On September 15, 2021, the Federal Trade Commission (FTC) hosted its third open meeting in as many months. The commission adopted the four items on its agenda and FTC staff gave a presentation on its study of acquisitions by digital platforms that were not reported under the Hart-Scott-Rodino Antitrust Improvement Act (HSR). Specifically, the commission adopted a policy statement affirming that certain health apps and connected devices and the unauthorized disclosure of covered information are covered by the FTC's Health Breach Notification Rule, voted to publicly release the FTC's findings on its study of non-HSR acquisitions by digital platforms, approved procedural changes to the FTC's rules concerning petition for rulemaking, and withdrew the 2020 Vertical Merger Guidelines. After the FTC staff's presentation, the commissioners offered their opinions on the deal reporting requirements under the HSR. Finally, the FTC heard from members of the public on a wide range of topics, including issues involving health data, data abuses, interoperability, vertical mergers, and transparency at the FTC.

Interpreting the Health Breach Notification Rule to Include Certain Health Apps and Connected Devices, and Unauthorized Access

The FTC voted 3-2 along party lines to release a policy statement on its Health Breach Notification Rule. The rule, issued by the FTC in 2009, requires vendors of personal health records to notify consumers, the FTC, and in some cases, the media, if there has been a breach of unsecured identifiable health information. The FTC has civil penalty authority to enforce the rule, but as some commissioners noted, has not yet enforced it. The policy statement clarifies the FTC's interpretation that the rule covers privacy breaches involving health apps and connected devices that obtain information from multiple sources, and that covered breaches include incidents of unauthorized access, such as the disclosure of covered information without authorization.

Chair Khan noted the increased adoption of health assistants during the pandemic and stated that digital apps play "fast and loose" with user data. She claimed that many companies mistakenly believe that they are not covered by the Health Breach Notification Rule because they are not covered by the Health Insurance Portability and Accountability Act (HIPAA), a mistake this policy statement is intended to address. The commissioners disagreed along party lines on whether the policy statement is consistent with prior FTC guidance, but Chair Khan insisted that the statement only clarifies, and does not expand, the rule. Commissioners Chopra and Slaughter supported the policy statement and noted the sensitivity of the health information at issue. Commissioner Chopra criticized the commission for not enforcing the rule, arguing that violations of the rule should be alleged in cases like the FTC's recent action against Flo Health.

Commissioners Phillips and Wilson objected to the adoption of the statement. Commissioner Phillips argued that the statement is an end-run around the administrative rulemaking process, is inconsistent with existing FTC guidance, and expands the rule beyond its original meaning. Commissioner Wilson echoed Commissioner Phillips's points and added that the FTC is adopting the statement without considering the implications for the Department of Health and Human Services and the Social Security Administration, both of which are also grappling with this issue. Both commissioners expressed concerns about transparency surrounding the FTC's open meetings and decisions being made at the meetings more generally.

Transparency in Petitions for Rulemaking

Consistent with themes of transparency and public input woven throughout the meeting, the FTC voted 4-1 in favor of changes to its procedural rules concerning petitions for rulemaking. The changes include new guidance on how members of the public can file petitions and on the FTC's procedures once it receives petitions. Every petition received will be made public, have an agency contact, and be open to public comment. Additionally, petitioners will be notified of the FTC's decisions regarding their petitions.

Chair Khan and Commissioners Chopra, Phillips, and Slaughter supported the changes, emphasizing the importance of transparency into what happens after petitions are received by the FTC. Commissioner Chopra added that the revisions are designed to balance the influence of large firms, who he claims have more connections at the agency, with that of small businesses and community groups.

Commissioner Wilson opposed the revisions, and instead proposed adding a disclosure requirement: petitioners would have to disclose who is funding their petitions. The other commissioners supported the idea of the requirement and noted the importance of funding disclosures, but they did not want to vote on the topic before they could conduct additional research. Commissioner Wilson's motion to amend the proposed changes did not go forward, and Commissioner Wilson voted against the underlying revisions to the petition procedures.

Withdrawal of 2020 Vertical Merger Guidelines

In a 3-2 vote along party lines, the FTC voted to rescind the 2020 Vertical Merger Guidelines, which were issued by the U.S. Department of Justice (DOJ) and FTC on June 30, 2020. The guidelines outline how the agencies evaluate the likely competitive impact of vertical mergers. The FTC did not vote to implement new versions of the guidelines. According to Commissioner Slaughter, the FTC will instead be guided by existing law and will not revert to older vertical merger guidelines.

