peak in 2021.[2] This decline in valuation suggests the company may declare bankruptcy, which often leads to a sale of a company’s assets. Bankruptcy or the sale of assets present a host of complex privacy and regulatory issues, particularly concerning the sale of 23andMe’s most valuable asset—its vast collection of consumer DNA data.[3] This uncertain situation underscores serious concerns surrounding the state of comprehensive privacy protections for genetic information that leave consumers’ sensitive genetic data vulnerable to misuse and exploitation.

23andMe collects and stores massive amounts of user genetic information. However, unlike healthcare providers, 23andMe does not have to comply with the stringent privacy regulations set out in the Health Insurance Portability and Accountability Act (HIPAA).[4] While HIPAA is designed to protect sensitive health data, its protections apply only to a small subset of healthcare related entities.[5] HIPAA only regulates the use of genetic information by “group health plan[s], health insurance issuer[s] that issue[] health insurance coverage, or issuer[s] of a medicare supplemental policy.”[6] 23andMe does not fit into any of these categories and therefore operates outside the scope of HIPAA protections with respect to genetic information, leaving any genetic information it holds largely unregulated.

The Genetic Information Nondiscrimination Act (GINA), enacted in 2008, offers consumer protections by prohibiting discrimination based on an individual’s genetic information with respect to health insurance premium amounts or eligibility requirements for health insurance.[7] GINA also prohibits any deprivation of employment opportunities based on genetic information.[8] However, GINA’s protections do not extend to life insurance, disability insurance, or long-term care insurance.[9] This leaves a gap where genetic information may be used against individuals by entities not subject to GINA.

This regulatory gap is a major concern for consumers, especially with a potential bankruptcy sale looming. If 23andMe sells its assets, including its database of genetic information, the new owner would not have to adhere to the same privacy commitments made by 23andMe. For example, 23andMe promises not to use genetic information it receives for personalized or targeted marketing/advertising without a user’s express consent.[10] This policy likely reflects 23andMe’s efforts to comply with the California Privacy Rights Act (CPRA), which grants consumers the right to direct a business to not share or sell their personal information.[11] However, this right under the CPRA is an opt-out right—not an opt-in right—meaning consumers can stop a future sale of their information but by default there is no initial, regulatory limit on the sale of their personal information.[12] As a result, there’s nothing stopping 23andMe from altering its policies and changing how it uses genetic information. In fact, 23andMe’s Privacy Statement states it “may make changes to this Privacy Statement from time to time.”[13] Any such change would likely be binding if it is clearly communicated to users.[14] 23andMe currently lists email or an in-app notification as methods it may notify its users of any change to the Privacy Statement.[15] If it does so, it’s highly possible a court would view this as “clear communication” and there would be little legal recourse for users to prevent their genetic information from being used in ways they did not anticipate, such as for research or commercial purposes.

For example, say a life insurance company acquires an individual’s genetic data through the purchase of 23andMe’s assets. It could potentially use that data to make decisions about coverage or premiums, even though GINA prohibits health insurers to do the same.[16] This loophole highlights the dangers of having genetic information in the hands of entities not bound by strict privacy protections.

In the event of an acquisition or bankruptcy, 23andMe’s Privacy Statement outlines that personal information, including genetic data, may be among the assets sold or transferred to the new entity.[17] In such a case, the new owner could inherit both the data and the rights to use it under the existing terms, including the ability to modify how the data is used. This could result in uses not originally intended by the user so long as the change is communicated to the user.[18] This transfer clause highlights a key concern for users because it allows their deeply personal genetic data to be passed to another company without additional consent, potentially subjecting them to exploitation by organizations with different data usage policies or commercial interests. While 23andMe must notify users about any changes to the privacy statement or its use of genetic information, it does not specify whether the notice will be given in advance.[19] Any new entity could plan a change to the privacy statement terms–altering how it uses the genetic information while leaving users in the dark until the change is communicated to them, at which point the user’s information may have already been shared with third parties.

The potential 23andMe bankruptcy and sale of assets reveals deep flaws in the current regulatory system governing genetic data privacy. Without HIPAA protections, consumers risk their sensitive genetic information being sold or misused in ways they cannot control. GINA–while offering some protections–still leaves significant gaps, especially in life and disability insurance. As the demand for genetic testing continues to grow, the vulnerabilities exposed by 23andMe’s potential financial troubles highlight the urgent need for better privacy protections. Consumers must be made aware of the risks involved in sharing their genetic data, and regulatory measures must be strengthened to ensure this sensitive information is not misused or sold without their explicit consent.

 

Notes

[1] Independent Directors of 23andMe Resign from Board, 23andMe (Sept. 17, 2024) https://investors.23andme.com/news-releases/news-release-details/independent-directors-23andme-resign-board.

[2] Rolfe Winkler, 23andMe Board Resigns in New Blow to DNA-Testing Company, WALL ST. J. (Sept. 18, 2024) https://www.wsj.com/tech/biotech/23andme-board-resigns-in-new-blow-to-dna-testing-company-12f1a355.

[3] Anne Wojcicki (the last remaining board member) has consistently publicized her plan to take the company private, which is looming larger given the current state of the business financials. Id.

[4] See 42 U.S.C. § 1320d-9(a)(2).

[5] See generally 42 U.S.C. §1320d et seq.

[6] 42 U.S.C. § 1320d-9(a)(2).

[7] Genetic Information Nondiscrimination Act of 2008, Pub. L. No. 110-233, 122 Stat. 881.

[8] Id.

[9] Jessica D Tenenbaum & Kenneth W Goodman, Beyond the Genetic Information Nondiscrimination Act: Ethical and Economic Implications of the Exclusion of Disability, Long-term Care and Life Insurance, 14 Personalized Med. 153, 154 (2017).

[10] How We Use Your Information, 23andMe, https://www.23andme.com/legal/how-we-use-info/ (last visited Oct. 14, 2024).

[11] Cal. Civ. Code § 1798.120(a) (Deering 2024).

[12] Id.

[13] Privacy Statement, 23andMe (Sept. 24, 2024) https://www.23andme.com/legal/privacy/full-version/.

[14] See Lee v. Ticketmaster LLC, 817 Fed. App’x 393 (9th Cir. 2019)(upholding terms of use where notice was clearly given to the user, even if the user didn’t check a box to assent to the terms).

[15] Privacy Statement, supra note 13.

[16] See K.S.A. § 40-2259(c)-(d) (carving out the ability for life insurance policies to take into account genetic information when underwriting the policy).

[17] Privacy Statement, supra note 13.

[18] See Ticketmaster, 817 Fed. App’x 393 (2019).

[19] Privacy Statement, supra note 13.

Transforming Access: The FCC’s New Telecommunication Requirements May Enhance Accessibility in Criminal Detention Centers

October 29, 2024
Disability Law, FCC, Human Rights Law, Telecommunication

 

Peyton Soethout, MJLST Staffer

Continued technological advancements have made it easier for people to communicate with their loved ones worldwide. Criminal detention centers have utilized the rise of this digital age to make the inmate communication process easier for their staff.[1] Although these practices may simplify security and administrative protocols, they also negatively impact inmates’ abilities to effectively communicate with loved ones through traditional mail as oftentimes inmates “receive letters with missing pages and blurry images.”[2] These issues—combined with the COVID-19 pandemic increasing security measures, and the prevalence and popularity of telephones—have caused decreases in written communications between incarcerated and free people and subsequent increases in telecommunication.[3]

 

While traditional mail has become less reliable, criminal detention centers’ use of video and audio telecommunications is not without issue. Challenges with telecommunication technology are especially difficult for inmates who have communication disabilities, which include deafness, hard of hearing, blindness, low vision, deafblindness, speech disabilities, or other disabilities that affect communication.[4] Despite technology advancing outside detention facilities, many jails and prisons primarily rely on out-of-date devices for their telecommunication needs.[5] The reliance on out-of-date technology greatly impacts inmates with communication disabilities because they heavily rely on technology to communicate with others.[6]

Congress has attempted to mitigate these challenges through various legislation. Together, the Rehabilitation Act of 1973 and the American Disabilities Act (“ADA”) require prison and jail officers to “avoid discrimination; individually accommodate disability; and maximize integration of prisoners with disabilities with respect to programs, service, and activities.”[7] These statutes provided the first step in equal communication opportunities for all inmates, but they left two questions: (1) who decides which inmates receive communication accommodations; and (2) what specific technologies are required for this communication access.[8]

The Federal Communications Commission (“FCC”) made efforts to address prison telecommunication issues but their attempts were ultimately quashed in 2017 as courts found the FCC only had authority to address interstate calls, not intrastate calls.[9] In 2022, Congress passed the Martha Wright-Reed Just and Reasonable Communications Act (“Martha Wright-Reed Act”) which amended the Communications Act of 1934. It established “any Federal, State, or local law to require telephone service or advanced communications services at a State or local prison, jail, or detention facility.”[10] Because the FCC determined that the Martha Wright-Reed Act “significantly expanded the [FCC’s] jurisdiction over incarcerated people’s communications services,” it promulgated new accessibility requirements for inmate telecommunications.[11]

The new FCC rule requires detention centers to provide text telephones (“TTY”) and telecommunication relay services (“TRS”) to inmates with communication disabilities.[12] TTYs—defined as “machine[s] that [employ] graphic communication in the transmission of coded signals through a wire or radio communication system”—have long been used in jails as a device to assist incarcerated people with communication disabilities, but they have never been explicitly required on a federal level.[13]

Unlike TTYs, the use of TRSs is much more rare. The FCC defines TRSs as “[t]elephone transmission services that provide the ability […] to engage in communication by wire or radio […], in a manner that is functionally equivalent to the ability of a hearing individual who does not have a speech disability.”[14] The new FCC rule also gives examples of certain TRSs such as speech-to-speech relay services (“STS”), and video relay services (“VRS”).[15] Overall, these technologies can significantly decrease challenges presented by general telecommunication devices.[16]

While this rule does an adequate job of addressing what technologies are required for inmate telecommunication access, it does little to address the remaining question: who decides which inmates require telecommunication accommodations. The rule specifies that TTYs and TRSs are for incarcerated people who individually register for communication accommodations, and the rule places registration responsibility primarily on the inmates.[17] Given the historic trend of jail and prison administration, detention facilities’ staff will likely need to organize the registration process and inform inmates of its existence.[18] In the rule proposal, the FCC quotes formerly incarcerated person Kim Thomas who notes, “[i]ncarcerated people with disabilities that impact their ability to communicate continually experience barriers to access because prison administrators fail to understand their communication needs.”[19]

The FCC acknowledges that detention center administrators may lack the knowledge necessary to identify communication needs, and this will likely continue negatively impacting inmates with communication disabilities. Specifically, inmates with communication disabilities may be unaware of the technologies available to them. But even with potential challenges, the FCC’s promulgation of these new requirements is a significant step in the right direction for the future of telecommunication access for inmates with communication disabilities.

