Regulatory

The Double-Helix Dilemma: Navigating Privacy Pitfalls in Direct-to-Consumer Genetic Testing

Ethan Wold, MJLST Staffer

Introduction

On October 22, direct-to-consumer genetic testing (DTC-GT) company 23andME sent emails to a number of its customers informing them of a data breach into the company’s “DNA Relatives” feature that allows customers to compare ancestry information with other users worldwide.[1] While 23andMe and other similar DTC-GT companies offer a number of positive benefits to consumers, such as testing for health predispositions and carrier statuses of certain genes, this latest data breach is a reminder that before choosing to opt into these sorts of services one should be aware of the potential risks that they present.

Background

DTC-GT companies such as 23andMe and Ancestry.com have proliferated and blossomed in recent years. It is estimated over 100 million people have utilized some form of direct-to-consumer genetic testing.[2] Using biospecimens submitted by consumers, these companies sequence and analyze an individual’s genetic information to provide a range of services pertaining to one’s health and ancestry.[3] The October 22 data breach specifically pertained to 23andMe’s “DNA Relatives” feature.[4] The DNA Relatives feature can identify relatives on any branch of one’s family tree by taking advantage of the autosomal chromosomes, the 22 chromosomes that are passed down from your ancestors on both sides of your family, and one’s X chromosome(s).[5] Relatives are identified by comparing the customer’s submitted DNA with the DNA of other 23andMe members who are participating in the DNA Relatives feature.[6] When two people are found to have an identical DNA segment, it is likely they share a recent common ancestor.[7] The DNA Relatives feature even uses the length and number of these identical segments to attempt to predict the relationship between genetic relatives.[8] Given the sensitive nature of sharing genetic information, there are often privacy concerns regarding practices such as the DNA Relatives feature. Yet despite this, the legislation and regulations surrounding DTC-GT is somewhat limited.

Legislation

The Health Insurance Portability and Accountability Act (HIPAA) provides the baseline privacy and data security rules for the healthcare industry.[9] HIPAA’s Privacy Rule regulates the use and disclosure of a person’s “protected health information” by a “covered entity.[10] Under the Act, the type of genetic information collected by 23andMe and other DTC-GT companies does constitute “protected health information.”[11] However, because HIPAA defines a “covered entity” as a health plan, healthcare clearinghouse, or health-care provider, DTC-GT companies do not constitute covered entities and therefore are not under the umbrella of HIPAA’s Privacy Rule.[12]

Thus, the primary source of regulation for DTC-GT companies appears to be the Genetic Information Nondiscrimination Act (GINA). GINA was enacted in 2008 for the purpose of protecting the public from genetic discrimination and alleviating concerns about such discrimination and thereby encouraging individuals to take advantage of genetic testing, technologies, research, and new therapies.[13] GINA defines genetic information as information from genetic tests of an individual or family members and includes information from genetic services or genetic research.[14] Therefore, DTC-GT companies fall under GINA’s jurisdiction. However, GINA only applies to the employment and health insurance industries and thus neglects many other potential arenas where privacy concerns may present.[15] This is especially relevant for 23andMe customers, as signing up for the service serves as consent for the company to use and share your genetic information with their associated third-party providers.[16] As a case in point, in 2018 the pharmaceutical giant GlaxoSmithKline purchased a $300 million stake in 23andMe for the purpose of gaining access to the company’s trove of genetic information for use in their drug development trials.[17]

Executive Regulation

In addition to the legislation above, three different federal administrative agencies primarily regulate the DTC-GT industry: the Food and Drug Administration (FDA), the Centers of Medicare and Medicaid services (CMS), and the Federal Trade Commission (FTC). The FDA has jurisdiction over DTC-GT companies due to the genetic tests they use being labeled as “medical devices”[18] and in 2013 exercised this authority over 23andMe by sending a letter to the company resulting in the suspending of one of its health-related genetic tests.[19] However, the FDA only has jurisdiction over diagnostic tests and therefore does not regulate any of the DTC-GT services related to genealogy such as 23andMe’s DNA Relatives feature.[20] Moreover, the FDA does not have jurisdiction to regulate the other aspects of DTC-GT companies’ activities or data practices.[21] CMS has the ability to regulate DTC-GT companies through enforcement of the Clinical Laboratory Improvements Act (CLIA), which requires that genetic testing laboratories ensure the accuracy, precision, and analytical validity of their tests.[22] But, like the FDA, CMS only has jurisdiction over tests that diagnose a disease or assess health.[23]

Lastly, the FTC has broad authority to regulate unfair or deceptive business practices under the Federal Trade Commission Act (FTCA) and has levied this authority against DTC-GT companies in the past. For example, in 2014 the agency brought an action against two DTC-GT companies who were using genetic tests to match consumers to their nutritional supplements and skincare products.[24] The FTC alleged that the companies’ practices related to data security were unfair and deceptive because they failed to implement reasonable policies and procedures to protect consumers’ personal information and created unnecessary risks to the personal information of nearly 30,000 consumers.[25] This resulted in the companies entering into an agreement with the FTC whereby they agreed to establish and maintain comprehensive data security programs and submit to yearly security audits by independent auditors.[26]

Potential Harms

As the above passages illustrate, the federal government appears to recognize and has at least attempted to mitigate privacy concerns associated with DTC-GT. Additionally, a number of states have passed their own laws that limit DTC-GT in certain aspects.[27] Nevertheless, given the potential magnitude and severity of harm associated with DTC-GT it makes one question if it is enough. Data breaches involving health-related data are growing in frequency and now account for 40% of all reported data breaches.[28] These data breaches result in unauthorized access to DTC-GT consumer-submitted data and can result in a violation of an individual’s genetic privacy. Though GINA aims to prevent it, genetic discrimination in the form of increasing health insurance premiums or denial of coverage by insurance companies due to genetic predispositions remains one of the leading concerns associated with these violations. What’s more, by obtaining genetic information from DTC-GT databases, it is possible for someone to recover a consumer’s surname and combine that with other metadata such as age and state to identify the specific consumer.[29] This may in turn lead to identity theft in the form of opening accounts, taking out loans, or making purchases in your name, potentially damaging your financial well-being and credit score. Dealing with the aftermath of a genetic data breach can also be expensive. You may incur legal fees, credit monitoring costs, or other financial burdens in an attempt to mitigate the damage.

Conclusion

As it sits now, genetic information submitted to DTC-GT companies already contains a significant volume of consequential information. As technology continues to develop and research presses forward, the volume and utility of this information will only grow over time. Thus, it is crucially important to be aware of risks associated with DTC-GT services.

This discussion is not intended to discourage individuals from participating in DTC-GT. These companies and the services they offer provide a host of benefits, such as allowing consumers to access genetic testing without the healthcare system acting as a gatekeeper, thus providing more autonomy and often at a lower price.[30] Furthermore, the information provided can empower consumers to mitigate the risks of certain diseases, allow for more informed family planning, or gain a better understanding of their heritage.[31] DTC-GT has revolutionized the way individuals access and understand their genetic information. However, this accessibility and convenience comes with a host of advantages and disadvantages that must be carefully considered.

Notes

[1] https://www.reuters.com/world/us/23andme-notifies-customers-data-breach-into-its-dna-relatives-feature-2023-10-24/#:~:text=%22There%20was%20unauthorized%20access%20to,exposed%20to%20the%20threat%20actor.%22

[2] https://www.ama-assn.org/delivering-care/patient-support-advocacy/protect-sensitive-individual-data-risk-dtc-genetic-tests#:~:text=Use%20of%20direct%2Dto%2Dconsumer,November%202021%20AMA%20Special%20Meeting

[3] https://go-gale-com.ezp3.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[4] https://www.reuters.com/world/us/23andme-notifies-customers-data-breach-into-its-dna-relatives-feature-2023-10-24/#:~:text=%22There%20was%20unauthorized%20access%20to,exposed%20to%20the%20threat%20actor.%22

[5] https://customercare.23andme.com/hc/en-us/articles/115004659068-DNA-Relatives-The-Genetic-Relative-Basics

[6] Id.

[7] Id.

[8] Id.

[9] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[10] https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf

[11] Id.

[12] Id; https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[13] https://www.eeoc.gov/statutes/genetic-information-nondiscrimination-act-2008

[14] Id.

[15] https://europepmc.org/backend/ptpmcrender.fcgi?accid=PMC3035561&blobtype=pdf

[16] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[17] https://news.yahoo.com/news/major-drug-company-now-access-194758309.html

[18] https://uscode.house.gov/view.xhtml?req=(title:21%20section:321%20edition:prelim)

[19] https://core.ac.uk/download/pdf/33135586.pdf

[20] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[21] Id.

[22] https://www.law.cornell.edu/cfr/text/42/493.1253

[23] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[24] https://www.ftc.gov/system/files/documents/cases/140512genelinkcmpt.pdf

[25] Id.

[26] Id.

[27] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[28] Id.

[29] https://go-gale-com.ezp2.lib.umn.edu/ps/i.do?p=OVIC&u=umn_wilson&id=GALE%7CA609260695&v=2.1&it=r&sid=primo&aty=ip

[30] Id.

[31] Id.


Who Is Regulating Regulatory Public Comments?