Chair Khan introduced the resolution by stating that the 2020 guidelines took positive steps toward recognizing ways that non-horizontal mergers can harm competition, but that the guidelines contravene statutory text, ignore empirical evidence, and create difficulties for courts attempting to evaluate the procompetitive efficiencies of vertical mergers. Chair Khan stated that the new guidelines will be keyed to empirical evidence instead of "speculative theories." Commissioner Slaughter supported recission, stating that the guidelines provided opportunities for gamesmanship by merging parties. Commissioner Chopra, also supporting recission, added that the new guidelines should focus on analytical rigor and take a harder look at whether, in practice, procompetitive efficiencies truly come to pass and offset long-term harm to competition.

Commissioners Wilson and Phillips objected to rescission, arguing that the FTC failed to seek public input on the decision and is sowing confusion by rescinding the guidelines without issuing new ones. Commissioner Wilson stated that the 2020 guidelines are grounded in empirical evidence and reflect the reality that vertical mergers are less likely to harm consumers than horizontal mergers. Commissioner Phillips added that the DOJ has not yet rescinded the 2020 guidelines, which will result in the two agencies applying different standards.

Implications of Study on Non-Reportable Acquisitions by Digital Platforms

In February 2020, the FTC initiated a study into certain digital platforms' acquisitions between 2010 and 2019 which were not reportable to the FTC and DOJ under HSR. HSR requires companies to report transactions to the agencies for antitrust review if the deals reach certain thresholds. The FTC issued orders under Rule 6(b) to Alphabet, Amazon, Apple, Facebook, and Microsoft to provide information about their non-reportable acquisitions made during the time period. FTC staff presented the study's findings during the September 15 open meeting. The presentation summarized the number and size of the transactions, and highlighted the number of acquisitions that targeted companies younger than five years old and that included non-compete clauses for the acquired companies' founders and key employees.

Chair Khan claimed that the study illustrated the systemic nature of large digital platforms buying, instead of competing with, small rivals. She argued that the study supports closely examining and possibly reforming HSR's reporting requirements. Commissioner Slaughter reiterated Chair Khan's statements, but added that reviewing transactions on a deal-by-deal basis prevents the FTC from seeing the big picture of a company's acquisition behavior.

Commissioner Chopra suggested amending HSR to require the largest firms to report all mergers and acquisitions, even those that fall below the reporting thresholds. He also advocated that the FTC more strongly enforce HSR's prohibition of avoidance devices. Avoidance devices are ways to structure transactions to avoid reporting requirements; Commissioner Chopra pointed to special dividends and "acqui-hires" as types of avoidance devices that the FTC can address through policy and enforcement. He further suggested that this commission's predecessors had a process of "informal interpretations" of HSR—not involving formal votes—which created loopholes in reporting requirements.

Commissioners Slaughter, Wilson, and Phillips noted that the study did not discuss industries other than digital platforms. Commissioner Wilson suggested that healthcare—pharmaceuticals and hospitals, specifically—may have reporting issues that warrant study.

Key Takeaways:

• The FTC withdrew the 2020 Vertical Merger Guidelines without issuing replacement guidelines. The DOJ has not withdrawn the guidelines but has issued a statement that it is conducting a thorough review of both the vertical and horizontal merger guidelines. While there is some uncertainty about the analytical framework under which the agencies will evaluate vertical mergers going forward, it is clear that they will be more aggressive than suggested by the recently-adopted guidelines. There is no timeline for the FTC to issue new guidelines.
• While the commissioners did not adopt any resolutions or confirm any planned changes following the digital platforms' acquisition study, some commissioners did indicate their interest in removing reporting thresholds for the largest firms, closing loopholes purportedly created through informal interpretations, and enforcing the prohibition on avoidance devices. Here again, it is clear that the commission will seek to review more transactions than ever before. The commissioners also suggested that similar non-reportable transaction studies may be warranted for other industries, including healthcare.
• Consistent themes throughout the meeting were transparency in how the FTC reaches decisions and the role of public input. The commission adopted new procedural rules for petitions in order to increase transparency, and it will be looking into mandatory disclosure of who funds petitions.
• Health apps and connected devices should be aware of the FTC's adopted policy statement, which clarifies the FTC's position that certain apps and devices and instances of unauthorized access to covered data are subject to the data breach notification requirements under the FTC's Health Breach Notification Rule, even if they are not covered by HIPAA.
• The FTC heard public comments at the end of the meeting, and many of the comments called for investigations or enforcement actions in various spheres, such as multi-level marketing, pharmaceuticals, hotel franchising, and messaging app interoperability. Commenters also called for the FTC to take action on national supply chain issues, citing the constraints small businesses are currently facing.