 

 

Notes

[1] Nazish Dholakia, The FCC Is Capping Outrageous Prison Phone Rates, but Companies Are Still Price Gouging, Vera (Sept. 4, 2024), https://www.vera.org/news/the-fcc-is-capping-outrageous-prison-phone-rates-but-companies-are-still-price-gouging#:~:text=The (“Corrections departments say they have adopted mail scanning to obtain greater control over materials entering their facilities and ensure safety.”).

[2] Id.

[3] Id.

[4] Tessa Bialek & Margo Schlanger, Effective Communication with Deaf, Hard of Hearing, Blind, and Low Vision Incarcerated People, 26 J. Gender Race & Just. 133, 138 (2023).

[5] Id. (referencing Heyer v. U.S. Bureau of Prisons, 849 F.3d 202 (4th Cir. 2017)).

[6] Id.

[7] Margo Schlanger, Prisoners with Disabilities, in Reforming Criminal Justice: Punishment, Incarceration, and Release 301 (E. Luna ed., 2017).

[8] See Farina Mendelson, A Silent Struggle: Constitutional Violations Against the Hearing Impaired in New York State Prisons, 20 CUNY L. Rev. 559, 564–571 (2017) (noting that the New York Department of Corrections had default responsibility to determine which inmates have disabilities as the ADA did not provide such information); Wanda Bertram, FCC Votes to Slash Prison and Jail Calling Rates and Ban Corporate Kickbacks, Prison Policy Initiative (July 18, 2024), https://www.prisonpolicy.org/blog/2024/07/18/fcc-vote/ (claiming that the July 2024 FCC regulations addressed required accessibility technologies for the first time).

[9] Jon Brodkin, Prison Phone Call Fees Are Out of Control. The FCC Can Finally Rein Them In, Wired (July 19, 2024, 8:30 AM), https://www.wired.com/story/prison-phone-call-fees-fcc-caps/.

[10] Martha Wright-Reed Just and Reasonable Communications Act of 2022, Pub. L. No. 117–338, 136 Stat 6156.

[11] Implementation of the Martha Wright-Reed Act; Rates for Interstate Inmate Calling Services, 89 FR 77244, 77244 [hereinafter FCC Notice and Comment]; Press Release, Fed. Commc’n Comm’n, FCC Caps Exorbitant Phone & Video Call Rates for Incarcerated Persons & Their Families: The Martha Wright-Reed Act Empowered the FCC to Close Gaps in the Long-Fought- For Protections Against Predatory Rates (July 18, 2024).

[12] 47 C.F.R. § 64.6040 (2024).

[13] 47 C.F.R. § 64.601(a)(44) (2024); Bialek & Schlanger, supra note 4 at 142. Note that Bialek & Schlanger use “TTY” to refer to teletypewriters which is one example of a TTY under the FCC’s rule. Oftentimes, teletypewriters and text telephones are used interchangeably. For the purposes of this blog post, TTY will be used as defined in 47 C.F.R. § 64.601.

[14] 47 C.F.R. § 64.601(a)(43) (2024).

[15] See 47 C.F.R. § 64.601(a)(41) (2024), which defines STS as a TRS “that allows individuals with speech disabilities to communicate with voice telephone users through the use of specially trained Communication Assistants who understand the speech patterns of persons with speech disabilities and can repeat the words spoken by that person;” and 47 C.F.R. § 64.601(a)(51) (2024), which defines VRS as “a TRS “that allows people with hearing or speech disabilities who use sign language to communicate with voice telephone users through video equipment.”

[16] See Fed. Commc’n Comm’n, Frequently Asked Questions on Telecommunications Relay Services (TRS), Fed. Commc’n Comm’n, (Mar. 1998), https://transition.fcc.gov/Bureaus/Common_Carrier/FAQ/faq_trs.html (explaining the benefits of TTY and TRS access).

[17] See e.g., 47 C.F.R. § 64.6040(c)(4) (2024) (requiring individual registration); 47 C.F.R. § 64.611 (2024) (explaining the registration process).

[18] See Mendelson, supra note 8, at 564 (“[T]he Department is responsible for identifying an inmate’s hearing impairment.”).

[19] FCC Notice and Comment, supra note 11, at 77248–77249 (emphasis added).

Persistent Yet Questionable: FTC’s Journey Regulating Negative Option Marketing in Online Subscription Services

October 17, 2024
Digital Marketing, Legal Ethics, Marketing, Regulatory

Su Young Lee, MJLST Staffer

Online subscription services are increasingly prevalent in society – prevalent enough to catch the attention of the Federal Trade Commission (FTC). On June 17, 2024, the FTC filed a lawsuit against Adobe Inc for the violation of the FTC Act Section 5 and Section 4 of the Restore Online Shoppers’ Confidence Act (ROSCA).[i] These two laws introduce a general legal framework governing online commerce and negative option marketing.[ii] The ROSCA Section 4 prohibits online sellers from conducting a transaction through “negative option feature” unless the seller “clearly and conspicuously discloses all material terms of the transaction” to the consumer.[iii] While the ROSCA is a distinctive law to the FTC Act, the violation of the ROSCA Section 4 is treated as an “unfair or deceptive acts or practices” so constitutes the violation of the FTC Act Section 5.[iv] Furthermore, as it is treated as an “unfair or deceptive acts or practices,”[v] the violation of the ROSCA Section 4 also triggers the FTC Act Section 19, which allows the FTC to “commence a civil action” against the one who violated subjected law.[vi]

In this case, the FTC argues that Adobe did not “clearly and conspicuously” disclose the early cancellation fee during the subscription process, which, therefore, “constitutes an unfair or deceptive act or practice in or affecting commerce.”[vii] Last year, the FTC filed a similar complaint against Amazon concerning the cancellation of Prime memberships; the case is still ongoing.[viii]

The FTC’s action against online subscription policies, specifically their marketing strategy called ‘negative option marketing,’ or ‘dark pattern,’[ix] are not new. Negative option marketing is “a term or condition under which the seller may interpret a consumer’s silence or failure to take affirmative action to reject a good or service or to cancel the agreement as acceptance or continuing acceptance of the offer.”[x] Examples include automatic renewals, continuity plans, free-to-pay or fee-to-pay conversions, and prenotification plans.[xi] The FTC reports negative option marketing to be a “persistent source of consumer harm” by “saddling shoppers with recurring payments for products and services they did not intend to purchase or did not want to continue to purchase.”[xii]

The FTC has pursued action against negative option marketing, especially its use in online subscription services, in recent years. As with Amazon and Adobe, using ROSCA and/or the FTC Act as a legal basis, the FTC has sued numerous online commercial companies with subscription services such as Wealthpress and MoviePass.[xiii] They also published a staff report and policy statement warning of the danger of negative option marketing.[xiv] On April 24, 2023, the FTC even exercised their rulemaking authority and proposed a rule amending 16 C.F.R. part 425 to specifically target the regulation of negative option marketing.[xv] While the proposed rule does not limit the type of applicable media,[xvi] the FTC added the definition of the terms that particularly apply to online subscription services, such as “simple cancellation” and “annual reminders.”[xvii]

Despite their persistence, the effectiveness of the FTC’s efforts is still in question. First, not everyone welcomes the proposed rule. Former Commissioner Christine S. Wilson states that the proposed rule’s scope of negative option marketing is overly broad because it applies to any misrepresentations, even to those irrelevant to negative option terms or policies.[xviii] She also points out that the proposed rule gives the FTC the authority to seek civil penalties under the FTC Act Section 5, which the Supreme Court limited in AMG Cap. Mgmt., LLC v. Fed. Trade Comm’n.[xix] Commissioner Wilson expresses concern that such overreach would put marketers at risk of being liable for monetary penalties even when they fully disclose negative option terms.[xx]

Luckily for those not fond of the proposed rule, the FTC has not yet prevailed in putting the regulation into effect. Even if it becomes effective one day, this new rule will have to survive the unclarified yet heightened standard the recent overruling of Chevron created. The Section 6(a) of the FTC Act, governing the agency’s rulemaking authority, grants the FTC to make a rule that addresses “unfair or deceptive acts or practices.”[xxi] The proposed rule manifests its relation to such authority, as many of its provisions trigger the violation of the FTC Act Section 5, which states that “unfair or deceptive acts or practices” are unlawful.[xxii] On the other hand, no one is sure at this moment whether such manifestations are the sufficient address of ‘unfair or deceptive acts or practices’ under the new rulemaking standard.

No matter where the proposed rule currently lies, as the ongoing lawsuits against Adobe and Amazon reflect, it seems like the FTC has not given up on regulating negative option marketing within online subscription services. If the current proposed rule does not end up being effective and fails to become the FTC’s resolution, could lawsuits be their alternate pathway? Based on their past lawsuits against Wealthpress and MoviePass, which ended with the agreement in the proposed court order (“Agreement”) and settlement, it may be reasonable to anticipate that the ongoing cases will reach a similar outcome.[xxiii] The settlement and Agreement, which involved specific restriction and monetary agreement,[xxiv] from Wealthpress and MoviePass cases focused on refraining from the alleged type of conduct of an alleged company. These could discourage alleged tech companies like Wealthpress and MoviePass from using the alleged type of negative option marketing in their future subscription policies. However, since neither settlement nor Agreement has precedential authority, it is questionable whether the history of lawsuits filled with settlements and Agreement could prevent other tech companies from applying similar negative option marketing to their subscription policies.

 

Notes

[i] Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief at 25, United States v. Adobe Inc., No. 5:24-cv-03630-BLF (N.D. Cal. June 17, 2024).

[ii] Id. at ¶ 10.

[iii] 15 U.S.C. § 8403.

[iv] 15 U.S.C. 45(a)(1) (“Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.”) (emphasis added). See also Complaint for Permanent Injunction, supra note i, at ¶ 22.

[v] 15 U.S.C. § 8404(a).

[vi]  15 U.S.C. § 57(b)(1) (“If any person, partnership, or corporation violates any rule under this subchapter respecting unfair or deceptive acts or practices…then the Commission may commence a civil action against such person.”) (emphasis added).

[vii] Complaint for Permanent Injunction, supra note i, at ¶ 121-25.

[viii] See Fed. Trade Comm’n v. Amazon.com, Inc., No. 2:23-CV-00932-JHC, 2024 WL 2723812 at 1 (W.D. Wash. May 28, 2024) (showing that the FTC is using the same legal basis).

[ix] FTC uses two terms (negative option marketing and dark pattern) interchangebly. See FED. TRADE COMM’N, Bringing Dark Patterns to Light : Staff Report (2022).