Madeleine Rossi, MJLST Staffer

In 2015 the Federal Communications Commission (FCC) issued a rule on “Protecting and Promoting the Open Internet.”[1] The basic premise of these rules was that internet service providers had unprecedented control over access to information for much of the public. Those in favor of the new rules argued that broadband providers should be required to enable access to all internet content, without either driving or throttling traffic to particular websites for their own benefit. Opponents of these rules – typically industry players such as the same broadband providers that would be regulated – argued that such rules were burdensome and would prevent technological innovation. The fight over these regulations is colloquially known as the fight over “net neutrality.” 

In 2017 the FCC reversed course and put forth a proposal to repeal the 2015 regulations. Any time that an agency proposes a rule, or proposes to repeal a rule, they must go through the notice-and-comment rulemaking procedure. One of the most important parts of this process is the solicitation of public comments. Many rules get put forth without much attention or fanfare from the public. Some rules may only get hundreds of public comments, often coming from the industry that the rule is aimed at. Few proposed rules get attention from the public at large. However, the fight over net neutrality – both the 2015 rules and the repeal of those rules in 2017 – garnered significant public interest. The original 2015 rule amassed almost four million comments.[2] At the time, this was the most public comments that a proposed rule had ever received.[3] In 2017, the rule’s rescission blew past four million comments to acquire a total of almost twenty-two million comments.[4]

At first glance this may seem like a triumph for the democratic purpose of the notice-and-comment requirement. After all, it should be a good thing that so many American citizens are taking an interest in the rules that will ultimately determine how they can use the internet. Unfortunately, that was not the full story. New York Attorney General Letitia James released a report in May of 2021 detailing her office’s investigation into wide ranging fraud that plagued the notice-and-comment process.[5] Of the twenty-two million comments submitted about the repeal, a little under eight million of them were generated by a single college student.[6] These computer-generated comments were in support of the original regulations, but used fake names and fake comments.[7] Another eight million comments were submitted by lead generation companies that were hired by the broadband companies.[8] These companies stole individuals’ identities and submitted computer-generated comments on their behalf.[9] While these comments used real people’s identities, they fabricated the content in support of repealing the 2015 regulations.[10]

Attorney General James’ investigation showed that real comments, submitted by real people, were “drowned out by masses of fake comments and messages being submitted to the government to sway decision-making.”[11] When the investigation was complete, James’ office concluded that nearly eighteen of the twenty-two million comments received by the FCC in 2017 were faked.[12] The swarm of fake comments created the false perception that the public was generally split on the issue of net neutrality. In fact, anywhere from seventy-five to eighty percent of Americans say that they support net neutrality.[13]

This is not an issue that is isolated to the fight over net neutrality. Other rulemaking proceedings have been targeted as well, namely by the same lead generation firms involved in the 2017 notice-and-comment fraud campaign.[14] Attorney General James’ investigation found that regulatory agencies like the Environmental Protection Agency (EPA), which is responsible for promulgating rules that protect people and the environment from risk, had also been targeted by such campaigns.[15] When agencies like the FCC or EPA propose regulations for the protection of the public, the democratic process of notice-and-comment is completely upended when industry players are able to “drown out” real public voices.

So, what can be done to preserve the democratic nature of the notice-and-comment period? As the technology involved in these schemes advances, this is likely to become not only a reoccurring issue but one that could entirely subvert the regulatory process of rulemaking. One way that injured parties are fighting back is with lawsuits.

In May of 2023, Attorney General James announced that she had come to a second agreement with three of the lead generation firms involved with the 2017 scam to falsify public comments.[16] The three companies agreed to pay $615,000 in fines for their involvement.[17] This agreement came in addition to a previous agreement in which the three stipulated to paying four million dollars in fines and agreed to change future lead generating practices, and the litigation is ongoing.[18]

However, more must be done to ensure that the notice-and-comment process is not entirely subverted. Financial punishment after the fact does not account for the harm to the democratic process that is already done. Currently, the only recourse is to sue these companies for their fraudulent and deceptive practices. However, lawsuits will typically only result in financial losses. Financial penalties are important, but they will always come after the fact. Once litigation is under way, the harm has already been done to the American public.

Agencies need to ensure that they are keeping up with the pace of rapidly evolving technology so that they can properly vet the validity of the comments that they receive. While it is important to keep public commenting a relatively open and easy practice, having some kind of vetting procedure has become essential. Perhaps requiring an accompanying email address or phone number for each comment, and then sending a simple verification code. Email or phone numbers could also be contacted during the vetting process once the public comment period closes. While it would likely be impractical to contact each individual independently, a random sample would at least flag whether or not a coordinated and large-scale fake commenting campaign had taken place. 

Additionally, the legislature should keep an eye on fraudulent practices that impact the notice-and-comment process. Lawmakers can and should strengthen laws to punish companies that are engaged in these practices. For example, in Attorney General James’ report she recommends that lawmakers do at least two things. First, they should explicitly and statutorily prohibit “deceptive and unauthorized comments.”[19] To be effective these laws should establish large civil fines. Second, the legislature should “strengthen impersonation laws.”[20] Current impersonation laws were not designed with mass-impersonation fraud in mind. These statutes should be amended to increase penalties when many individuals are impersonated.

In conclusion, the use of fake comments to sway agency rulemaking is a problem that is only going to worsen with time and the advance of technology. This is a serious problem that should be taken as such by both agencies and the legislature. 

Notes

[1] 80 Fed. Reg. 19737.

[2] https://www.brookings.edu/articles/democratizing-and-technocratizing-the-notice-and-comment-process/.

[3] Id.

[4] Id.

[5] https://ag.ny.gov/press-release/2021/attorney-general-james-issues-report-detailing-millions-fake-comments-revealing.

[6] https://www.brookings.edu/articles/democratizing-and-technocratizing-the-notice-and-comment-process/.

[7] Id.

[8] Id.

[9] Id.

[10] Id.

[11] https://ag.ny.gov/press-release/2021/attorney-general-james-issues-report-detailing-millions-fake-comments-revealing.

[12] Id.

[13] https://thehill.com/policy/technology/435009-4-in-5-americans-say-they-support-net-neutrality-poll/, https://publicconsultation.org/united-states/three-in-four-voters-favor-reinstating-net-neutrality/.

[14] Id.

[15] https://apnews.com/article/settlement-fake-public-comments-net-neutrality-ae1f69a1f5415d9f77a41f07c3f6c358.

[16] Id.

[17] Id.

[18] https://apnews.com/article/government-and-politics-technology-business-9f10b43b6aacbc750dfc010ceaedaca7.

[19] https://ag.ny.gov/sites/default/files/oag-fakecommentsreport.pdf.

[20] Id.


Whistleblowers Reveals…—How Can the Legal System Protect and Encourage Whistleblowing?

Vivian Lin, MJLST Staffer

In July 2022, Twitter’s former head of security, Peiter Zatko, filed a 200+ page complaint with Congress and several federal agencies, disclosing Twitter’s potential major security problems that pose a threat to its users and national security.[1] Though it is still unclear whether  these allegations were confirmed, the disclosure drew significant attention because of data privacy implications and calls for whistleblower protection. Whistleblowers play an important role in detecting major issues in corporations and the government. A 2007 survey reported that in private companies, professional auditors were only able to detect 19% of instances of fraud but whistleblowers were able to expose 43% of incidents.[2]In fact, this recent Twitter scandal, along with Facebook’s online safety scandal in 2021[3] and the famous national security scandal disclosed by Edward Snowden, were all revealed by inside whistleblowers. Without these disclosures, the public may never learn of incidents that involve their personal information and security.

An Overview of the U.S. Whistleblower Protection Regulations

Whistleblower laws aim to protect individuals who report illegal or unethical activities in their workplace or government agency. The primary federal law protecting whistleblowers is the Whistleblower Protection Act (WPA), passed in 1989. The WPA provides protections for federal employees who report violations such as  gross mismanagement, gross waste of funds, abuse of authority, or dangers to public health or safety.[4]

In addition to the WPA, there are other federal laws that provide industry specific whistleblower protections in private sectors. For example, the Sarbanes-Oxley Act (SOX) was enacted in response to the corporate accounting scandals of the early 2000s. It requires public companies to establish and maintain internal controls to ensure the accuracy of their financial statements. Whistleblowers who report violations of securities law can receive protection against retaliation, including reinstatement, back pay, and special damages. To further encourage more whistleblowers to come forward with potential securities violations, Congress passed the Dodd-Frank           Wall Street Reform and Consumer Protection Act (Dodd-Frank) in 2010 which provides incentives and additional protections for whistleblowers. The Securities and Exchange Commission (SEC) established its whistleblower protection program under Dodd-Frank to award qualified whistleblowers for their tips that lead to a successful SEC sanction. Finally, the False Claims Act (FCA) allows individuals to file lawsuits on behalf of the government against entities that have committed fraud against the government. Whistleblowers who report fraud under the FCA can receive a percentage of the amount recovered by the government. In general, these laws give protections for whistleblowers in the private corporate setting, providing anti-retaliation protection and incentives for reporting violations.

