LabMD is back in the news. This time, however, it’s not the FTC’s administrative action against LabMD that’s making headlines. (For information about the administrative action, please see our prior posts here and here.) Instead, LabMD’s federal court actions against the FTC – one in the United States Court of Appeals for the Eleventh Circuit and one in United States District Court for the District of Columbia – are now making news. Both have recently been dismissed. This means that, at least for now, the FTC’s administrative action will likely settle the parties’ disputes.
The Eleventh Circuit Case
In an unusual move, LabMD filed a petition in the Eleventh Circuit entitled “Petition for Review of Unlawful Federal Trade Commission Attempt to Regulate Patient-Information.” LabMD, Inc. v. Federal Trade Commission, No. 13-15267-F (11th Cir.). This petition asked the Eleventh Circuit to review the FTC’s administrative action because LabMD believed it was “an unlawful attempt to regulate patient-information data security in excess” of the FTC’s “jurisdiction under 15 U.S.C. § 45.” In response to this unusual petition, the Eleventh Circuit asked the parties to address whether the Eleventh Circuit had jurisdiction at this juncture. After considering the parties’ briefing, the Eleventh Circuit held that it did not have jurisdiction to decide the petition and therefore dismissed it. The Eleventh Circuit first held that it did not have jurisdiction to hear the case under 15 U.S.C. § 45(c), which allows appellate courts to review FTC orders “to cease and desist from using any method of competition or act or practice.” The Eleventh Circuit, however, could not review the petition under that provision because the FTC had not yet issued a cease and desist order. The Eleventh Circuit also found that it did not have jurisdiction to address the petition under the Administrative Procedures Act (“APA”). Under the APA, an appellate court only has jurisdiction after a district court has considered the claims at issue.
The District Court Case
In the district court action, which raised similar issues as the Eleventh Circuit case, LabMD claimed the FTC does not have power under Section 5 of the FTC Act, 15 U.S.C. § 45, to regulate allegedly inadequate data-security as an “unfair” practice. LabMD claimed this was particularly true for inadequate data security practices related to patient information. LabMD sought an injunction to stop the FTC’s administrative action and a declaration that the FTC does not have jurisdiction “over patient-information data-security practices.” The day after the Eleventh Circuit issued its opinion, LabMD voluntarily dismissed this case without prejudice, meaning LabMD might refile this case in the future.
Written by Zach Neal, Senior Associate, Privacy & Data Security | Alston & Bird LLP