[x] FED. TRADE COMM’N, ENFORCEMENT POLICY STATEMENT REGARDING NEGATIVE OPTION MARKETING 60822 (2021).

[xi] Id.

[xii] Id. at 60823.

[xiii] See FTC Suit Requires Investment Advice Company WealthPress to Pay $1.7 Million for Deceiving Consumers, Fed. Trade Comm’n (Jan. 13, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/01/ftc-suit-requires-investment-advice-company-wealthpress-pay-17-million-deceiving-consumers and Operators of MoviePass Subscription Service Agree to Settle FTC Allegations that They Limited Usage, Failed to Secure User Data Fed. Trade Comm’n (June. 7, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/06/operators-moviepass-subscription-service-agree-settle-ftc-allegations-they-limited-usage-failed.

[xiv] See FED. TRADE COMM’N, Bringing Dark Patterns to Light, supra note ix and FED. TRADE COMM’N, ENFORCEMENT POLICY STATEMENT, supra note x.

[xv] Negative Option Rule, 88 FR 24716 (proposed April 24, 2023) (to be codified at 16 C.F.R. pt. 425)

[xvi] Id. at 24734 (“This Rule contains requirements related to any form of negative option plan in any media, including, but not limited to, the internet, telephone, inprint, and in-person transactions.”).

[xvii] Id.

[xviii] Christine S. Wilson, Dissenting Statement of Commissioner Christine S. Wilson, Notice of Proposed Rulemaking, Negative Option Rule 2 (Sept. 2021), https://www.ftc.gov/system/files/ftc_gov/pdf/p064202_commissioner_wilson_dissent_negative_option_rule_finalrevd_0.pdf.

[xix] Id. See also AMG Cap. Mgmt., LLC v. Fed. Trade Comm’n, 593 U.S. 67, 141 S. Ct. 1341, 209 L. Ed. 2d 361 (2021) (finding that the FTC cannot seek monetary relief based on the FTC § 13(b), which triggers permanent injunction when the § 5 is found to be violated)

[xx] Christine S. Wilson, Dissenting Statement, supra note xviii, at 2.

[xxi] 15 U.S.C. § 46(g). See also A Brief Overview of the Federal Trade Commission’s Investigative, Law Enforcement, and Rulemaking Authority, Fed. Trade Comm’n (May, 2021), https://www.ftc.gov/about-ftc/mission/enforcement-authority.

[xxii] 15 U.S.C. 45(a)(1). E.g. Negative Option Rule, 88 FR at 24735 (“In connection with promoting or offering for sale any good or service with a negative option feature, it is a violation of this Rule and an unfair or deceptive act or practice in violation of Section 5 of the FTC Act.”).

[xxiii] supra note xiii.

[xxiv] Id.

The New Reefer Madness? New Laws Look to Regulate Hemp Products

October 11, 2024
Drug Policy, Food and Drug Law, Regulatory

Violet Butler, MJLST Staffer

In 2018, the federal government took a major step in shifting its policy towards the criminalization of marijuana. Included in the 2018 Farm Bill was a provision that legalized some hemp-derivative products, in particular CBD products with a low-level of THC.[1] While this was touted by the industry and activists as a major step forward, the move to increase regulations on these hemp products have recently gained steam.

But what exactly was legalized by the federal government? The 2018 Farm Bill legalized hemp and hemp derived products (including CBD) that contain no more than 0.3% THC.[2] It should be noted that most cannabis products are consumed for some form of intoxication[3] and, suffice it to say, intoxication does not arise from 0.3% THC. The 2018 Farm Bill legalized a very small subsection of cannabis products serving a limited range of uses. Under the law, if a product contains more than 0.3% THC it is legally classified as marijuana and is still illegal under the Controlled Substances Act. So, if these new products cannot be used as intoxicants, why is there a push for more regulations?

A reason for the push for further regulations gaining traction is the concern over synthetically produced cannabinoids. A report from the National Academy of Sciences, Engineering, and Medicine recently published a report urging the federal government to redefine what “hemp” means. This is in an effort to ban semi-synthetic cannabinoids derived from legal hemp products as these cannabinoids can mirror the intoxicating effects of marijuana.[4] By clamping down on these semi-synthetic products, the legal line between hemp, CBD, and marijuana can be more properly maintained.

Different states are taking different approaches to the new regulations on hemp products. One camp of lawmakers want to go back to the old regime where any miniscule trace of THC was illegal. This “total ban” approach is presently seen in new legislation passed in Arkansas. Arkansas’ Act 629 bans the “production and sale of products containing Delta 8, Delta 9 and Delta 10 and other THC isomers inside the state of Arkansas” in any capacity.[5] Currently on appeal in the Eighth Circuit, the act has been subject to a lawsuit from hemp companies claiming the state law is preempted by the 2018 Farm Bill.[6] Arkansas is not the only state to take a total ban approach. Missouri’s governor Mike Parsons recently signed an executive order banning all consumables containing “psychoactive cannabis products”—or hemp products containing even trace amounts of THC—outside of the state’s already regulated cannabis market.[7] While this is not as broad in scope as Arkansas’ ban, the wide-reaching ban restricts the sale of most non-marijuana cannabis products in the state.

However, some states have taken a different approach to regulating hemp products, particularly in its distribution. New Jersey recently banned any amount of THC from being sold to a person under the age of 21.[8] California governor Gavin Newsom took a similar approach, signing an emergency ban on all hemp products containing THC and restricting the sale of all other hemp products to the 21+ market.[9] Even the federal government might be looking to increase the regulations on hemp products. Senator Ron Wyden recently introduced a bill that would raise the age at which someone could buy hemp products to 21 and set more federal safety standards on the industry.[10]

So, why is there a push to change the laws around hemp now? It could come down to perceived health risks and a rise in hospitalizations. A study from the Nationwide Children’s Hospital found that there were over 3,000 calls to poison controls related to THC, including the those found in small doses of legal hemp products.[11] Although only about 16% of these calls resulted in hospitalizations, roughly half of admissions were for children under 6-years-old.[12] California Governor Newsom directly cited hospitalizations as one the principal reasons he signed his emergency order.[13]

People seem to be worried about the hemp products currently on the market, including CBD, but should they be? The jury is still out on the health effects of CBD. A report from the World Health Organization in 2018 said that CBD had a “good safety profile” and reported no evidence of detrimental effects from recreational consumption of pure CBD.[14] However, the AAMC notes that CBD is understudied and there could be adverse interactions if CBD is taken with other medications.[15]

Legislators and policy-makers need to be able to ensure the safety and well-being of their citizens without creating unnecessary barriers for a new and growing industry. One of the barriers that states are facing is— maybe ironically—the 2018 Farm Bill. The bill opened the door for hemp products that met the THC standards, and these state laws are running into friction with the federal law. While states are allowed (and expected) to regulate the hemp industry under the 2018 Farm Bill, the move by many states to put heavier restrictions on the amount of THC allowed in hemp products seems to be in conflict with federal law. The lawsuits from hemp producers so far have all revolved around the idea that these state regulations, which are more restrictive than the 2018 Farm Bill, are preempted by the federal legislation.[16] Under Article VI of the Constitution, federal laws are the “supreme law of the land” so the Farm Bill must preempt state law in some way, but the exact way it does so is unclear.[17] There are two different ideas on how the Farm Bill preempts state law. The first idea is that the hemp regulations laid out in the federal law are the most stringent that states can regulate. This is the interpretation that hemp producers prefer, and the theory that they are suing under. The second idea, the option preferred by states that are looking to increase regulations, is that the Farm Bill set the outer limit for regulations. In other words, states are free to increase the regulations on the industry, but the federal law provides a national baseline if states do not come up with their own regulation.

Court rulings on this issue may settle the debate, but there is always a risk of a circuit split forming as different Courts of Appeal hear and decide on different lawsuits. To clear confusion once and for all, the federal government could clarify the scope of regulatory power with new legislation, or the Supreme Court could decide the issue in its upcoming term. But, until then, the legal challenges are likely to keep mounting and leave the nascent hemp industry in lingo.

 

Notes

[1] Dennis Romero, Hemp Industry Expected to Blossom Under New Farm Bill, NBC News (Dec. 17, 2018, 4:02 PM), https://www.nbcnews.com/news/us-news/hemp-industry-expected-blossom-under-new-farm-bill-n947791. For clarification, CBD stands for cannabidiol, a product derived from hemp, often sold in gummy or oil form. THC stands for tetrahydrocannabinol, the psychoactive part of the marijuana plant that can get you high. THC often refers to what is known as delta-9 THC, a type of THC found in the marijuana plant.

[2] John Hudak, The Farm Bill, Hemp Legalization and the Status of CBD: An Explainer, Brookings Institution (Dec. 14, 2018), https://www.brookings.edu/articles/the-farm-bill-hemp-and-cbd-explainer/

[3] As the Brookings Institution points out, the extremely low levels of THC in now-legal hemp products means that these products cannot be used to get high.

[4] Sam Reisman, New Report Urges Feds to Take Larger Role in Pot Policy, Law360 (Sept. 26, 2024, 8:53 PM), https://plus.lexis.com/newsstand/law360/article/1883058/?crid=c6fd0d9a-971e-489f-a5c6-8c1725ffee87

[5] Dale Ellis, Federal Judge Blocks State’s New Law Banning Delta-8 THC Products, Arkansas Democrat Gazette (Sept. 7, 2023, 6:00 PM), https://www.arkansasonline.com/news/2023/sep/07/federal-judge-blocks-states-new-law-banning-delta-8-thc-products/

[6] Sam Reisman, Court Defers Ruling On Challenge To Arkansas Hemp Law, Law360 (Sept. 25, 2024, 6:50 PM), https://plus.lexis.com/newsstand/law360/article/1882683/?crid=48cd5145-0817-47a7-bf22-1fb3bf01cb5f

[7] Jonathan Capriel, Missouri Ban on Some Psychoactive Foods to Hit Sept. 1 (August 30, 2024, 8:47 PM), https://plus.lexis.com/newsstand/law360/article/1882683/?crid=48cd5145-0817-47a7-bf22-1fb3bf01cb5f;  Rebecca Rivas, Missouri Hemp Leaders File Suit to Halt Governor’s Ban on Hemp THC Products, Missouri Independent (August 30, 2024 5:55 AM), https://missouriindependent.com/2024/08/30/missouri-hemp-leaders-set-to-file-suit-to-halt-governors-ban-on-hemp-thc-products/

[8] Sophie Nieto-Munoz, Gov. Murphy Signs Controversial Bill Restricting Sales of Hemp Products, New Jersey Monitor (Sept. 13, 2024, 7:11 AM), https://newjerseymonitor.com/2024/09/13/gov-murphy-signs-controversial-bill-restricting-sales-of-hemp-products/

[9] Rae Ann Varona, Calif. Gov.’s Emergency Hemp Intoxicant Ban Wins Approval, Law360 (Sept. 24, 2024, 9:49 PM),  https://plus.lexis.com/newsstand/law360/article/1882121/?crid=642ddd2e-a29d-46d6-8ff4-b7f209fd6c7f&cbc=0,0

[10] Same Reisman, Wyden Pitches New Bill To Regulate Intoxicating Hemp, Law360 (Sept. 25, 2024, 7:06 PM), https://plus.lexis.com/newsstand/law360/article/1882226/?crid=ed53b57f-dd97-4a6a-8a89-f6028f95e523

[11] Nationwide Children’s, New Study Finds Increase in Exposures to Synthetic Tetrahydrocannabinols Among Young Children, Teens, and Adults, Nationwide Children’s Hospital (May 7, 2024), https://www.nationwidechildrens.org/newsroom/news-releases/2024/05/deltathc_clinicaltoxicology

[12] Id.