Concerns Involved in Whistleblowing and Related Laws

While whistleblower laws in the United States provide important protections for individuals who speak out against illegal or unethical activities, there are still risks associated with whistleblowing. Even with the anti-retaliation provisions, whistleblowers still face retaliation from their employer, such as demotion or termination, and may face difficulties finding new employment in their field. For example, a 2011 report indicated that while the percentage of employees who noticed wrongdoings at their workplaces decreased from the 1992 survey, about one-third of those who called out wrongdoings and were identified as whistleblowers experienced retaliation in the form of threats and/or reprisals.[5]

Besides the fear of retaliation, another concern is the low success rate under the WPA when whistleblowers step up to make a claim. A 2015 research analyzed 151 cases where employees sought protection under the WPA and found that 79% of the cases were found in favor of the federal government.[6] Such a low success rate, in addition to potential retaliation, likely discourages employees from disclosing when they identify wrongdoings at their workplace.

A third problem with the current whistleblowing law is that financial incentives do not work as effectively as expected and might negatively impact corporate governance. From the incentives perspective, bounty hunting might actually discourage whistleblowers when not used well. For example, Dodd-Frank provides monetary rewards for people who report financial fraud that will allow the SEC impose a more than $1 million sanction on the violator, but if an employee discovers a wrongdoing that will not lead to a sanction over $1 million, a study shows that the employee will be less likely to report it timely.[7] From a corporate governance perspective, a potential whistleblower might turn to a regulatory agency for the reward rather than reporting it to the company’s internal compliance program, providing the company with the opportunity to do the right thing.[8]

Potential Changes 

There are several ways in which the current whistleblower regulations can improve. First, to encourage employees to stand up and identify wrongdoings at the workplace, the SEC’s whistleblower protection program should exclude the $1 million threshold requirement for any potential reward. Those who notice illegal behaviors that might not result in a $1 million sanction should also receive a reward if they report the potential risks.[9] Second, to deter retaliation, compensation for retaliation should be proportionate to the severity of the wrongdoing uncovered.[10] Currently, statutes mostly offer backpay, front pay, reinstatement, etc. as compensation for retaliation, while receiving punitive damages beyond that is rare. This mechanism does not recognize the public interest in retaliation cases—the public benefits from the whistleblower’s act while she risks retaliation. Finally, bounty programs might not be the right approach given that many whistleblowers are motivated more by their own moral calling rather than money. Perhaps a robust system ensuring whistleblower’s reports be thoroughly investigated and building stronger protections  from retaliation would work better than bounty programs.

In conclusion, whistleblowers play a crucial role in exposing illegal and unethical activities within organizations and government agencies. While current U.S. whistleblower protection regulations offer some safeguards, there are still shortcomings that may discourage employees from reporting wrongdoings. Improving whistleblower protections against retaliation, expanding rewards to include a wider range of disclosures, and refining the approach to investigations are essential steps to strengthen the system. By ensuring that their disclosures are thoroughly investigated and their lives are not severely impacted, we can encourage more whistleblowers to come forward with useful information which will better protect the public interest and maintain a higher standard of transparency, accountability, and corporate governance in the society.

Notes

[1] Donie O’Sullivan et al., Ex-Twitter Exec Blows The Whistle, Alleging Reckless and Negligent Cybersecurity Policies, CNN (Aug. 24, 2022, 5:59 AM EDT), https://edition.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html.

[2] Kai-D. Bussmann, Economic Crime: People, Culture, and Controls 10 (2007).

[3] Ryan Mac & Cecilia Kang, Whistle-Blower Says Facebook ‘Chooses Profits Over Safety’, N.Y. Times (Oct. 3, 2021), https://www.nytimes.com/2021/10/03/technology/whistle-blower-facebook-frances-haugen.html.

[4] Whistleblower Protection, Office of Inspector General, https://www.oig.dhs.gov/whistleblower-protection#:~:text=The%20Whistleblower%20Protection%20Act%20 (last accessed: Mar. 5, 2023).

[5] U.S. Merit Systems Protection Board, Blowing the Whistle: Barriers to Federal Employees Making Disclosures 27 (2011).

[6] Shelley L. Peffer et al., Whistle Where You Work? The Ineffectiveness of the Federal Whistleblower Protection Act of 1989 and the Promise of the Whistleblower Protection Enhancement Act of 2012, 35 Review of Public Personnel Administration 70 (2015).

[7] Leslie Berger, et al., Hijacking the Moral Imperative: How Financial Incentives Can Discourage Whistleblower Reporting. 36 AUDITING: A Journal of Practice & Theory 1 (2017).

[8] Matt A. Vega, Beyond Incentives: Making Corporate Whistleblowing Moral in the New Era of Dodd- Frank Act “Bounty Hunting”, 45 Conn. L. Rev. 483.

[9] Geoffrey C. Rapp, Mutiny by the Bounties? The Attempt to Reform Wall Street by the New Whistleblower Provisions of the Dodd-Frank Act, 2012 B.Y.U.L. Rev. 73.

[10] David Kwok, The Public Wrong of Whistleblower Retaliation, 96 Hastings L.J. 1225.


Taking Off: How the FAA Reauthorization Bill Could Keep Commercial Flights Grounded

James Challou, MJLST Staffer

The last year has been one that the airline industry is eager to forget. Not only did a record number of flight delays and cancellations occur, but the Federal Aviation Administration (FAA) suffered an extremely rare complete system outage and Southwest dealt with a holiday travel meltdown. These incidents, coupled with recent near collisions on runways, have drawn increased scrutiny from lawmakers in Congress as this year they face a September 30threauthorization deadline for the Federal Aviation Administration Reauthorization Act. And while the Federal Aviation Act is a hotly debated topic, lawmakers and industry professionals all agree that a failure to meet the reauthorization deadline could spell disaster.

The need for reauthorization arises from the structure and funding system of the FAA. Reauthorization is a partial misnomer. Though the airline industry was deregulated in 1978, the practice of FAA reauthorization originated with the Airport and Airway Revenue Act of 1970 which created the Airport and Airway Trust Fund (Trust Fund) that is used to finance FAA investments. The authority to collect taxes and to spend from the Trust Fund must be periodically reauthorized to meet agency and consumer needs. Currently, the Trust Fund provides funds for four major FAA accounts: Operations, Facilities & Equipment (F&E), Research, Engineering and Development (RE&D), and Grants-in-Aid for Airports. If the FAA’s authorization expired without an extension, then the agency would be unable to spend revenues allocated from the Trust Fund. The flip side of the unique reauthorization process is that it offers a regular opportunity for Congress to hold the FAA accountable for unfulfilled mandates, to respond to new problems in air travel, and to advocate for stronger consumer protections because enacted changes in reauthorization acts only span a set time period.

On top of the recent spate of industry complications and near disasters, Congress must sift through a myriad of other concerns and issues that pervade the airline industry for the potential upcoming reauthorization. Consumer protection has become an increasingly pressing and hot-button issue as the deluge of canceled flights in the past year left many consumers disgruntled by the treatment and compensation they received. In fact, the Consumer Federation of America and several other consumer and passengers’ right groups recently called upon the House Transportation Committee and the Senate Commerce Committee to prioritize consumer protections. Their requests include requiring compensation when consumers’ flights are delayed and canceled, holding airlines accountable for publishing unrealistic flight schedules, ending junk fee practices in air travel, including prohibiting fees for family seating and for other such services, and requiring all-in pricing, ending federal preemption of airline regulation and allowing state attorneys general and individuals to hold airlines accountable, encouraging stronger DOT enforcement of passenger protections, and prioritizing consumer voices and experiences.

However, not all are sold on enhancing consumer protections via the reauthorization process. Senator Ted Cruz, the top Republican lawmaker on the Commerce, Science, and Transportation Committee has expressed opposition to increased agency and government intervention in the airline industry, citing free market and regulatory overreach concerns. Instead, Cruz and his allies have suggested that the FAA’s technology is outdated, and their sole focus should be on modernizing it.

Indeed, it appears that in the wake of the FAA system outage most interested parties and lawmakers agree that the aging FAA technology needs updating. While at first glance one might think this provides common ground, the opinions on how to update the FAA’s technology are wide-ranging. For example, while some have flagged IT infrastructure and aviation safety systems as the FAA technology to target in order to augment the FAA’s cybersecurity capacity, others are more concerned with providing the agency direction on the status of new airspace inhabitants such as drones and air taxis to facilitate entrants into the market. Even despite cross-party assent that the FAA’s technology necessitates some level of baseline update, a lack of direction for what this means in practice remains.

Another urgent and seemingly undisputed issue that the reauthorization effort faces is FAA staffing. The FAA’s workforce has severely diminished in the past decade. Air traffic controllers, for example, number 1,000 fewer than a decade ago, and more than 10% are eligible to retire. Moreover, a shortage of technical operations employees has grown so severe that union officials have dubbed it to be approaching crisis levels. Resultingly, most lawmakers agree that expanding the FAA’s workforce is paramount.

However, despite the dearth of air traffic controllers and technical operations employees, this proposition has encountered roadblocks as well. Some lawmakers view this as a solution to increase diversity within the ranks of the FAAand offer solutions revolving around this. Currently, only 2.6% of aviation mechanics are women and 94% of aircraft pilots male and 93% of them White. Lawmakers have made several proposals intended to rectify this disparity centering around reducing the cost of entry into FAA professions. However, Republicans have largely refuted such efforts and criticized such efforts as distractions from the chief concern of safety. Additionally, worker groups continue to air concerns about displacing qualified U.S. pilot candidates and undercutting current pilot pay. Any such modifications to the FAA reauthorization bill will require bipartisan support.

