Antitrust Law Daily Wrap Up, PRIVACY—N.D. Ga.: Medical testing lab’s suit against FTC over data security investigation dismissed for lack of jurisdiction, (May 13, 2014)

By Linda O’Brien, J.D., LL.M.

The federal district court in Atlanta lacked jurisdiction over a medical testing laboratory’s suit to enjoin an FTC enforcement action in relation to the agency’s investigation of the laboratory’s data security practices, since the enforcement action was not a final agency action. Thus, the FTC’s motion to dismiss the complaint was granted (LabMD, Inc. v. FTC, May 12, 2014, Duffey, W.).

LabMD is a medical testing laboratory that provides cancer detection services to physicians. In 2010, the FTC began an investigation into the laboratory’s data security practices. Subsequently, the Commission filed administrative complaint, alleging that in two separate incidents LabMD failed to protect the security of consumers’ personal data in violation of the FTC Act. The laboratory’s billing information for over 9,000 consumers was found on a peer-to-peer file-sharing network, and LabMD documents containing sensitive personal information of at least 500 consumers were found in the hands of identity thieves. LabMD’s motion to dismiss the administrative complaint was denied and the claims were referred to an administrative law judge (ALJ) for an evidentiary hearing.

LabMD filed suit against the FTC, seeking to enjoin the enforcement action on the grounds that the FTC action was arbitrary and capricious under the Administrative Procedures Act (APA). LabMD alleged that the FTC exceeded its statutory authority by regulating LabMD’s data security practices and its application of the FTC Act to LabMD’s data security practices violated the Due Process of the U.S. Constitution. The FTC moved to dismiss the complaint.

Final agency action. The court found that the FTC’s denial of LabMD’s motion to dismiss the administrative complaint was not a final agency action. Under the APA, an agency action is reviewable by a final agency action for which there is no other adequate remedy in court. An agency action is considered final when the action (1) ends the agency’s decision making process and must not be interlocutory in nature, and (2) must be one by which the rights and obligations have been determined and legal consequences will flow.

LabMD’s challenge of the FTC’s statutory or constitutional authority to conduct an investigation or bring an enforcement action did not allow the plaintiff to avoid administrative review or procedures, according to the court. The possibility that LabMD may prevail on the merits if the ALJ or FTC concludes that the laboratory did not violate the FTC Act will render its judicial action moot and make it unnecessary for the court to intervene. Moreover, the court noted that any expenses or burdens associated with LabMD’s complying with the FTC’s information requests and submitting to an administrative proceeding did not constitute an irreparable harm or provide a basis upon which to grant relief.

Finally, absent a final agency action, LabMD’s constitutional claims were not ripe for judicial review, according to the court. The exception to the rule that federal courts typically lack jurisdiction to enjoin an ongoing administrative proceeding did not apply since the FTC’s application of the FTC Act to the data security practices of a private company was not contrary to an unambiguous and mandatory provision of a federal statute, the court concluded.

The case is No. 1:14-cv-00810-WSD.

Attorneys: Burleigh Lavisky Singleton (Kilpatrick Townsend & Stockton, LLP) for LabMD, Inc. Lauren E. Fascett, U.S. Department of Justice, for the FTC.

Companies: LabMD, Inc.

Cases: Privacy GeorgiaNews