[13] Varona, supra note 9.

[14] World Health Organization, Cannabidiol (CBD) Critical Review Report 5 (2018).

[15] Stacy Weiner, CBD: Does It Work? Is It Safe? Is It Legal?, AAMC News (July 20, 2023), https://www.aamc.org/news/cbd-does-it-work-it-safe-it-legal

[16] Reisman, supra note 6; Varona, supra note 9.

[17] U.S. Const. art. VI, cl. 2

NEPA and Climate Change: Are Environmental Protections Hindering Renewable Energy Development?

October 9, 2024
Climate Change, Energy Law, Environmental Law, Regulatory

Samuel Taylor, MJLST Staffer

The National Environmental Protection Act, or “NEPA”, has been essential in protecting America’s air and water, managing health hazards, and preserving environmental integrity. For decades, environmental activist groups, the government, and regular citizens relied on and benefitted from enforcing these NEPA against those looking to pollute, poison, or endanger Americans and their environment. NEPA, however, is proving to be less suitable for addressing the country’s  imminent environmental challenge: climate change. As proponents of green energy scramble to ditch fossil fuels, NEPA and its procedural requirements are accused of delaying or halting renewable energy projects. Environmental protection laws remain essential to stopping the dangers they were passed to stop, and many new green energy projects pose additional risks to the environment, but we also need to transition away from fossil fuels as fast as possible to avoid the worst consequences of climate change. The conflict between the need to address climate change and the need to maintain environmental protections has created a regulatory challenge that may not have a perfect solution.

Enacted in 1970, NEPA was the first major environmental protection measure taken in the US.[i] The “magna carta” of environmental laws applies to all “major federal actions significantly affecting the environment”.[ii] Major federal actions can include everything from infrastructure projects like proposed dams, bridges, highways, and pipelines, to housing developments, research projects, and wildlife management plans.[iii] Before a federal agency can act, there are a series of procedures they must follow which force them to consider the environmental impacts of the potential action. These procedures involve community outreach, the effects of past and future actions in the region, and providing the public with a detailed explanation of the agency’s findings, and often take years to fully complete.[iv] By requiring the government to follow these procedures “to the fullest extent possible,” NEPA aims to ensure that environmental concerns are given sufficient consideration before any harmful actions are taken.[v] Notably, NEPA is not a results-oriented statute, but a process-oriented one.[vi] No agency decision can be made until after its procedures are followed, but once they are, NEPA does not mandate a particular decision.[vii] NEPA does not even require that environmental concerns be given more weight than any other factors.[viii] Nevertheless, if an agency fails to properly follow NEPA procedures, all resulting decisions can be invalidated if challenged in the courts.[ix]

Though passing NEPA was the first step Congress took towards addressing environmental concerns, and decades of NEPA success stories have followed, there is growing concern about its  ability to adapt to the pressing challenges presented by global climate change.[x] NEPA, critics say, drastically slows the government’s ability to invest in green energy because each step of the procedure can be challenged in court.[xi] Corporate competitors in the renewable energy sector, environmental interest groups, concerned citizen groups, and Native American tribes have all challenged various projects’ compliance with NEPA requirements.[xii] Many of these groups have legitimate concerns about the projects, and NEPA allows them to stall or halt development while the government is forced to further consider their potential environmental impacts. This causes direct conflict between these valid concerns and efforts to reverse the country’s reliance on fossil fuels.[xiii] Collectively, the long procedures and potential legal challenges that accompany NEPA’s requirements present serious hurdles to the production of green energy.

Legal experts disagree, perhaps not surprisingly, over the extent to which NEPA hinders the production of green energy sources. Some groups believe the rhetoric surrounding NEPA’s deficiencies is an exaggeration, citing data that shows only a very small percentage of green energy projects actually require the production of EISs.[xiv] Others present NEPA and other environmental protection laws as serious hurdles preventing the production of renewable energy at the pace we need to avoid the worst effects of climate change.[xv] They argue that this data is not properly representative of all clean energy projects, ignores the delays caused by litigation, and does not properly account for the likelihood that delays will get worse in the future.[xvi] Because there is little consensus regarding the extent of the problem, there is likewise almost no agreement on a potential solution.

 Lawmakers and legal scholars have proposed a range of approaches to the NEPA problem. Most drastically, a bill introduced to the U.S. House Committee on Natural Resources by Representative Bruce Westerman would largely eradicate most NEPA provisions by limiting consideration of new scientific evidence, allowing some projects to go exempt from NEPA’s requirements, and drastically limiting community instigated judicial review.[xvii] Other proposals are more modest, including permitting reform to favor green energy projects, placing some limits on judicial review, and collecting more comprehensive data on NEPA issues.[xviii] Still others are staunchly against most reforms, arguing that weakening any NEPA provisions would open the door for greater environmental abuses.[xix] The differing opinions on the scope of the problem and the wide range of proposed solutions amount to a problem that will not be easy to solve.

The legal community is divided on the efficacy of existing NEPA regulations that have, for decades, promoted environmental protection. In the face of climate change and the accompanying need for renewable energy, it must be determined whether NEPA is truly hindering the switch to green energy. The United States must build more renewable energy infrastructure if we are to avoid the worst consequences of global climate change, but with concern growing that our own environmental protection laws are hindering progress, it will be challenging to move forward in a manner that balances the need for green energy production against the necessity of strong environmental protection laws.

 

Notes

[i] Sam Kalen, NEPA’s Trajectory: Our Waning Environmental Charter From Nixon to Trump, 50 Environmental Law Reporter 10398, 10398 (2020).

[ii] Id.; Mark A. Chertok, Overview of the National Environmental Policy Act: Environmental Impact Assessments and Alternatives (2021); 42 U.S.C. §§ 4321–70.

[iii] Elly Pepper, Never Eliminate Public Advice: NEPA Success Stories, Natural Resources Defense Council (Feb. 1, 2015), https://www.nrdc.org/resources/never-eliminate-public-advice-nepa-success-stories#:~:text=The%20NEPA%20process%20has%20saved,participated%20in%20important%20federal%20decisions.

[iv] Chertok, supra note ii; 42 U.S.C. §§ 4321–70.

[v] Chertok, supra note ii; Catron County v. U.S.F.W.S., 75 F.3d 1429, 1437 (10th Cir. 1996).

[vi] Chertok, supra note ii; Catron County at 1434.

[vii] Chertok, supra note ii.

[viii] Balt. Gas & Elec. Co. v. Nat. Res. Def. Council, Inc., 462 U.S. 87, 97 (1983).

[ix] Chertok, supra note ii (citing Lands Council v. Powell, 395 F.3d 1019, 1027 (9th Cir. 2005)).

[x] Pepper, supra note iii; Aidan Mackenzie & Santi Ruiz, No, NEPA Really Is a Problem for Clean Energy, Institute For Progress (Aug. 17, 2023), https://ifp.org/no-nepa-really-is-a-problem-for-clean-energy/#nepa-will-harm-clean-energy-projects-even-more-in-the-future; Darian Woods & Adrian Ma, Environmental Laws Can Be an Obstancel in Building Green Energy Infrastructure, NPR (Apr. 13, 2022), https://www.npr.org/2022/04/13/1092686675/environmental-laws-can-be-an-obstacle-in-building-green-energy-infrastructure.

[xi] Mackenzie & Ruiz, supra note x; See, e.g. Ocean Advocates v. U.S. Army Corps of Engineers, 402 F.3d 846 (9th Cir. 2005) (where the agency finding of no significant impact was challenged by an environmental protection group); Sierra Club v. Bosworth, 510 F.3d 1016 (9th Cir. 2007) (where the agency’s EIS analysis was challenged by the Sierra Club).

[xii] Niina H. Farah, Tribes Sue Over NEPA Review for Oregon Offshore Wind Auction, Politico (Sep. 18, 2024), https://www.eenews.net/articles/tribes-sue-over-nepa-review-for-oregon-offshore-wind-auction/; Christine Billy, Update: Congestion Pricing: A Case Study on Interstate Air Pollution Disputes, New York State Bar Association (Sep. 23, 2024), https://nysba.org/update-congestion-pricing-a-case-study-on-interstate-air-pollution-disputes/; Jonathan D. Brightbill & Madalyn Brown Feiger, Environmental Challenges Seek to Block Renewable Projects, Winston & Strawn LLP (Sep. 1, 2021), https://www.winston.com/en/blogs-and-podcasts/winston-and-the-legal-environment/environmental-challenges-seek-to-block-renewable-projects.

[xiii] Farah, supra note xii; Brightbill & Feiger, supra note xiv.

[xiv] Ann Alexander, Renewable Energy and Environmental Protection Is Not an Either/Or, Natural Resources Defense Council (Jan. 18, 2024), https://www.nrdc.org/bio/ann-alexander/renewable-energy-and-environmental-protection-not-eitheror.

[xv] Mackenzie & Ruiz, supra note x.

[xvi] Alexander, supra note xiv; Mackenzie & Ruiz, supra note x.

[xvii] Defenders of Wildlife, Defenders Slams Bill Aiming to Rollback NEPA and Gut Environmental Protections, (Sep. 10, 2024), https://defenders.org/newsroom/defenders-slams-bill-aiming-rollback-nepa-and-gut-environmental-protections.

[xviii] Brian Potter, Arnab Datta & Alec Stapp, How to Stop Environmental Review from harming the Environment, Institute For Progress (Sep. 13, 2022), https://ifp.org/environmental-review/.