Finally, a lingering battle between Democrats and Republicans regarding the confirmation of President Biden’s nominated commissioner have hampered efforts to forge a bipartisan reauthorization bill. Cruz, again spearheading the Republican contingent, has decried Biden’s nominee for possessing no aviation experience and being overly partisan. Proponents, however, have pointed out that only two of the last five commissioners have had any aviation experience and lauded the nominee’s credentials and experience in the military. The surprisingly acrid fight bodes ominously for a reauthorization bill that will have to be bipartisan and is subject to serious time constraints.

The FAA reauthorization process provides valuable insight into how Congress decides agency directives. However, while safety and technology concerns remain the joint focal point of Congress’ intent for the reauthorization bill, in practice there seems to be little common ground between lawmakers. With a September 13th deadline looming, it is increasingly important that lawmakers cooperate to collectively hammer out a reauthorization bill. Failure to do so would severely cripple the FAA and the airline industry in general.


Call of Regulation: How Microsoft and Regulators Are Battling for the Future of the Gaming Industry

Caroline Moriarty, MJLST Staffer

In January of 2022 Microsoft announced its proposed acquisition of Activision Blizzard, a video game company, promising to “bring the joy and community of gaming to everyone, across every device.” However, regulators in the United States, the EU, and the United Kingdom have recently indicated that they may block this acquisition due to its antitrust implications. In this post I’ll discuss the proposed acquisition, its antitrust concerns, recent actions from regulators, and prospects for the deal’s success.

Background

Microsoft, along with making the Windows platform, Microsoft Office suite, Surface computers, cloud computing software, and of new relevance, Bing, is a major player in the video game space. Microsoft owns Xbox, which along with Nintendo and Sony (PlayStation) is one of the three most popular gaming consoles. One of the main ways these consoles distinguish themselves from their competitors is by categorizing certain games as “exclusives,” where certain games can only be played on a single console. For example, Spiderman can only be played on PlayStation, the Mario games are exclusive to Nintendo, and Halo can only be played on Xbox. Other games, like Grand Theft Auto, Fortnite, and FIFA are offered on multiple platforms, allowing consumers to play the game on whatever console they already own.

Activision Blizzard is a video game holding company, which means the company owns games developed by game development studios. They then make decisions about marketing, creative direction, and console availability for individual games. Some of their most popular games include World of Warcraft, Candy Crush, Overwatch, and one of the most successful game franchises ever, Call of Duty. Readers outside of the gaming space may recognize Activision Blizzard’s name from recent news stories about its toxic workplace culture.

In January 2022, Microsoft announced its intention to purchase Activision Blizzard for $68.7 billion dollars, which would be the largest acquisition in the company’s history. The company stated that its goals were to expand into mobile gaming, as well as make more titles available, especially through Xbox Game Pass, a streaming service for games. After the announcement, critics pointed out two main issues. First, if Microsoft owned Activision Blizzard, it would be able to make the company’s titles exclusive to Xbox. This is especially problematic in relation to the Call of Duty franchise. Not only does the Call of Duty franchise include the top three most popular games of 2022, but it’s estimated that 400 million people play at least one of the games, 42% of whom play on Playstation. Second, if Microsoft owned Activision Blizzard, it could also make its titles exclusive to Xbox Game Pass, which would change the structure of the relatively new cloud streaming market.

The Regulators

Microsoft’s proposed acquisition has drawn scrutiny from the FTC, the European Commission, and the UK Competition and Markets Authority. In what the New York Times has dubbed “a global alignment on antitrust,” the three regulators have pursued a connected strategy. First, the European Commission announced an investigation of the deal in November, signaling that the deal would take time to close. Then, a month later, the FTC sued in its own administrative court, which is more favorable to antitrust claims. In February 2023, the Competition and Markets Authority released provisional findings on the effect of the acquisition on UK markets, writing that the merger may be expected to result in a substantial lessening of competition. Finally, the EU commission also completed its investigation, concluding that the possibility of Microsoft making Activision Blizzard titles exclusives “could reduce competition in the markets for the distribution of console and PC video games, leading to higher prices, lower quality and less innovation for console game distributors, which may, in turn, be passed on to consumers.” Together, the agencies are indicating a new era in antitrust – one that is much tougher on deals than in the recent past.

Specifically, the FTC called out Microsoft on its past acquisitions in its complaint. When Microsoft acquired Bethesda (another video game company, known for games like The Elder Scrolls: Skyrim) in 2021, the company told the European Commission that they would keep titles available on other consoles. After the deal cleared, Microsoft announced that many Bethesda titles, including highly anticipated games like Starfield and Redfall, would be Microsoft exclusives. The FTC used this in its complaint to show that any promises by Microsoft to keep games like Call of Duty available to all consumers could be broken at any time. Microsoft has disputed this characterization, arguing that the company made decisions to make titles exclusive on a “case-by-case basis,” which was in line with what it told the European Commission.

For the current deal, Microsoft has agreed to make Call of Duty available on the Nintendo Switch, and it claims to have made an offer to Sony, guaranteeing the franchise would remain available on PlayStation for ten years. This type of guarantee is known as conduct remedy, which preserves competition through requirements that the merged firm commits to take certain business actions or refrain from certain business conduct going forward. In contrast, structural remedies usually require a company to divest certain assets by selling parts of the business. One example of conduct remedies was in the Live Nation – Ticketmaster merger. The companies agreed not to retaliate against concert venue customers that switched to a different service nor tie sales of ticketing services to concerts it promoted. However, as the recent Taylor Swift ticketing dilemma proves, conduct remedies may not be effective in eliminating anticompetitive behavior.

Conclusion

Microsoft faces an uphill battle with its proposed acquisition. Despite its claims that Xbox does not exercise outsize influence in the gaming industry, the sheer size and potential effects of this acquisition make Microsoft’s claims much weaker. Further, the company faces stricter scrutiny from new regulators in the United States. Assistant Attorney General Jonathan Kanter, who leads the DOJ’s antitrust division, has already indicated that he prefers structural remedies to conduct ones, and Lina Khan, FTC commissioner, is well known for her opposition to big tech companies. If Microsoft wants this deal to succeed, it may have to provide more convincing evidence that it will act differently than its anticompetitive conduct in the past.


The Crypto Wild West Chaos Continues at FTX: Will the DCCPA Fix This?

Jack Atterberry, MJLST Staffer

The FTX Collapse and Its Implications

Over the last few weeks, the company FTX has imploded in what appears to be a massive scam of epic proportions. John Ray III, the former Enron restructuring leader who just took over FTX as CEO in their bankruptcy process, described FTX’s legal and bankruptcy situation as “worse than Enron” and a “complete failure of corporate control.”[1] FTX is a leading cryptocurrency exchange company that provided a platform on which customers could buy and sell crypto assets – similar to a traditional finance stock exchange. As of this past summer, FTX was worth $32 billion and served as a platform that global consumers trusted enough to deposit tens of billions of dollars in assets.[2]

Although FTX and its CEO Sam Bankman-Fried (“SBF”) engaged in numerous questionable and likely illegal business practices, perhaps the greatest fraudulent activity was intermingling customer deposits on the FTX exchange platform with assets from SBF’s asset management firm Alameda Research. Although facts are still being uncovered, preliminary investigations have highlighted that Alameda Research was using customer deposits in their trading and lending activities without customer consent – now customers face the unpleasant reality that their assets (in excess of $1 billion on aggregate) may never be returned.[3] While many lessons in corporate governance can be learned from the FTX situation, a key legal implication of the meltdown is that crypto has a regulatory problem that needs to be addressed by Congress and other US government agencies.

Current State of Government Regulation

Crypto assets are a relatively new asset class and have risen to prominence globally since the publishing of the Bitcoin white paper by the anonymous Satoshi Nakamoto in 2009.[4] Although crypto assets and the business activities associated with them are regulated in the United States, this regulation has been inconsistent and has created uncertainty for businesses and individuals in the ecosystem. Currently, the US Securities and Exchange Commission (“SEC”), state legislatures, the US Treasury, and a host of other government agencies have acted inconsistently. The SEC has inconsistently pursued enforcement actions, state governments have enacted differing digital assets laws, and the Treasury has banned crypto entities without clear rationale.[5] This has been a major problem for the industry and has led companies (including now infamously FTX) to move abroad to seek more regulatory certainty. Companies like FTX have chosen to domicile in jurisdictions like the Bahamas to avoid having to guess what approach various state governments and federal agencies will take with regard to its digital asset business activities.

