Court Rules that Lawyers Are not Subject to Gramm-Leach-Bliley ActMay 2004 | Privacy In Focus
Lawyers again escaped regulation under the Gramm-Leach-Bliley Act (G-L-B) as U.S. District Judge Reggie B. Walton granted summary judgment against the Federal Trade Commission (FTC), concluding, as a matter of law, that "Congress did not intend for the G-L-B’s privacy provisions to apply to attorneys who provide legal services in the fields of real estate settlement, tax-planning and tax preparation." Rejecting the Commission’s fall-back request to remand "for a more complete explanation," Judge Walton, instead, "declared and decreed" that the agency decision to assert jurisdiction over lawyers is "beyond the FTC’s statutory authority" and "is an arbitrary and capricious agency action." Whether the FTC will appeal is not yet clear.
Judge Walton’s April 30, 2004 decision in actions brought by the New York State Bar Association (D.D.C. No. 02-810) and the American Bar Association (No. 02-1883) relied primarily on his August 11, 2003 opinion denying the FTC’s motions to dismiss.New York State Bar Ass’n v. FTC, 276 F.Supp.2d 110 (D.D.C. 2003). That decision was reached before the agency record was submitted to the court and left open the possibility that the record might justify, or provide a basis for judicial deference to, the Commission’s assertion of jurisdiction and refusal to grant exemptions sought by numerous bar associations. See August 2003Privacy In Focus. However, it turned out that the record included little more than bar association correspondence and the Bureau of Consumer Protection Director Howard Beales’ April 8, 2002 letter asserting jurisdiction over lawyers who engage in activities that define a G-L-B "financial institution" and declining to grant any exemption based on lawyers’ confidentiality obligations arising under state bar rules.
In that context, the bar associations’ motion sought conversion of the August 2003 opinion to a final disposition, contending that the FTC "raises no legal arguments that the Court has not previously and thoroughly considered." The FTC’s cross-motion viewed the matter similarly, urging the "Court to reconsider its August 11, 2003 Memorandum Opinion and Order." The FTC did not present any newly discovered evidence (the scant record changed nothing previously assumed) and presented no new law, relying principally on restatements of the legal contentions raised before. Judge Walton was not moved.
Judge Walton’s Decision
Judge Walton ruled that the FTC’s 2002 letter determination was not entitled to deference under Chevron U.S.A., Inc. v. Natural Resources Defense Council, 467 U.S. 837, 842-43 (1984), because it was "made without any degree of deliberation, thoughtful consideration or comments from the public." Similarly, the agency action was "arbitrary and capricious," because the Commission "has failed to articulate any explanation, let alone a satisfactory one, for its interpretation." Judge Walton found the FTC’s arguments presented by brief to be "post hocrationalizations" and rejected them as not a proper "substitute for the reasoned decision making process that an agency must undertake when making the decision itself." Having determined the FTC lacked statutory jurisdiction over lawyers under G-L-B, the Court found it unnecessary to consider whether the Commission acted arbitrarily in refusing to grant the exemptions requested by the bar associations.
The FTC’s basic argument was that G-L-B applies to "financial institutions," which is broadly defined to include "any institution the business of which is engaging in financial activities" described by the Bank Holding Company Act or listed by the Federal Reserve Board, which include "real estate settlement services" and providing "tax planning and tax-preparation services to any person." When lawyers provide such services, the FTC contended, they are covered and must send privacy notices and meet other G-L-B requirements. Thus, the FTC’s strategy was to focus on the jurisdictional provision, demonstrate that lawyers performing certain services fall within its broad terms, and conclude that was sufficient to establish G-L-B applicability. Judge Walton rejected that approach, reasoning instead that (1) G-L-B was not designed to address abuses by lawyers (but rather what banks and similar businesses might do with personal information given the broadened scope of their business activities authorized by G-L-B) and (2) Congress would not likely have made changes in the long-standing state-based confidentiality regime governing lawyers without making very clear that it intended to do so.
Courts decide cases following both of those interpretative approaches. For example, in Doe v.Chao, 124 S.Ct. 1204 (2004), the U.S. Supreme Court narrowly construed the Privacy Act remedy based primarily on analysis of the text of its remedial paragraph. By contrast, in FDA v. Brown & Williamson Tobacco Co., 120 S.Ct. 1291 (2000), the Court refused to be guided by the broad scope of the statutory definition of "drug" and looked instead to the structure of the Federal Food, Drug and Cosmetic Act and prior Congressional tobacco-specific actions to conclude that Congress had not granted the Food and Drug Administration jurisdiction over tobacco products. Reliably forecasting when a court will apply one of these analytical approaches, rather than the other, can prove quite challenging. However, if Judge Walton’s conclusion prevails, the Commission faces additional G-L-B enforcement obstacles.
Future Problems for Both Sides
If lawyers as a state-regulated group fall outside the reach of G-L-B, then so too might other groups that are state-regulated as to the confidentiality or marketing use of personal information and not expressly noted by Congress as targeted for G-L-B coverage. Additionally, Judge Walton’s August 2003 opinion questioned whether lawyers could properly be regarded as "institutions" within the meaning of the G-L-B definition of financial institution. That language will open the way for small businesses, particularly unincorporated individuals, to contend they are not "institutions," and consequently, are not covered.
The news may not all be good for lawyers either. The FTC argued that one reason G-L-B coverage should be found is that G-L-B regulation would expand the protections enjoyed by lawyers’ clients, for example, by requiring lawyers "to design and implement safeguards to protect customer information, including appropriate safeguards relating to information systems, such as network and software design, to protect against unauthorized access to confidential customer information." The bar associations responded that such duties already exist under the ABA Model Rules and, specifically, both "the state ethics rules and the G-L-B safeguards rules essentially require the implementation of whatever measures are appropriate in the circumstances." While Judge Walton’s April 30, 2004 opinion did not mention this issue, the expressed positions of the parties can be cited by others in other settings contending that lawyers have extensive data safeguard duties arising under their codes of ethics.
For more information, please contact Bruce L. McDonald (202.719.7014 or ).
RECENT NEWSDOE Seeks Input on Potential Efficiency Rules for Computer and Battery Backup Systems
Wiley Rein Hosts 12th Annual “Law Day” for Thurgood Marshall Academy Students
Wiley Rein Partner David A. Gross Begins Term as Federal Communications Bar Association President