[xix] Alexander, supra note xiv; Sierra Club

 

 

 

 

Moderating Social Media Content: A Comparative Analysis of European Union and United States Policy

September 24, 2024
EU Law, Internet, Regulatory, Social Media

Jaxon Hill, MJLST Staffer

In the wake of the Capitol Hill uprising, former president Donald Trump had several of his social media accounts suspended.1 Twitter explained that their decision to suspend Trump’s account was “due to the risk of further incitement of violence.”2 Though this decision caught a lot of attention in the public eye, Trump was not the first figure in the political sphere to have his account suspended.3 In response to the social media platforms alleged censorship, some states, mainly Florida and Texas, attempted to pass anti-censorship laws which limit the ability for social media companies to moderate content.4 

Now, as litigation ensues for Trump and social media companies fighting the Texas and Florida legislation, the age-old question rears its ugly head: what is free speech?5 Do social media companies have a right to limit free speech? Social media companies are not bound by the First Amendment.6 Thus, barring valid legislation that says otherwise, they are allowed to restrict or moderate content on their platforms. But should they, and, if so, how? How does the answer to these questions differ for public officials on social media? To analyze these considerations, it is worthwhile to look beyond the borders of the United States. This analysis is not meant to presuppose that there is any wrongful conduct on the part of social media companies. Rather, this serves as an opportunity to examine an alternative option to social media content moderation that could provide more clarity to all interested parties. 

  In the European Union, social media companies are required to provide clear and specific information whenever they restrict the content on their platform.7 These statements are called “Statements of Reasons” (“SoRs”) and they must include some reference to whatever law the post violated.8 All SoRs  are  made publicly available to ensure transparency between the users and the organization.9 

An analysis of these SoRs yielded mixed results as to their efficacy but it opened up the door for potential improvements.10 Ultimately, the analysis showed inconsistencies among the various platforms in how or why they moderate content, but those inconsistencies can potentially open up an ability for legislators to clarify social media guidelines.11 

Applying this same principle domestically could allow for greater transparency between consumers, social media companies, and the government. By providing publicly available rationale behind any moderation, social media companies could continue to remove illegal content while not straddling the line of censorship. It is worth noting that there are likely negative financial implications for this policy, though. With states potentially implementing vastly different policies, social media companies may have to increase costs to ensure they are in compliance wherever they operate.12 Nevertheless, absorbing these costs up front may be preferable to “censorship” or “extremism, hatred, [or] misinformation and disinformation.”13 

In terms of the specific application to government officials, it may seem this alternative fails to offer any clarity to the current state of affairs. This assertion may have some merit as government officials have still been able to post harmful social media content in the EU without it being moderated.14 With that being said, politicians engaging with social media is a newer development—domestically and internationally—so more research needs to be conducted to conclude best practices. Regardless, increasing transparency should bar social media companies from making moderation choices unfounded in the law.

 

Notes

1 Bobby Allyn & Tamara Keith, Twitter Permanently Suspends Trump, Citing ‘Risk Of Further Incitement Of Violence’, Npr (Jan. 8, 2021), https://www.npr.org/2021/01/08/954760928/twitter-bans-president-trump-citing-risk-of-further-incitement-of-violence.

2 Id.

3 See Christian Shaffer, Deplatforming Censorship: How Texas Constitutionally Barred Social Media Platform Censorship, 55 Tex. Tech L. Rev. 893, 903-04 (2023) (giving an example of both conservative and liberal users that had their accounts suspended).

4 See Daveed Gartenstein-Ross et al., Anti-Censorship Legislation: A Flawed Attempt to Address a Legitimate Problem, Lawfare (July 27, 2022), https://www.lawfaremedia.org/article/anti-censorship-legislation-flawed-attempt-address-legitimate-problem (explaining the Texas and Florida legislation in-depth).

5 See e.g. Trump v. United States, 219 L.E.2d 991, 1034 (2024) (remanding the case to the lower courts); Moody v. NetChoice, LLC, 219 L.E.2d. 1075, 1104 (2024) (remanding the case to the lower courts).

6 Evelyn Mary Aswad, Taking Exception to Assessments of American Exceptionalism: Why the United States Isn’t Such an Outlier on Free Speech, 126 Dick. L. R. 69, 72 (2021).

7 Chiara Drolsbach & Nicolas Pröllochs, Content Moderation on Social Media in the EU: Insights From the DSA Transparency Database (2023), https://arxiv.org/html/2312.04431v1/#bib.bib56.

8  Id.

9 Id.

10 Id. This analysis showed that (1) content moderation varies across platforms in number, (2) content moderation is most often applied to videos and text, whereas images are moderated much less, (3) most rule-breaking content is decided via automated means (except X), (4) there is much variation among how often the platforms choose to moderate illegal content, and (5) the primary reasons for moderation include falling out of the scope of the platform’s services, illegal or harmful speech, and sexualized content. Misinformation was very rarely cited as the reason for moderation.

11 Id.

12 Perkins Coie LLP, More State Content Moderation Laws Coming to Social Media Platforms (November 17, 2022), https://perkinscoie.com/insights/update/more-state-content-moderation-laws-coming-social-media-platforms (recommending social media companies to hire counsel to ensure they are complying with various state laws). 

13 See e.g. Shaffer, supra note 3 (detailing the harms of censorship); Gartenstein-Ross, supra note 4 (outlining the potential harms of restrictive content moderation).

14 Goujard et al., Europe’s Far Right Uses TikTok to Win Youth Vote, Politico (Mar. 17, 2024), https://www.politico.eu/article/tiktok-far-right-european-parliament-politics-europe/ (“Without evidence, [Polish far-right politician, Patryk Jaki] insinuated the person who carried out the attack was a migrant”).

 

The Stifling Potential of Biden’s Executive Order on AI

April 1, 2024
Administrative Law, Agencies, Artificial Intelligence, Regulatory

Christhy Le, MJLST Staffer

Biden’s Executive Order on “Safe, Secure, and Trustworthy” AI

On October 30, 2023, President Biden issued a landmark Executive Order to address concerns about the burgeoning and rapidly evolving technology of AI. The Biden administration states that the order’s goal is to ensure that America leads the way in seizing the promising potential of AI while managing the risks of AI’s potential misuse.[1] The Executive Order establishes (1) new standards for AI development, and security; (2) increased protections for Americans’ data and privacy; and (3) a plan to develop authentication methods to detect AI-generated content.[2] Notably, Biden’s Executive Order also highlights the need to develop AI in a way that ensures it advances equity and civil rights, fights against algorithmic discrimination, and creates efficiencies and equity in the distribution of governmental resources.[3]

While the Biden administration’s Executive Order has been lauded as the most comprehensive step taken by a President to safeguard against threats posed by AI, its true impact is yet to be seen. The impact of the Executive Order will depend on its implementation by the agencies that have been tasked with taking action. The regulatory heads tasked with implementing Biden’s Executive Order are the Secretary of Commerce, Secretary of Energy, Secretary of Homeland Security, and the National Institute of Standards and Technology.[4] Below is a summary of the key calls-to-action from Biden’s Executive Order:

  • Industry Standards for AI Development: The National Institute of Science and Tech (NIST), Secretary of Commerce, Secretary of Energy, Secretary of Homeland Secretary, and other heads of agencies selected by the Secretary of Commerce will define industry standards and best practices for the development and deployment of safe and secure AI systems.
  • Red-Team Testing and Reporting Requirements: Companies developing or demonstrating an intent to develop potential dual-use foundational models will be required to provide the Federal Government, on an ongoing basis, with information, reports, and records on the training and development of such models. Companies will also be responsible for sharing the results of any AI red-team testing conducted by the NIST.
  • Cybersecurity and Data Privacy: The Department of Homeland Security shall provide an assessment of potential risks related to the use of AI in critical infrastructure sectors and issue a public report on best practices to manage AI-specific cybersecurity risks. The Director of the National Science Foundation shall fund the creation of a research network to advance privacy research and the development of Privacy Enhancing Technologies (PETs).
  • Synthetic Content Detection and Authentication: The Secretary of Commerce and heads of other relevant agencies will provide a report outlining existing methods and the potential development of further standards/techniques to authenticate content, track its provenance, detect synthetic content, and label synthetic content.
  • Maintaining Competition and Innovation: The government will invest in AI research by creating at least four new National AI Research Institutes and launch a pilot distributing computational, data, model, and training resources to support AI-related research and development. The Secretary of Veterans Affairs will also be tasked with hosting nationwide AI Tech Sprint competitions. Additionally, the FTC will be charged with using its authorities to ensure fair competition in the AI and semiconductor industry.
  • Protecting Civil Rights and Equity with AI: The Secretary of Labor will publish a report on effects of AI on the labor market and employees’ well-being. The Attorney General shall implement and enforce existing federal laws to address civil rights and civil liberties violations and discrimination related to AI. The Secretary of Health and Human Services shall publish a plan to utilize automated or algorithmic systems in administering public benefits and services and ensure equitable distribution of government resources.[5]

Potential for Big Tech’s Outsized Influence on Government Action Against AI

Leading up to the issuance of this Executive Order, the Biden administration met repeatedly and exclusively with leaders of big tech companies. In May 2023, President Biden and Vice President Kamala Harris met with the CEOs of leading AI companies–Google, Anthropic, Microsoft, and OpenAI.[6] In July 2023, the Biden administration celebrated their achievement of getting seven AI companies (Amazon, Anthropic, Google, Inflection, Meta, Microsoft, and Open AI) to make voluntary commitments to work towards developing AI technology in a safe, secure, and transparent manner.[7] Voluntary commitments generally require tech companies to publish public reports on their developed models, submit to third-party testing of their systems, prioritize research on societal risks posed by AI systems, and invest in cybersecurity.[8] Many industry leaders criticized these voluntary commitments for being vague and “more symbolic than substantive.”[9] Industry leaders also noted the lack of enforcement mechanisms to ensure companies follow through on these commitments.[10] Notably, the White House has only allowed leaders of large tech companies to weigh in on requirements for Biden’s Executive Order.

While a bipartisan group of senators[11] hosted a more diverse audience of tech leaders in their AI Insights Forum, the attendees for the first and second forum were still largely limited to CEOs or Cofounders of prominent tech companies, VC executives, or professors at leading universities.[12] Marc Andreessen, a co-founder of Andreessen Horowitz, a prominent VC fund, noted that in order to protect competition, the “future of AI shouldn’t be dictated by a few large corporations. It should be a group of global voices, pooling together diverse insights and ethical frameworks.”[13] On November 3rd, 2023 a group of prominent academics, VC executives, and heads of AI startups published an open letter to the Biden administration where they voiced their concern about the Executive Order’s potentially stifling effects.[14] The group also welcomed a discussion with the Biden administration on the importance of developing regulations that allowed for robust development of open source AI.[15]

Potential to Stifle Innovation and Stunt Tech Startups

While the language of Biden’s Executive Order is fairly broad and general, it still has the potential to stunt early innovation by smaller AI startups. Industry leaders and AI startup founders have voiced concern over the Executive Order’s reporting requirements and restrictions on models over a certain size.[16] Ironically, Biden’s Order includes a claim that the Federal Trade Commission will “work to promote a fair, open, and competitive ecosystem” by helping developers and small businesses access technical resources and commercialization opportunities.