Earlier in 2022, Congress introduced the Digital Commodities Consumer Protection Act (“DCCPA”) to attempt to fill gaps in the federal regulatory framework that oversees the crypto industry. The Digital Commodities Consumer Protection Act amends the Commodity Exchange Act to create a much-needed comprehensive and robust regulatory framework for spot markets of digital asset commodities. The DCCPA would enable the Commodity Futures Trading Commission (“CFTC”) to require digital asset commodity exchanges to actively prevent fraud and market manipulation, and would provide the CFTC regulatory authority to access quote and trade data allowing them to identify market manipulation more easily.[6] Taken as a whole, the DCCPA would implement consumer protections relating to digital asset commodities, ensure oversight of digital asset commodity platforms (such as FTX, Coinbase, etc.), and better prevent system risk to financial markets.[7] This regulation fills in a necessary gap in federal crypto regulation and industry observers are optimistic of its chances in getting passed as law.[8]

Digital Asset Regulation Has a Long Path Ahead

Despite the potential benefits and strong congressional regulatory action that the DCCPA represents, elements of the bill have been criticized by both the crypto industry and policy experts. According to the Blockchain Association, a leading crypto policy organization, the DCCPA could present negative implications for the decentralized finance (“DeFi”) ecosystem because of the onerous reporting and custody requirements that elements of the DCCPA would inflict on De-Fi protocols and applications[9]. “De-Fi” is a catch-all term for blockchain-based financial tools that allow users to trade, borrow, and loan crypto assets without third-party intermediaries.[10] The DCCPA attempts to regulate intermediary risks associated with digital asset trading whereas the whole point of De-Fi is to remove intermediaries through the use of blockchain software technology.[11] The Blockchain Association has also criticized the DCCPA as providing an overly broad definition for “digital commodity platform” and an overly narrow and ambiguous definition of “digital commodity” which could create future unnecessary turf wars between the SEC and CFTC.[12] When Congress revisits this bill next year, these complexities will likely be brought up in weighing the pros and cons of the bill. Besides the textual contents of the DCCPA, the legislators pushing forward the bill must also deal with the DCCPA’s negative association with Sam Bankman-Fried, the former FTX CEO. The former FTX CEO and suspected fraudster was perhaps the greatest supporter of the bill and lobbied for its provisions before Congress several times.[13] While Bankman-Fried’s support does not necessarily mean anything is wrong with the bill, some legislators and lobbyists may be hesitant to push forward a bill that was heavily influenced by a person who perpetrated a massive fraud scheme severely hurting thousands of consumers.

Though the goal of the DCCPA is to establish CFTC authority over crypto assets that qualify as commodities, the crypto ecosystem will still be left with several unanswered regulatory issues if it is passed. A key question is whether digital assets will be treated as commodities, securities or something else entirely. In addition, another key looming question is how Congress will regulate stablecoins—a type of digital asset where the price is designed to be pegged to another type of asset, typically a real-world asset such as US Treasury bills. For these unanswered questions Congress and the SEC will likely need to provide additional guidance and rules to build on the increased certainty that could be brought about with the DCCPA. By passing an amended version of the DCCPA with more careful attention paid to the De-Fi ecosystem as well as clarified definitions of digital commodities and digital commodity platforms, Congress would go a long way in the right direction to prevent future FTX-like fraud schemes, protect consumers, and ensure crypto innovation stays in the US.

Notes

[1] Ken Sweet & Michelle Chapman, FTX Is a Bigger Mess Than Enron, New CEO Says, Calling It “Unprecedented”, TIME (Nov. 17, 2022), https://time.com/6234801/ftx-fallout-worse-than-enron/

[2] FTX Company Profile, FORBES, https://www.forbes.com/companies/ftx/?sh=506342e23c59

[3] Osipovich et al., They Lived Together, Worked Together and Lost Billions Together: Inside Sam Bankman-Fried’s Doomed FTX Empire, WSJ (Nov. 19, 2022), https://www.wsj.com/articles/sam-bankman-fried-ftx-alameda-bankruptcy-collapse-11668824201

[4] Guardian Nigeria, The idea and a brief history of cryptocurrencies, The Guardian (Dec. 26, 2022), https://guardian.ng/technology/tech/the-idea-and-a-brief-history-of-cryptocurrencies/

[5] Kathryn White, Cryptocurrency regulation: where are we now, and where are we going?, World Economic Forum (Mar. 28, 2022), https://www.weforum.org/agenda/2022/03/where-is-cryptocurrency-regulation-heading/

[6] https://www.agriculture.senate.gov/imo/media/doc/Testimony_Phillips_09.15.2022.pdf

[7] US Senate Agriculture Committee, Crypto One-Pager: The Digital Commodities Consumer Protection Act Closes Regulatory Gaps, https://www.agriculture.senate.gov/imo/media/doc/crypto_one-pager1.pdf

[8] Courtney Degen, Washington wants to regulate cryptocurrency, Pensions & Investments (Oct. 3, 2022), https://www.pionline.com/cryptocurrency/washington-wants-regulate-crypto-path-unclear

[9] Jake Chervinsky, Blockchain Association Calls for Revisions to the Digital Commodities Consumer Protection Act (DCCPA), Blockchain Association (Sept. 15, 2022), https://theblockchainassociation.org/blockchain-association-calls-for-revisions-to-the-digital-commodities-consumer-protection-act-dccpa/

[10] Rakesh Sharma, What is Decentralized Finance (DeFi) and How Does It Work?, Investopedia (Sept. 21, 2022), https://www.investopedia.com/decentralized-finance-defi-5113835.

[11] Jennifer J. Schulpt & Jack Solowey, DeFi Must Be Defended, CATO Institute (Oct. 26, 2022), https://www.cato.org/commentary/defi-must-be-defended

[12] Jake Chervinsky, supra note 7.

[13] Fran Velasquez, Former SEC Official Doubts FTX Crash Will Prompt Congress to Act on Crypto Regulations, CoinDesk (Nov. 16, 2022), https://www.coindesk.com/business/2022/11/16/former-sec-official-doubts-ftx-crash-will-prompt-congress-to-act-on-crypto-regulations/


Twitter Troubles: The Upheaval of a Platform and Lessons for Social Media Governance

Gordon Unzen, MJLST Staffer

Elon Musk’s Tumultuous Start

On October 27, 2022, Elon Musk officially completed his $44 billion deal to purchase the social media platform, Twitter.[1] When Musk’s bid to buy Twitter was initially accepted in April 2022, proponents spoke of a grand ideological vision for the platform under Musk. Musk himself emphasized the importance of free speech to democracy and called Twitter “the digital town square where matters vital to the future of humanity are debated.”[2] Twitter co-founder Jack Dorsey called Twitter the “closest thing we have to a global consciousness,” and expressed his support of Musk: “I trust his mission to extend the light of consciousness.”[3]

Yet only two weeks into Musk’s rule, the tone has quickly shifted towards doom, with advertisers fleeing the platform, talk of bankruptcy, and the Federal Trade Commission (“FTC”) expressing “deep concern.” What happened?

Free Speech or a Free for All?

Critics were quick to read Musk’s pre-purchase remarks about improving ‘free speech’ on Twitter to mean he would change how the platform would regulate hate speech and misinformation.[4] This fear was corroborated by the stream of racist slurs and memes from anonymous trolls ‘celebrating’ Musk’s purchase of Twitter.[5] However, Musk’s first major change to the platform came in the form of a new verification service called ‘Twitter Blue.’

Musk took control of Twitter during a substantial pullback in advertisement spending in the tech industry, a problem that has impacted other tech giants like Meta, Spotify, and Google.[6] His solution was to seek revenue directly from consumers through Twitter Blue, a program where users could pay $8 a month for verification with the ‘blue check’ that previously served to tell users whether an account of public interest was authentic.[7] Musk claimed this new system would give ‘power to the people,’ which proved correct in an ironic and unintended fashion.

Twitter Blue allowed users to pay $8 for a blue check and impersonate politicians, celebrities, and company media accounts—which is exactly what happened. Musk, Rudy Giuliani, O.J. Simpson, LeBron James, and even the Pope were among the many impersonated by Twitter users.[8] Companies received the same treatment, with an impersonation Eli Lilly and Company account writing “We are excited to announce insulin is free now,” causing its stock to drop 2.2%.[9]This has led advertising firms like Omnicom and IPG’s Mediabrands to conclude that brand safety measures are currently impeded on Twitter and advertisers have subsequently begun to announce pauses on ad spending.[10] Musk responded by suspending Twitter Blue only 48 hours after it launched, but the damage may already be done for Twitter, a company whose revenue was 90% ad sales in the second quarter of this year.[11] During his first mass call with employees, Musk said he could not rule out bankruptcy in Twitter’s future.[12]

It also remains to be seen whether the Twitter impersonators will escape civil liability under theories of defamation[13] or misappropriation of name or likeness,[14] or criminal liability under state identity theft[15] or false representation of a public employee statutes,[16] which have been legal avenues used to punish instances of social media impersonation in the past.

FTC and Twitter’s Consent Decree

On the first day of Musk’s takeover of Twitter, he immediately fired the CEO, CFO, head of legal policy, trust and safety, and general counsel.[17] By the following week, mass layoffs were in full swing with 3,700 Twitter jobs, or 50% of its total workforce, to be eliminated.[18] This move has already landed Twitter in legal trouble for potentially violating the California WARN Act, which requires 60 days advance notice of mass layoffs.[19] More ominously, however, these layoffs, as well as the departure of the company’s head of trust and safety, chief information security officer, chief compliance officer and chief privacy officer, have attracted the attention of the FTC.[20]

In 2011, Twitter entered a consent decree with the FTC in response to data security lapses requiring the company to establish and maintain a program that ensured its new features do not misrepresent “the extent to which it maintains and protects the security, privacy, confidentiality, or integrity of nonpublic consumer information.”[21] Twitter also agreed to implement two-factor authentication without collecting personal data, limit employee access to information, provide training for employees working on user data, designate executives to be responsible for decision-making regarding sensitive user data, and undergo a third-party audit every six months.[22] Twitter was most recently fined $150 million back in May for violating the consent decree.[23]

With many of Twitter’s former executives gone, the company may be at an increased risk for violating regulatory orders and may find itself lacking the necessary infrastructure to comply with the consent decree. Musk also reportedly urged software engineers to “self-certify” legal compliance for the products and features they deployed, which may already violate the court-ordered agreement.[24] In response to these developments, Douglas Farrar, the FTC’s director of public affairs, said the commission is watching “Twitter with deep concern” and added that “No chief executive or company is above the law.”[25] He also noted that the FTC had “new tools to ensure compliance, and we are prepared to use them.”[26] Whether and how the FTC will employ regulatory measures against Twitter remains uncertain.

Conclusions

The fate of Twitter is by no means set in stone—in two weeks the platform has lost advertisers, key employees, and some degree of public legitimacy. However, at the speed Musk has moved so far, in two more weeks the company could likely be in a very different position. Beyond the immediate consequences to the company, Musk’s leadership of Twitter illuminates some important lessons about social media governance, both internal and external to a platform.

First, social media is foremost a business and not the ‘digital town square’ Musk imagines. Twitter’s regulation of hate speech and verification of public accounts served an important role in maintaining community standards, promoting brand safety for advertisers, and protecting users. Loosening regulatory control runs a great risk of delegitimizing a platform that corporations and politicians alike took seriously as a tool for public communication.

Second, social media stability is important to government regulators and further oversight may not be far off on the horizon. Musk is setting a precedent and bringing the spotlight on the dangers of a destabilized social media platform and the risks this may pose to data privacy, efforts to curb misinformation, and even the stock market. In addition to the FTC, Senate Majority Whip, and chair of the Senate Judiciary Committee, Dick Durbin, has already commented negatively on the Twitter situation.[27] Musk may have given powerful regulators, and even legislators, the opportunity they were looking for to impose greater control over social media. For better or worse, Twitter’s present troubles could lead to a new era of government involvement in digital social spaces.

Notes

[1] Adam Bankhurst, Elon Musk’s Twitter Takeover and the Chaos that Followed: The Complete Timeline, IGN (Nov. 11, 2022), https://www.ign.com/articles/elon-musks-twitter-takeover-and-the-chaos-that-followed-the-complete-timeline.

[2] Monica Potts & Jean Yi, Why Twitter is Unlikely to Become the ‘Digital Town Square’ Elon Musk Envisions, FiveThirtyEight (Apr. 29, 2022), https://fivethirtyeight.com/features/why-twitter-is-unlikely-to-become-the-digital-town-square-elon-musk-envisions/.

[3] Bankhurst, supra note 1.

[4] Potts & Yi, supra note 2.

[5] Drew Harwell et al., Racist Tweets Quickly Surface After Musk Closes Twitter Deal, Washington Post (Oct. 28, 2022), https://www.washingtonpost.com/technology/2022/10/28/musk-twitter-racist-posts/.

[6] Bobby Allyn, Elon Musk Says Twitter Bankruptcy is Possible, But is That Likely?, NPR (Nov. 12, 2022), https://www.wglt.org/2022-11-12/elon-musk-says-twitter-bankruptcy-is-possible-but-is-that-likely.

[7] Id.

[8] Keegan Kelly, We Will Never Forget These Hilarious Twitter Impersonations, Cracked (Nov. 12, 2022), https://www.cracked.com/article_35965_we-will-never-forget-these-hilarious-twitter-impersonations.html; Shirin Ali, The Parody Gold Created by Elon Musk’s Twitter Blue, Slate (Nov. 11, 2022), https://slate.com/technology/2022/11/parody-accounts-of-twitter-blue.html.

[9] Ali, supra note 8.

[10] Mehnaz Yasmin & Kenneth Li, Major Ad Firm Omnicom Recommends Clients Pause Twitter Ad Spend – Memo, Reuters (Nov. 11, 2022), https://www.reuters.com/technology/major-ad-firm-omnicom-recommends-clients-pause-twitter-ad-spend-verge-2022-11-11/; Rebecca Kern, Top Firm Advises Pausing Twitter Ads After Musk Takeover, Politico (Nov. 1, 2022), https://www.politico.com/news/2022/11/01/top-marketing-firm-recommends-suspending-twitter-ads-with-musk-takeover-00064464.

[11] Yasmin & Li, supra note 10.

[12] Katie Paul & Paresh Dave, Musk Warns of Twitter Bankruptcy as More Senior Executives Quit, Reuters (Nov. 10, 2022), https://www.reuters.com/technology/twitter-information-security-chief-kissner-decides-leave-2022-11-10/.

[13] Dorrian Horsey, How to Deal With Defamation on Twitter, Minc, https://www.minclaw.com/how-to-report-slander-on-twitter/ (last visited Nov. 12, 2022).

[14] Maksim Reznik, Identity Theft on Social Networking Sites: Developing Issues of Internet Impersonation, 29 Touro L. Rev. 455, 456 n.12 (2013), https://digitalcommons.tourolaw.edu/cgi/viewcontent.cgi?article=1472&context=lawreview.

[15] Id. at 455.

[16] Brett Snider, Can a Fake Twitter Account Get You Arrested?, FindLaw Blog (April 22, 2014), https://www.findlaw.com/legalblogs/criminal-defense/can-a-fake-twitter-account-get-you-arrested/.

[17] Bankhurst, supra note 1.

[18] Sarah Perez & Ivan Mehta, Twitter Sued in Class Action Lawsuit Over Mass Layoffs Without Proper Legal Notice, Techcrunch (Nov. 4, 2022), https://techcrunch.com/2022/11/04/twitter-faces-a-class-action-lawsuit-over-mass-employee-layoffs-with-proper-legal-notice/.

[19] Id.

[20] Natasha Lomas & Darrell Etherington, Musk’s Lawyer Tells Twitter Staff They Won’t be Liable if Company Violates FTC Consent Decree (Nov. 11, 2022), https://techcrunch.com/2022/11/11/musks-lawyer-tells-twitter-staff-they-wont-be-liable-if-company-violates-ftc-consent-decree/.

[21] Id.

[22] Scott Nover, Elon Musk Might Have Already Broken Twitter’s Agreement With the FTC, Quartz (Nov. 11, 2022), https://qz.com/elon-musk-might-have-already-broken-twitter-s-agreement-1849771518.

[23] Tom Espiner, Twitter Boss Elon Musk ‘Not Above the Law’, Warns US Regulator, BBC (Nov. 11, 2022), https://www.bbc.com/news/business-63593242.

[24] Nover, supra note 22.

[25] Espiner, supra note 23.

[26] Id.

[27] Kern, supra note 10.


Behind the “Package Insert”: Loophole in FDA’s Regulation of Off-Label Prescriptions

Yolanda Li, MJLST Staffer

FDA Regulation of Drug Prescription Labeling and the “Package Insert”

Over the recent years, constant efforts have been made towards regulating medical prescriptions in an attempt to reduce risks accompanied with drug prescriptions. Among those efforts is the FDA’s revision of the format of prescription drug information, commonly known as the “package insert”.[1]

The package insert regulation, effective since 2006, applies to all prescription drugs. The package insert is to provide up-to-date information on the drug in an easy-to-read format. One significant feature is a section named “highlights”, which provides the most important information regarding the benefits and risks of a prescribed medication. The highlights section is typically half a page in length providing a concise summary of information including “boxed warning”, “indications and usage”, and “dosage and administration”.[2] The highlights section also refers physicians to appropriate sections of the full prescribing information. In this way, the package insert aims to draw both the physicians’ and the patients’ attention to the prescription of a drug, consequently accomplishing the ultimate purpose of managing medication use and reducing medical errors. Mike Leavitt, the Health and Human Services Secretary of the FDA commented that the package insert “help[s] ensure safe and optimal use of drugs, which translates into better health outcomes for patients and more efficient delivery of healthcare.”[3]

FDA Regulation of Off-Label Prescription and the Emergence of a Loophole

The FDA’s regulations relating to the labeling of prescription drugs, although systematic in its form, are cut short to a certain extent due to its lack of regulation on off-label prescriptions. Off-label prescriptions do not refer to a physician prescribing non-FDA approved drugs, a common misunderstanding by the public. Rather, off-label prescriptions are those that do not conform to the FDA-approved use set out in the FDA-approved label.[4] More specifically, off-label prescription generally refers to: “(1) the practice of a physician prescribing a legally manufactured drug for purposes other than those indicated on that drug’s FDA mandated labeling; (2) using a different method of applying the treatment and prescribing a drug, device, or biologic to patient groups other than those approved by FDA; and (3) prescriptions for drug dosages that are different from the approved label-recommended dosage or for time periods exceeding the label-recommended usage.”[5] For example if Drug A’s use, as mandated by the FDA, is to treat chronic headaches, and a physician prescribes it to treat a patient’s sprained ankle, that is an off-label prescription. However, such practice is common as estimated by the American Medical Association (AMA).[6]

The commonly approach is that the FDA and courts do not to interfere with physicians’ off-label uses.[7] Thus, when the FDA regulates the labeling of approved uses but does not regulate prescriptions for off-label uses, a loophole is formed. Andrew von Eschenbach, M.D., claims that because the FDA’s package insert regulation makes it easier for physicians to get access to important information about drugs, including drug safety and benefits, this regulation helps physicians to have more meaningful discussions with patients.[8] However, physicians’ discretion in prescribing off-label prescriptions would offset the proposed benefit of the FDA regulation because the regulation remains as guidance without force of law once physicians choose to go off from FDA’s approved uses of drugs. The easy-to-understand feature of the package insert and its benefit for a patient’s understanding of the drug becomes futile when physicians exercise discretion and prescribe drugs for uses not written on the inserts. In sum, when a patient receives an off-label prescription, the insert provides them little benefit as it addresses benefits and risks related to a different use of the drug.