Despite this promise of providing resources to startups and small businesses, the Executive Order’s stringent reporting and information-sharing requirements will likely have a disproportionately detrimental impact on startups. Andrew Ng, a longtime AI leader and cofounder of Google Brain and Coursera, stated that he is “quite concerned about the reporting requirements for models over a certain size” and is worried about the “overhyped dangers of AI leading to reporting and licensing requirements that crush open source and stifle innovation.”[17] Ng believes that regulating AI model size will likely hurt the open-source community and unintentionally benefit tech giants as smaller companies will struggle to comply with the Order’s reporting requirements.[18]

Open source software (OSS) has been around since the 1980s.[19] OSS is code that is free to access, use, and change without restriction.[20] The open source community has played a central part in developing the use and application of AI, as leading AI generative models like ChatGPT and Llama have open-source origins.[21] While both Llama and ChatGPT are no longer open source, their development and advancement heavily relied on using open source models like Transformer, TensorFlow, and Pytorch.[22] Industry leaders have voiced concern that the Executive Order’s broad and vague use of the term “dual-use foundation model” will impose unduly burdensome reporting requirements on small companies.[23] Startups typically have leaner teams, and there is rarely a team solely dedicated to compliance. These reporting requirements will likely create barriers to entry for tech challengers who are pioneering open source AI, as only incumbents with greater financial resources will be able to comply with the Executive Order’s requirements.

While Biden’s Executive Order is unlikely to bring any immediate change, the broad reporting requirements outlined in the Order are likely to stifle emerging startups and pioneers of open source AI.

Notes

[1] https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/.

[2] Id.

[3] Id.

[4] https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/.

[5] https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/.

[6] https://www.whitehouse.gov/briefing-room/statements-releases/2023/05/04/readout-of-white-house-meeting-with-ceos-on-advancing-responsible-artificial-intelligence-innovation/.

[7] https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/21/fact-sheet-biden-harris-administration-secures-voluntary-commitments-from-leading-artificial-intelligence-companies-to-manage-the-risks-posed-by-ai/.

[8] https://www.whitehouse.gov/wp-content/uploads/2023/07/Ensuring-Safe-Secure-and-Trustworthy-AI.pdf.

[9] https://www.nytimes.com/2023/07/22/technology/ai-regulation-white-house.html.

[10] Id.

[11] https://www.heinrich.senate.gov/newsroom/press-releases/read-out-heinrich-convenes-first-bipartisan-senate-ai-insight-forum.

[12] https://techpolicy.press/us-senate-ai-insight-forum-tracker/.

[13] https://www.schumer.senate.gov/imo/media/doc/Marc%20Andreessen.pdf.

[14] https://twitter.com/martin_casado/status/1720517026538778657?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1720517026538778657%7Ctwgr%5Ec9ecbf7ac4fe23b03d91aea32db04b2e3ca656df%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcointelegraph.com%2Fnews%2Fbiden-ai-executive-order-certainly-challenging-open-source-ai-industry-insiders.

[15] Id.

[16] https://www.cnbc.com/2023/11/02/biden-ai-executive-order-industry-civil-rights-labor-groups-react.html.

[17] https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/.

[18] https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/.

[19] https://www.brookings.edu/articles/how-open-source-software-shapes-ai-policy/.

[20] Id.

[21] https://www.zdnet.com/article/why-open-source-is-the-cradle-of-artificial-intelligence/.

[22] Id.

[23] Casado, supra note 14.

Payment Pending: CFPB Proposes to Regulate Digital Wallets

November 27, 2023
Administrative Law, Financial Law, Regulatory

Kevin Malecha, MJLST Staffer

Federal regulators are increasingly concerned about digital wallets and person-to-person payment (P2P) apps like Apply Pay, Google Pay, Cash App, and Venmo, and how such services might impact the rights of financial consumers. As many as three-quarters of American adults use digital wallets or payment apps and, in 2022, the total value of transactions was estimated at $893 billion, expected to increase to $1.6 trillion by 2027.[1] In November of 2023, the Consumer Financial Protection Bureau proposed a rule that would expand its supervisory powers to cover certain nonbank providers of these services. The CFPB, an independent federal agency within the broader Federal Reserve System, was created by the Dodd-Frank Act in response to the 2007-2008 financial crisis and subsequent recession. The Bureau is tasked with protecting consumers in the financial space by promulgating and enforcing rules governing a wide variety of financial activities like mortgage lending, debt collection, and electronic payments.[2]

The CFPB has identified digital wallets and payment apps as products that threaten consumer financial rights and well-being.[3] First, because these services collect mass amounts of transaction and financial data, they pose a substantial risk to consumer data privacy.[4] Second, if the provider ceases operations or faces a “bank” run, any funds held in digital accounts may be lost because Federal Deposit Insurance Corporation (FDIC) protection, which insures deposits up to $250,000 in traditional banking institutions, is often unavailable for digital wallets.[5]

Enforcement and Supervision

The CFPB holds dual enforcement and supervisory roles. As one of the federal agencies charged with “implementing the Federal consumer financial laws,”[6] the enforcement powers of the CFPB are broad, but enforcement actions are relatively uncommon. In 2022, the Bureau brought twenty enforcement actions.[7] By contrast, the Commodity Futures Trading Commission (CFTC), which is also tasked in part with protecting financial consumers, brought eighty-two enforcement actions in the same period.[8] In contrast to the limited and reactionary nature of enforcement actions, the CFPB’s supervisory authority requires regulated entities to disclose certain documents and data, such as internal policies and audit reports, and allows CFPB examiners to proactively review their actions to ensure compliance.[9] The Bureau describes its supervisory process as a tool for identifying issues and addressing them before violations become systemic or cause significant harm to consumers.[10]

The CFPB already holds enforcement authority over all digital wallet and payment app services via its broad power to adjudicate violations of financial laws wherever they occur.[11] However, the Bureau has so far enjoyed only limited supervisory authority over the industry.[12] Currently, the CFPB only supervises digital wallets and payment apps when those services are provided by banks or when the provider falls under another CFPB supervision rule.[13] As tech companies like Apple and Google – which do not fall under other CFPB supervision rules – have increasingly entered the market, they have gone unsupervised.

Proposed Rule

Under the organic statute, CFPB’s existing supervisory authority covers nonbank persons that offer certain financial services including real estate and mortgage loans, private education loans, and payday loans.[14] In addition, the statute allows the Bureau to promulgate rules to cover other entities that are “larger participant[s] of a market for other consumer financial products or services.”[15] The proposed rule takes advantage of the power to define “larger participants” and expands the definition to include providers of “general-use digital consumer applications,” which the Bureau defines as funds transfer or wallet functionality through a digital application that the consumer uses to make payments for personal, household, or family purposes.[16] An entity is a “larger participant” if it (1) provides general-use digital consumer payment applications with an annual volume of at least five million transactions and (2) is not a small business as defined by the Small Business Administration.[17] The Bureau will make determinations on an individualized basis and may request documents and information from the entity to determine if it satisfies the requirements, which the entity can then dispute.

Implications for Digital Wallet and Payment App Providers

Major companies like Apple and Google can easily foresee that the CFPB intends to supervise them under the new rule. The Director of the CFPB recently compared the two American companies to Chinese tech companies Alibaba and WeChat that offer similar products and that, in the Director’s view, pose a similar risk to consumer data privacy and financial security.[18] For smaller firms, predicting the Bureau’s intentions is challenging, but existing regulations indicate that the Bureau will issue a written communication to initiate supervision.[19] The entity will then have forty-five days to dispute the finding that they meet the regulatory definition of a “larger participant.”[20] In their response, entities may include a statement of the reason for their objection and records, documents, or other information. Then the Assistant Director of the CFPB will review the response and make a determination. The regulation gives the Assistant Director the ability to request records and documents from the entity prior to the initial notification of intended supervision and throughout the determination process.[21] The Assistant Director also may extend the timeframe for determination beyond the forty-five-day window.[22]

If an entity becomes supervised, the Bureau will contact it for an initial conference.[23] The examiners will then determine the scope of future supervision, taking into consideration the responses at the conference, any records requested prior to or during the conference, and a review of the entity’s compliance management program.[24] The Bureau prioritizes its supervisory activities based on entity size, volume of transactions, size and risk of the relevant market, state oversight, and other market information to which the Bureau has access.[25] Ongoing supervision is likely to vary based on these factors, as well, but may include on-site or remote examination, review of documents and records, testing accounts and transactions for compliance with federal statutes and regulations, and continued review of the compliance management system.[26] The Bureau may then issue a confidential report or letter stating the examiner’s opinion that the entity has violated or is at risk of violating a statute or regulation.[27] While these findings are not final determinations, they do outline specific steps for the entity to regain or ensure compliance and should be taken seriously.[28] Supervisory reports or letters are distinct from enforcement actions and generally do not result in an enforcement action.[29] However, violations may be referred to the Bureau’s Office of Enforcement, which would then launch its own investigation.[30]

The likelihood of the proposed rule resulting in an enforcement action is, therefore, relatively low, but the exposure for regulated entities is difficult to measure because the penalties in enforcement actions vary widely. From October 2022 to October 2023, amounts paid by regulated entities ranged from $730,000 paid by a remittance provider that violated Electronic Funds Transfer rules,[31] to $3.7 billion in penalties and redress paid by Wells Fargo for headline-making violations of the Consumer Financial Protection Act.[32]

Notes

[1] Analysis of Deposit Insurance Coverage on Funds Stored Through Payment Apps, Consumer Fin. Prot. Bureau (Jun. 1, 2023), https://www.consumerfinance.gov/data-research/research-reports/issue-spotlight-analysis-of-deposit-insurance-coverage-on-funds-stored-through-payment-apps/full-report.

[2] Final Rules, Consumer Fin. Prot. Bureau, https://www.consumerfinance.gov/rules-policy/final-rules (last visited Nov. 16, 2023).

[3] CFPB Proposes New Federal Oversight of Big Tech Companies and Other Providers of Digital Wallets and Payment Apps, Consumer Fin. Prot. Bureau (Nov. 7, 2023), https://www.consumerfinance.gov/about-us/newsroom/cfpb-proposes-new-federal-oversight-of-big-tech-companies-and-other-providers-of-digital-wallets-and-payment-apps.

[4] Id.

[5] Id.

[6] 12 U.S.C. § 5492.

[7] Enforcement by the numbers, Consumer Fin. Prot. Bureau (Nov. 8, 2023), https://www.consumerfinance.gov/enforcement/enforcement-by-the-numbers.

[8] CFTC Releases Annual Enforcement Results, Commodity Futures Trading Comm’n (Oct. 20, 2022), https://www.cftc.gov/PressRoom/PressReleases/8613-22.

[9] CFPB Supervision and Examination Manual, Consumer Fin. Prot. Bureau at Overview 10 (Mar. 2017), https://files.consumerfinance.gov/f/documents/cfpb_supervision-and-examination-manual_2023-09.pdf.

[10] An Introduction to CFPB’s Exams of Financial Companies, Consumer Fin. Prot. Bureau 4 (Jan. 9, 2023), https://files.consumerfinance.gov/f/documents/cfpb_an-introduction-to-cfpbs-exams-of-financial-companies_2023-01.pdf.

[11] 12 U.S.C. §5563(a).

[12] CFPB Proposes New Federal Oversight of Big Tech Companies and Other Providers of Digital Wallets and Payment Apps, Consumer Fin. Prot. Bureau (Nov. 7, 2023), https://www.consumerfinance.gov/about-us/newsroom/cfpb-proposes-new-federal-oversight-of-big-tech-companies-and-other-providers-of-digital-wallets-and-payment-apps.

[13] Id.

[14] 12 U.S.C. § 5514.

[15] Id.

[16] Defining Larger Participants of a Market for General-Use Digital Consumer Payment, Consumer Fin. Prot. Bureau 3 (Nov. 7, 2023), https://files.consumerfinance.gov/f/documents/cfpb_nprm-digital-payment-apps-lp-rule_2023-11.pdf.

[17] Id. at 4.

[18] Rohit Chopra, Prepared Remarks of CFPB Director Rohit Chopra at the Brookings Institution Event on Payments in a Digital Century, Consumer Fin. Prot. Bureau (Oct. 6, 2023), https://www.consumerfinance.gov/about-us/newsroom/prepared-remarks-of-cfpb-director-rohit-chopra-at-the-brookings-institution-event-on-payments-in-a-digital-century.

[19] 12 CFR § 1090.103(a).

[20] 12 CFR § 1090.103(b).

[21] 12 CFR § 1090.103(c).

[22] 12 CFR § 1090.103(d).

[23] Defining Larger Participants of a Market for General-Use Digital Consumer Payment, Consumer Fin. Prot. Bureau 6 (Nov. 7, 2023), https://files.consumerfinance.gov/f/documents/cfpb_nprm-digital-payment-apps-lp-rule_2023-11.pdf.

[24] Id.

[25] Id. at 5.

[26] Id. at 6.

[27] An Introduction to CFPB’s Exams of Financial Companies, Consumer Fin. Prot. Bureau 3 (Jan. 9, 2023), https://files.consumerfinance.gov/f/documents/cfpb_an-introduction-to-cfpbs-exams-of-financial-companies_2023-01.pdf.

[28] Id.

[29] Id.

[30] Id.

[31] CFPB Orders Servicio UniTeller to Refund Fees and Pay Penalty for Failing to Follow Remittance, Consumer Fin. Prot. Bureau (Dec. 22, 2022), https://www.consumerfinance.gov/enforcement/actions/servicio-uniteller-inc.

[32] CFPB Orders Wells Fargo to Pay $3.7 Billion for Widespread Mismanagement of Auto Loans, Mortgages, and Deposit Accounts, Consumer Fin. Prot. Bureau (Dec. 20, 2022), https://www.consumerfinance.gov/enforcement/actions/wells-fargo-bank-na-2022.

Conflicts of Interest and Conflicting Interests: The SEC’s Controversial Proposed Rule

November 27, 2023
Administrative Law, Agencies, Artificial Intelligence, New Technology, Regulatory

Shaadie Ali, MJLST Staffer

A controversial proposed rule from the SEC on AI and conflicts of interest is generating significant pushback from brokers and investment advisers. The proposed rule, dubbed “Reg PDA” by industry commentators in reference to its focus on “predictive data analytics,” was issued on July 26, 2023.[1] Critics claim that, as written, Reg PDA would require broker-dealers and investment managers to effectively eliminate the use of almost all technology when advising clients.[2] The SEC claims the proposed rule is intended to address the potential for AI to hurt more investors more quickly than ever before, but some critics argue that the SEC’s proposed rule would reach far beyond generative AI, covering nearly all technology. Critics also highlight the requirement that conflicts of interest be eliminated or neutralized as nearly impossible to meet and a departure from traditional principles of informed consent in financial advising.[3]

The SEC’s 2-page fact sheet on Reg PDA describes the 239-page proposal as requiring broker-dealers and investment managers to “eliminate or neutralize the effect of conflicts of interest associated with the firm’s use of covered technologies in investor interactions that place the firm’s or its associated person’s interest ahead of investors’ interests.”[4] The proposal defines covered technology as “an analytical, technological, or computational function, algorithm, model, correlation matrix, or similar method or process that optimizes for, predicts, guides, forecasts, or directs investment-related behaviors or outcomes in an investor interaction.”[5] Critics have described this definition of “covered technology” as overly broad, with some going so far as to suggest that a calculator may be “covered technology.”[6] Despite commentators’ insistence, this particular contention is implausible – in its Notice of Proposed Rulemaking, the SEC stated directly that “[t]he proposed definition…would not include technologies that are designed purely to inform investors.”[7] More broadly, though, the SEC touts the proposal’s broadness as a strength, noting it “is designed to be sufficiently broad and principles-based to continue to be applicable as technology develops and to provide firms with flexibility to develop approaches to their use of technology consistent with their business model.”[8]

This move by the SEC comes amidst concerns raised by SEC chair Gary Gensler and the Biden administration about the potential for the concentration of power in artificial intelligence platforms to cause financial instability.[9] On October 30, 2023, President Biden signed an Executive Order that established new standards for AI safety and directed the issuance of guidance for agencies’ use of AI.[10] When questioned about Reg PDA at an event in early November, Gensler defended the proposed regulation by arguing that it was intended to protect online investors from receiving skewed recommendations.[11] Elsewhere, Gensler warned that it would be “nearly unavoidable” that AI would trigger a financial crisis within the next decade unless regulators intervened soon.[12]

Gensler’s explanatory comments have done little to curb criticism by industry groups, who have continued to submit comments via the SEC’s notice and comment process long after the SEC’s October 10 deadline.[13] In addition to highlighting the potential impacts of Reg PDA on brokers and investment advisers, many commenters questioned whether the SEC had the authority to issue such a rule. The American Free Enterprise Chamber of Commerce (“AmFree”) argued that the SEC exceeded its authority under both its organic statutes and the Administrative Procedures Act (APA) in issuing a blanket prohibition on conflicts of interest.[14] In their public comment, AmFree argued the proposed rule was arbitrary and capricious, pointing to the SEC’s alleged failure to adequately consider the costs associated with the proposal.[15] AmFree also invoked the major questions doctrine to question the SEC’s authority to promulgate the rule, arguing “[i]f Congress had meant to grant the SEC blanket authority to ban conflicts and conflicted communications generally, it would have spoken more clearly.”[16] In his scathing public comment, Robinhood Chief Legal and Corporate Affairs Officer Daniel M. Gallagher alluded to similar APA concerns, calling the proposal “arbitrary and capricious” on the grounds that “[t]he SEC has not demonstrated a need for placing unprecedented regulatory burdens on firms’ use of technology.”[17] Gallagher went on to condemn the proposal’s apparent “contempt for the ordinary person, who under the SEC’s apparent world view [sic] is incapable of thinking for himself or herself.”[18]

Although investor and broker industry groups have harshly criticized Reg PDA, some consumer protection groups have expressed support through public comment. The Consumer Federation of America (CFA) endorsed the proposal as “correctly recogniz[ing] that technology-driven conflicts of interest are too complex and evolve too quickly for the vast majority of investors to understand and protect themselves against, there is significant likelihood of widespread investor harm resulting from technology-driven conflicts of interest, and that disclosure would not effectively address these concerns.”[19] The CFA further argued that the final rule should go even further, citing loopholes in the existing proposal for affiliated entities that control or are controlled by a firm.[20]

More generally, commentators have observed that the SEC’s new prescriptive rule that firms eliminate or neutralize potential conflicts of interest marks a departure from traditional securities laws, wherein disclosure of potential conflicts of interest has historically been sufficient.[21] Historically, conflicts of interest stemming from AI and technology have been regulated the same as any other conflict of interest – while brokers are required to disclose their conflicts, their conduct is primarily regulated through their fiduciary duty to clients. In turn, some commentators have suggested that the legal basis for the proposed regulations is well-grounded in the investment adviser’s fiduciary duty to always act in the best interest of its clients.[22] Some analysts note that “neutralizing” the effects of a conflict of interest from such technology does not necessarily require advisers to discard that technology, but changing the way that firm-favorable information is analyzed or weighed, but it still marks a significant departure from the disclosure regime. Given the widespread and persistent opposition to the rule both through the note and comment process and elsewhere by commentators and analysts, it is unclear whether the SEC will make significant revisions to a final rule. While the SEC could conceivably narrow definitions of “covered technology,” “investor interaction,” and “conflicts of interest,” it is difficult to imagine how the SEC could modify the “eliminate or neutralize” requirement in a way that would bring it into line with the existing disclosure-based regime.

For its part, the SEC under Gensler is likely to continue pursuing regulations on AI regardless of the outcome of Reg PDA. Gensler has long expressed his concerns about the impacts of AI on market stability. In a 2020 paper analyzing regulatory gaps in the use of generative AI in financial markets, Gensler warned, “[e]xisting financial sector regulatory regimes – built in an earlier era of data analytics technology – are likely to fall short in addressing the risks posed by deep learning.”[23] Regardless of how the SEC decides to finalize its approach to AI in conflict of interest issues, it is clear that brokers and advisers are likely to resist broad-based bans on AI in their work going forward.

Notes

[1] Press Release, Sec. and Exch. Comm’n., SEC Proposes New Requirements to Address Risks to Investors From Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Jul. 26, 2023).

[2] Id.

[3] Jennifer Hughes, SEC faces fierce pushback on plan to police AI investment advice, Financial Times (Nov. 8, 2023), https://www.ft.com/content/766fdb7c-a0b4-40d1-bfbc-35111cdd3436.

[4] Sec. Exch. Comm’n., Fact Sheet: Conflicts of Interest and Predictive Data Analytics (2023).

[5] Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers,  88 Fed. Reg. 53960 (Proposed Jul. 26, 2021) (to be codified at 17 C.F.R. pts. 240, 275) [hereinafter Proposed Rule].

[6] Hughes, supra note 3.

[7] Proposed Rule, supra note 5.

[8] Id.

[9] Stefania Palma and Patrick Jenkins, Gary Gensler urges regulators to tame AI risks to financial stability, Financial Times (Oct. 14, 2023), https://www.ft.com/content/8227636f-e819-443a-aeba-c8237f0ec1ac.