It is undisputed that drug manufacturers have less discretion regarding drug labeling than physicians. If a manufacturer included an off-label use on a drug’s label, and promoted the off-label use of the drug, the drug would be considered misbranded. The manufacturer would then be subject to liability[9] as manufacturing a misbranded product in interstate commerce is prohibited.[10] However, the effect of regulations on manufacturers still fail to eliminate the loophole in off-label prescription: in response to the regulations, the manufacturer usually receives FDA approval for only a few drug uses and then relies on physicians prescribing off-label uses to ensure their profitability.[11] In this way, the manufacturer avoids liability under regulation and furthers the loophole in off-label prescription by encouraging physicians to prescribe more off-label uses in order to expand the manufacturer’s market.[12]

Why are Off-Label Prescriptions Difficult to Regulate?

One of the main reasons behind the lack of regulation of off-label prescriptions is the FDA’s objective in ensuring effective delivery of health care. Physicians are encouraged to use discretion and judgment in order to tailor prescription to patients’ individual conditions.[13] Another reason is to increase efficiency in treatments by avoiding the lengthy FDA approval process.[14] Aspirin was widely prescribed to reduce the risk of heart attack long before it was FDA-approved for this purpose; off-label prescriptions have also been proven effective in treatment of cancer, and off-label therapies have prolonged the lives of AIDS patients.[15] Another concern is drug prices in the United States, and promoting off-label uses has been found to help reduce drug prices as increased sales volume enables drug companies to lower their prices.[16] Indeed, off-label prescription has become a mainstream of medicine: “the FDA has long tolerated off-label drug use and has disclaimed any interest in regulating physicians’ prescribing practices.”[17] Today it is unclear whether the agency even has jurisdiction to regulate off-label prescription of drugs.[18]

In sum, there is clear guidance on the labeling of prescription drugs as a result of FDA regulation. However, because of difficulties in enforcement, the custom and widely accepted practice of off-label prescriptions and the inherent benefit of off-label prescription, the effects of the regulation are not as effective as what was firstly planned and proposed.

Notes

[1] The FDA Announces New Prescription Drug Information Format, U.S. Food & Drug Adm’ (Dec. 04 2015) https://www.fda.gov/drugs/laws-acts-and-rules/fda-announces-new-prescription-drug-information-format.

[2] Id.

[3] Id.

[4] Margaret Z. Johns, Informed Consent: Requiring Doctors to Disclose Off-Label Prescriptions and Conflicts of Interest, 58 Hastings L.J. 967, 968 https://plus.lexis.com/document?crid=35364c11-2939-4e58-bceb-dab7ae8f0154&pddocfullpath=%2Fshared%2Fdocument%2Fanalytical-materials%2Furn%3AcontentItem%3A4P0W-GY20-00CW-906B-00000-00&pdsourcegroupingtype=&pdcontentcomponentid=7341&pdmfid=1530671&pdisurlapi=true.

[5] Lisa E. Smilan, The off-label loophole in the psychopharmacologic setting: prescription of antipsychotic drugs in the nonpsychotic patient population, 30 Health Matrix 233, 240 (2020), https://plus.lexis.com/document/?pdmfid=1530671&crid=367cf8ad-295e-4f14-97fa-737618718d61&pddocfullpath=%2Fshared%2Fdocument%2Fanalytical-materials%2Furn%3AcontentItem%3A64BT-RR31-JWBS-61KV-00000-00&pdworkfolderid=5506aeec-9540-4837-89f0-5a1acfd81d8b&pdopendocfromfolder=true&prid=1d42abd0-b66e-43af-a61a-0d1fb94180f5&ecomp=gdgg&earg=5506aeec-9540-4837-89f0-5a1acfd81d8b#.

[6] Supra note 4.

[7] Sigma-Tau Pharms. v. Schwetz, 288 F.3d 141, 148, https://plus.lexis.com/document?crid=7d2a2b00-13ad-4953-968e-82a28724aa00&pddocfullpath=%2Fshared%2Fdocument%2Fcases%2Furn%3AcontentItem%3A45RF-5H50-0038-X1PB-00000-00&pdsourcegroupingtype=&pdcontentcomponentid=6388&pdmfid=1530671&pdisurlapi=true.

[8] Supra note 1.

[9] 21 CFR 201.5, https://plus.lexis.com/document/?pdmfid=1530671&crid=e02a99fb-be65-4525-b83c-a167f3e21b93&pddocfullpath=%2Fshared%2Fdocument%2Fadministrative-codes%2Furn%3AcontentItem%3A603K-BXD1-DYB7-W30Y-00000-00&pdcontentcomponentid=5154&pdworkfolderlocatorid=NOT_SAVED_IN_WORKFOLDER&prid=ff2b7e20-9dab-49b0-8385-627c16ee0ba2&ecomp=vfbtk&earg=sr2.

[10] 21 CFR 801.4, https://plus.lexis.com/document/?pdmfid=1530671&crid=721a586d-52a4-4228-b0c3-c464a77d6e6a&pddocfullpath=%2Fshared%2Fdocument%2Fadministrative-codes%2Furn%3AcontentItem%3A638R-X4S3-GXJ9-32FV-00000-00&pdcontentcomponentid=5154&pdworkfolderlocatorid=NOT_SAVED_IN_WORKFOLDER&prid=ff2b7e20-9dab-49b0-8385-627c16ee0ba2&ecomp=vfbtk&earg=sr6.

[11]  Supra note 4.

[12] Id.

[13]   Supra note 7.

[14]   Supra note 4.

[15]  Id.

[16] Supra note 4, at 981.

[17] ​​Kaspar J. Stoffelmayr, Products Liability And “Off-label” Uses Of Prescription Drugs, 63 U. Chi. L. Rev. 275, 279, https://plus.lexis.com/document?crid=a2181ffc-7f3e-4bce-b82e-08ba9111194f&pddocfullpath=%2Fshared%2Fdocument%2Fanalytical-materials%2Furn%3AcontentItem%3A3S3V-4CF0-00CV-K03W-00000-00&pdsourcegroupingtype=&pdcontentcomponentid=7358&pdmfid=1530671&pdisurlapi=true.

[18]  Id.


New Congressional Bill to Fuel the Crypto Winter?

Shawn Zhang, MJLST Staffer

Cryptocurrency has experienced rapid growth over the past few years. Retail investors rushed into this market in hopes of amassing wealth. However, the current price of Bitcoin is sitting at roughly 30% of the all-time high. Investors dub this current state of the market as the “Crypto Winter”, where the entire crypto market is underperforming. This term signifies the current negative sentiment held by a large portion of the market towards cryptocurrency.

Cryptocurrency is a relatively new class of assets, bearing similarities to both currency and securities. Regulators are not quite sure of how to regulate this volatile market, and with the lack of regulations investors are more prone to risk. Nevertheless, legislators are still seeking to protect retail investors and the general public from risky investments, as they did with the 1933 Securities Act and 1934 Securities Exchange Act. The question is how? Well, the answer may be The Lummis-Gillibrand Responsible Financial Innovation Act which has recently been introduced into Congress. This bill seeks to “provide for responsible financial innovation and to bring digital assets within the regulatory perimeter.” If passed, this bill would address those concerns investors currently have with investing in the volatile crypto market.

Summary of the Bill

This legislation would set up the regulatory landscape by granting the Commodity Futures Trading Commission (CFTC) exclusive jurisdiction over digital assets, subject to several exclusions. One of the exclusions being that when the asset is deemed a security, the Securities and Exchange Commission (SEC) will gain jurisdiction and providers of digital asset services will then be required to provide disclosures. The bill would also require the Internal Revenue Service to issue regulations clarifying issues of digital assets and eliminate capital gains taxes through a de minimis exclusion for cryptocurrencies used to buy up to $200 of goods and services per transaction. Moreover, it would also allow crypto miners to defer income taxes on digital assets earned while mining or staking until they dispose of the assets.

Commodity vs Security

So, what’s the difference between CFTC and SEC? The CFTC governs commodities and derivatives market transactions, while the SEC governs securities. The key difference that these classifications make are the laws under which they operate. The CFTC was created under the 1936 Commodities Exchange Act, while the SEC was created under the 1933 Securities Act and 1934 Securities Exchange Act. Hence, giving the CFTC primary jurisdiction means that cryptocurrency will primarily be governed under the 1936 Commodity Exchange Act. The biggest advantage (or what one may think of as a disadvantage) of this Act is that commodities are generally more lightly regulated than securities. Under the 33’ act and 34’ act, securities are thoroughly regulated via disclosures and reports to protect the public. Issuers of securities must comply with a large set of regulations (which is why IPOs are expensive). This could be a win for crypto, as crypto was intended to be “decentralized” rather than heavily regulated. Though having some regulations may help invoke public trust in this class of assets and potentially increase the total number of investors, which may be a bigger win.