[10] Fact Sheet, White House, President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence (Oct. 30, 2023).

[11] Hughes, supra note 3.

[12] Palma, supra note 9.

[13] See Sec. Exch. Comm’n., Comments on Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (last visited Nov. 13, 2023), https://www.sec.gov/comments/s7-12-23/s71223.htm (listing multiple comments submitted after October 10, 2023).

[14] Am. Free Enter. Chamber of Com., Comment Letter on Proposed Rule regarding Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Oct. 10, 2023), https://www.sec.gov/comments/s7-12-23/s71223-270180-652582.pdf.

[15] Id. at 14-19.

[16] Id. at 9.

[17] Daniel M. Gallagher, Comment Letter on Proposed Rule regarding Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Oct. 10, 2023), https://www.sec.gov/comments/s7-12-23/s71223-271299-654022.pdf.

[18] Id. at 43.

[19] Consumer Fed’n. of Am., Comment Letter on Proposed Rule regarding Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (Oct. 10, 2023), https://www.sec.gov/comments/s7-12-23/s71223-270400-652982.pdf.

[20] Id.

[21] Ken D. Kumayama et al., SEC Proposes New Conflicts of Interest Rule for Use of AI by Broker-Dealers and Investment Advisers, Skadden (Aug. 10, 2023), https://www.skadden.com/insights/publications/2023/08/sec-proposes-new-conflicts.

[22] Colin Caleb, ANALYSIS: Proposed SEC Regs Won’t Allow Advisers to Sidestep AI, Bloomberg Law (Aug. 10, 2023), https://news.bloomberglaw.com/bloomberg-law-analysis/analysis-proposed-sec-regs-wont-allow-advisers-to-sidestep-ai.

[23] Gary Gensler and Lily Bailey, Deep Learning and Financial Stability (MIT Artificial Intel. Glob. Pol’y F., Working Paper 2020) (in which Gensler identifies several potential systemic risks to the financial system, including overreliance and uniformity in financial modeling, overreliance on concentrated centralized datasets, and the potential of regulators to create incentives for less-regulated entities to take on increasingly complex functions in the financial system).

Cracking the Code: Navigating New SEC Rules Governing Cybersecurity Disclosure

November 13, 2023
Cyber Security, Regulatory, Securities Law

Noah Schottenbauer, MJLST Staffer

In response to the dramatic impact cybersecurity incidents have on investors through the decline of stock value and sizeable costs to companies in rectifying breaches,  the SEC adopted new rules governing cybersecurity-related disclosures for public companies, covering both the disclosure of individual cybersecurity incidents as well as periodic disclosures of a company’s procedures to assess, identify, and manage material cybersecurity risks, management’s role in assessing and managing cybersecurity risks, and the board of directors’ oversight of cybersecurity risks.[1]

Before evaluating the specifics of the new SEC cybersecurity disclosure requirements, it is important to understand why information about cybersecurity incidents is important to investors. In recent years, data breaches have led to an average decline in stock value of 7.5% amongst publicly traded companies, with impacts being felt long after the date of the breach, as demonstrated by companies experiencing a significant data breach underperforming the NASDAQ by an average of 8.6% after one year.[2] One of the forces driving this decline in stock value is the immense costs associated with rectifying a data breach for the affected company. In 2022, the average cost of a data breach for U.S. companies was $9.44 million, drawn from ransom payments, disruptions in business operations, legal and audit fees, and other associated expenses.[3]

Summary Of Required Disclosures

  • Material Cybersecurity Incidents (Form 8-K, Item 1.05)

Amendments to Item 1.05 of Form 8-K require that reporting companies disclose any cybersecurity incident deemed to be material.[4] When making such disclosures, companies are required to “describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.”[5]

So, what is a material cybersecurity incident? The SEC defines cybersecurity incident as “an unauthorized occurrence . . . on or conducted through a registrant’s information systems that jeopardizes the confidentiality, integrity, or availability of a registrant’s information systems or any information residing therein.”[6]

The definition of material, on the other hand, lacks the same degree of clarity. Based on context offered by the SEC through the rulemaking process, material is to be used in a way that is consistent with other securities laws.[7] Under this standard, information, or, in this case, a cybersecurity incident, would be considered material if “there is a substantial likelihood that a reasonable shareholder would consider it important.”[8] This determination is made based on a “delicate assessment of the inferences a ‘reasonable shareholder’ would draw from a given set of facts and the significance of those inferences to him.”[9] Even with this added context, what characteristics of a cybersecurity incident make it material remain unclear, but considering the fact that the rules are being implemented with the intent of protecting investor interests, the safest course of action would be to disclose a cybersecurity incident when in doubt of its materiality.[10]

It is important to note that this disclosure mandate is not limited to incidents that occur within the company’s own systems. If a material cybersecurity incident happens on third-party systems that a company utilizes, that too must be disclosed.[11] However, in these situations, companies are only expected to disclose information that is readily accessible, meaning they are not required to go beyond their “regular channels of communication” to gather pertinent information.[12]

Regarding the mechanics of the disclosure, the SEC stipulates that companies must file an Item 1.05 of Form 8-K within four business days of determining that a cybersecurity incident is material.[13] However, delaying disclosure may be allowed in limited circumstances where the United States Attorney General determines that immediate disclosure may seriously threaten national security or public safety.[14]

If there are any changes in the initially-disclosed information or if new material information is discovered that was not available at the time of the first disclosure, registrants are obligated to update their disclosure by filing an amended Form 8-K, ensuring that all relevant information related to the cybersecurity incident is available to the public and stakeholders.[15]

  • Risk Management & Strategy (Regulation S-K, Item 106(b))

Under amendments to Item 106(b) of Regulation S-K, reporting companies are obligated to describe their  “processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes.”[16] When detailing these processes, companies must specifically address three primary points. First, they need to indicate how and if the cybersecurity processes described in Item 106(b) fall under the company’s overarching risk management system or procedures. Second, companies must clarify whether they involve assessors, consultants, auditors, or other third-party entities in relation to these cybersecurity processes. Third,  they must describe if they possess methods to monitor and access significant risks stemming from cybersecurity threats when availing the services of any third-party providers.[17]

In addition to the three enumerated elements under Item 106(b), companies are expected to furnish additional information to ensure a comprehensive understanding of their cybersecurity procedures for potential investors. This supplementary disclosure should encompass “whatever information is necessary, based on their facts and circumstances, for a reasonable investor to understand their cybersecurity processes.”[18] While companies are mandated to reveal if they collaborate with third-party service providers concerning their cybersecurity procedures, they are not required to disclose the specific names of these providers or offer a detailed description of the services these third-party entities provide, thus striking a balance between transparency and confidentiality and ensuring that investors have adequate information.[19]

  • Governance (Regulation S-K, Item 106(c))

Amendments to Regulation S-K, Item 106(c) require that companies: (1) describe the board’s oversight of the risks emanating from cybersecurity threats, and (2) characterize management’s role in both assessing and managing material risks arising from such threats.[20]

When detailing management’s role concerning these cybersecurity threats, there are a number of issues that should be addressed. First, companies should clarify which specific management positions or committees are entrusted with the responsibility of assessing and managing these risks. Additionally, the expertise of these designated individuals or groups should be outlined in such detail as necessary to comprehensively describe the nature of their expertise. Second, a description of the processes these entities employ to stay informed about, and to monitor, the prevention, detection, mitigation, and remediation of cybersecurity incidents should be included. Third, companies should indicate if and how these individuals or committees convey information about such risks to the board of directors or potentially to a designated committee or subcommittee of the board.[21]

The disclosures required under Item 106(c) are aimed at balancing investor accessibility to information with the company’s ability to maintain autonomy in determining cybersecurity practices in the context of organizational structure; therefore, disclosures do not need to be overly detailed.[22]

  • Foreign Private Issuers (Form 6-K & Form 20-F)

The rules addressed above only apply to domestic companies, but the SEC imposed parallel cybersecurity disclosure requirements for foreign private issuers under Form 6-K (incident reporting) and Form 20-K (periodic reporting).[23]

Key Dates

The SEC’s final rules are effective as of September 5, 2023, but the Form 8-K and Regulation S-K reporting requirements have yet to take effect. The key compliance dates for each are as follows:

  • Form 8-K Item 1.05(a) Incident Reporting – December 18, 2023
  • Regulation S-K Periodic Reporting – Fiscal years ending on or after December 15, 2023

Smaller reporting companies are provided with an extra 180 days to comply with Form 8-K Item 1.05. Under this grant, small companies will be expected to begin incident reporting on June 15, 2024. No such extension was granted to smaller reporting companies with regard to Regulation S-K Periodic Reporting.[24]

Potential Impact On Cybersecurity Policy

The actual impact of the SEC’s new disclosure requirements will likely remain unclear for some time, yet the regulations compel companies to adopt a greater sense of discipline and transparency in their cybersecurity practices. Although the primary intent of these rules is investor protection, they may also influence how companies formulate their cybersecurity strategies, given the requirement to discuss such policies in their annual disclosures. This heightened level of accountability, regarding defensive measures and risk management strategies in response to cybersecurity threats, may encourage companies to implement more robust cybersecurity practices or, at the very least, ensure that cybersecurity becomes a regular topic of discussion amongst senior leadership. Consequently, the SEC’s initiative may serve as a catalyst for strengthening cybersecurity policies within corporate entities, while also providing investors with essential information for making informed decisions in the marketplace.

Further Information

The overview of the new SEC rules governing cybersecurity disclosures provided above is precisely that: an overview. For more information regarding the requirements and applicability of these rules please refer to the official rules and the SEC website.

Notes

[1] Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Exchange Act Release No. 33-11216, Exchange Act Release No. 34-97989 (July 26, 2023) [hereinafter Final Rule Release], https://www.sec.gov/files/rules/final/2023/33-11216.pdf.

[2] Keman Huang et al., The Devastating Business Impact of a Cyber Breach, Harv. Bus Rev., May 4, 2023, https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach.

[3] Id.

[4] Final Rule Release, supra note 1, at 12

[5] Id. at 49.

[6] Id. at 76.

[7] Id. at 14.

[8] TSC Indus. v. Northway, 426 U.S. 438, 449 (1976).

[9] Id. at 450.

[10] Id. at 448.

[11] Final Rule Release, supra note 1, at 30.

[12] Id. at 31.

[13] Id. at 32.

[14] Id. at 28.

[15] Id. at 50–51.

[16] Id. at 61.

[17] Id. at 63.

[18] Id.

[19] Id. at 60.

[20] Id. at 12.

[21] Id. at 70.

[22] Id.

[23] Id. at 12.

[24] Id. at 107.

Home | Contact Publishing Services | My Account