The question ends up being what level of regulation and protection is appropriate? On the one hand, applying heavy handed regulations may not be effective, and in fact might encourage black market activity. This may lead to tech savvy investors detaching their real life identity from the world of crypto and using their money elsewhere through the blockchain networks. On the other hand, investors hate uncertainty. Markets react badly when there is “fear, uncertainty, and doubt.” By solidifying the jurisdiction of CFTC on cryptocurrency, both investors and issuers may feel more at ease rather than wonder what regulations they must follow. As a comparison, oil, gold, and futures are also regulated by the CFTC rather than the SEC, and they seem to be doing fine on the exchanges.

Tax Clarifications & Incentives

Clarifications are always welcome in the complex world of federal taxes. Uncertainty can result in investors avoiding a class of assets purely due to the complexity of its tax consequences. Moreover, investors may be unexpectedly hit with a tax bill that was different from what they expected due to ambiguity or lack of clarity in the statutes. Thus, clarifications under the proposed Act would likely make lives easier for investors in this space.

Tax often incentivizes certain investor actions. For example, capital gains tax incentivizes investors to hold their investments for longer than a year in order to reduce their taxes. Tax incentives also often have policy rationales behind them, like the capital gain tax incentive aims to promote long term investment rather than short term speculation. This indirectly protects investors from short term fluctuations in the market, and also keeps more money in the economy for longer.

The proposed Act would eliminate capital gains tax for crypto used to purchase goods and services up to $200. That’s $200 of untaxed money that could be spent without increasing an investor’s tax liability. This would likely encourage people to conduct at least some transactions in crypto, and thus further legitimize the asset class. People often doubt the real world use of cryptocurrencies, but if this Act can encourage people to utilize and accept cryptocurrencies in everyday transactions, it may increase confidence in the asset class.

Conclusion

The Lummis-Gillibrand Responsible Financial Innovation Act could be a big step towards further adoption and legitimization of crypto. Congress giving primary jurisdiction to the CFTC is likely the better choice, as it strikes a balance between protecting consumers while not having too much regulation. Regardless of whether this will have a positive impact on the current market or not, Congress is at least finally signaling that they do see Crypto as a legitimate class of asset.


It’s Social Media – A Big Lump of Unregulated Child Influencers!

Tessa Wright, MJLST Staffer

If you’ve been on TikTok lately, you’re probably familiar with the Corn Kid. Seven-year-old Tariq went viral on TikTok in August after appearing in an 85-second video clip professing his love of corn.[1] Due to his accidental viral popularity, Tariq has become a social media celebrity. He has been featured in content collaborations with notable influencers, starred in a social media ad for Chipotle, and even created an account on Cameo.[2] At seven-years-old, he has become a child influencer, a minor celebrity, and a major financial contributor for his family. Corn Kid is not alone. There are a growing number of children rising to fame via social media. In fact, today child influencers have created an eight-billion-dollar social media advertising industry, with some children generating as much as $26 million a year through advertising and sponsored content.[3] Yet, despite this rapidly growing industry, there are still very few regulations protecting the financial earnings of children entertainers in the social media industry.[4]

What Protects Children’s Financial Earnings in the Entertainment Industry?

Normally, children in the entertainment industry have their financial earnings protected under the California Child Actor’s Bill (also known as the Coogan Law).[5] The Coogan Law was passed in 1939 by the state of California in response to the plight of Jackie Coogan.[6] Coogan was a child star who earned millions of dollars as a child actor only to discover upon reaching adulthood that his parents had spent almost all of his money.[7] Over the years the law has evolved, and today it upholds that earnings by minors in the entertainment industry are the property of the minor.[8] Specifically, the California law creates a fiduciary relationship between the parent and child and requires that 15% of all earnings must be set aside in a blocked trust.[9]

What Protections do Child Social Media Stars Have? 

Social media stars are not legally considered to be actors, so the Coogan Law does not apply to their earnings.[10] So, are there other laws protecting these social media stars? The short answer is, no. 

Technically, there are laws that prevent children under the age of 12 from using social media apps which in theory should protect the youngest of social media stars.[11] However, even though these social media platforms claim that they require users to be at least thirteen years old to create accounts on their platforms, there are still ways children end up working in content creation jobs.[12] The most common scenario is that parents of these children make content in which they feature their children.[13] These “family vloggers” are a popular genre of YouTube videos where parents frequently feature their children and share major life events; sometimes they even feature the birth of their children. Often these parents also make separate social media accounts for their children which are technically run by the parents and are therefore allowed despite the age restrictions.[14] There are no restrictions or regulations preventing parents from making social media accounts for their children, and therefore no restriction on the parents’ collection of the income generated from such accounts.[15]

New Attempts at Legislation 

So far, there has been very little intervention by lawmakers. The state of Washington has attempted to turn the tide by proposing a new state bill that attempts to protect children working in social media.[16] The bill was introduced in January of 2022 and, if passed, would offer protection to children living within the state of Washington who are on social media.[17] Specifically, the bill introduction reads, “Those children are generating interest in and revenue for the content, but receive no financial compensation for their participation. Unlike in child acting, these children are not playing a part, and lack legal protections.”[18] The bill would hopefully help protect the finances of these child influencers. 

Additionally, California passed a similar bill in 2018.[19] Unfortunately, it only applies to videos that are longer than one hour and have direct payment to the child.[20] What this means is that a child who, for example, is a Twitch streamer that posts a three-hour livestream and receives direct donations during the stream, would be covered by the bill; however, a child featured in a 10-minute YouTube video or a 15-second TikTok would not be financially protected under the bill.

The Difficulties in Regulating Social Media Earnings for Children

Currently, France is the only country in the world with regulations for children working in the social media industry.[21] There, children working in the entertainment industry (whether as child actors, models, or social media influencers) have to register for a license and their earnings must be put into a dedicated bank account for them to access when they’re sixteen.[22] However, the legislation is still new and it is too soon to see how well these regulations will work. 

The problem with creating legislation in this area is attributable to the ad hoc nature of making social media content.[23] It is not realistic to simply extend existing legislation applicable to child entertainers to child influencers[24] as their work differs greatly. Moreover, it becomes extremely difficult to attempt to regulate an industry when influencers can post content from any location at any time, and when parents may be the ones filming and posting the videos of their children in order to boost their household income. For example, it would be hard to draw a clear line between when a child is being filmed casually for a home video and when it is being done for work, and when an entire family is featured in a video it would be difficult to determine how much money is attributable to each family member. 

Is There a Solution?

While there is no easy solution, changing the current regulations or creating new regulations is the clearest route. Traditionally, tech platforms have taken the view that governments should make rules and then they will then enforce them.[25] All major social media sites have their own safety rules, but the extent to which they are responsible for the oversight of child influencers is not clearly defined.[26] However, if any new regulation is going to be effective, big tech companies will need to get involved. As it stands today, parents have found loopholes that allow them to feature their child stars on social media without violating age restrictions. To avoid these sorts of loopholes to new regulations, it will be essential that big tech companies work in collaboration with legislators in order to create technical features that prevent them.

The hope is that one day, children like Corn Kid will have total control of their financial earnings, and will not reach adulthood only to discover their money has already been spent by their parents or guardians. The future of entertainment is changing every day, and the laws need to keep up. 

Notes

[1] Madison Malone Kircher, New York Times (Online), New York: New York Times Company (September 21, 2022) https://www.nytimes.com/2022/09/21/style/corn-kid-tariq-tiktok.html.

[2] Id.

[3] Marina Masterson, When Play Becomes Work: Child Labor Laws in the Era of ‘Kidfluencers’, 169 U. Pa. L. Rev. 577, 577 (2021).

[4] Coogan Accounts: Protecting Your Child Star’s Earnings, Morgan Stanley (Jan. 10, 2022), https://www.morganstanley.com/articles/trust-account-for-child-performer.

[5] Coogan Law, https://www.sagaftra.org/membership-benefits/young-performers/coogan-law (last visited Oct. 16, 2022).

[6] Id.

[7] Id.

[8] Cal. Fam. Code § 6752.

[9] Id.

[10] Morgan Stanley, supra note 4.

[11] Sapna Maheshwari, Online and Making Thousands, at Age 4: Meet the Kidfluencers, N.Y. Times, (March 1, 2019) https://www.nytimes.com/2019/03/01/business/media/social-media-influencers-kids.html.

[12] Id.

[13] Id.

[14] Id.

[15] Id.

[16] Katie Collins, TikTok Kids Are Being Exploited Online, but Change is Coming, CNET (Aug. 8, 2022 9:00 AM), https://www.cnet.com/news/politics/tiktok-kids-are-being-exploited-online-but-change-is-coming/.

[17] Id.

[18] Id.

[19] E.W. Park, Child Influencers Have No Child Labor Regulations. They Should, Lavoz News (May 16, 2022) https://lavozdeanza.com/opinions/2022/05/16/child-influencers-have-no-child-labor-regulations-they-should/.

[20] Id.

[21] Collins, supra note 19.

[22] Id.

[23] Id.

[24] Id.

[25] Id.

[26] Katie Collins, TikTok Kids Are Being Exploited Online, but Change is Coming, CNET (Aug. 8, 2022 9:00 AM), https://www.cnet.com/news/politics/tiktok-kids-are-being-exploited-online-but-change-is-coming/.