Consumer Product Manufacturers Face Reduced Consumer Product Safety Commission Data Protection

Sunday, February 1, 2009 - 01:00

The Consumer Product Safety Improvement Act (CPSIA), signed into law on August 14, 2008, provides the greatest expansion of the Consumer Product Safety Commission's (CPSC's) authority since Congress first established the agency in 1972. The CPSIA gives the CPSC increased staffing and funding, new laboratory facilities, expanded enforcement mechanisms and greater oversight of imported goods, as well as imposing significant new content, testing and reporting requirements on toys and children's products.

Given the short deadlines provided by the CPSIA, regulated industry is currently struggling to comply with the new provisions. Overlooked in the chaos, however, are important changes in the CPSC's traditional data protection rules and the prospective implementation of a consumer complaint database that will allow the public both to post and access consumer allegations of hazards presented by consumer products.

Public Disclosure Of Information Under The Freedom Of Information Act (FOIA) And The Consumer Product Safety Act (CPSA)

Since its creation, the CPSC has provided perhaps the broadest protection for manufacturer data of any federal agency. In addition to the protections provided by the FOIA, section 6(b) of the CPSA precludes the CPSC release of information to the public unless the Commission has determined that such information is accurate and that disclosure is fair under the circumstances and reasonably related to effectuating the purposes of the CPSA. Statute and case law provide additional protections against disclosure of information provided to the CPSC by the manufacturer that would not usually be released to third parties in the normal course of business.

When information is received by the CPSC that identifies a manufacturer or private labeler of a consumer product, the CPSC must provide the information to the manufacturer so it may object to the disclosure of information protected by the FOIA. Responding to the complaints of a number of consumer advocacy groups, the CPSA shortens the time for manufacturers to object to data disclosures and justify withholding of information under the Act. Manufacturers will have only 15 days (reduced from 30) to object to the CPSC's proposed disclosure of information to a third party under the FOIA. That deadline can be woefully inadequate, especially in those cases where hundreds of pages of documents are proposed for disclosure.

Once objections are received by the CPSC, staff reviews the objections and decides whether all, some or none of those documents can legally be disclosed. After such a review produces a decision to disclose information, a manufacturer's only recourse is to file a "reverse FOIA" action in federal district court to prevent release of the documents. Under the CPSIA, manufacturers may be provided as little as five days (reduced from a minimum of ten days) to decide whether to file suit. Such a short deadline will place greater pressure on manufacturers to make legal decisions that may have significant implications, and may well deter court challenges to the CPSC's disclosure decisions.

Sharing Of Information With Other Governmental Agencies

The CPSIA also dramatically broadens the scope of information that may be disclosed to other federal, state, local or foreign government agencies. Previously, the CPSC could only release to federal, state or local agencies copies of accident or investigation reports made by the Commission itself, few if any of which would be protected under section 6(b) or the FOIA. The CPSIA now allows the Commission, upon request, to share any information obtained by CPSC staff, regardless of the protections of section 6(b).

In order to obtain such information, a federal, state or local agency must certify that the information will be maintained "in confidence," that the agency has a bona fide legal basis for its assertion of authority to maintain confidentiality, and that the materials are to be used only for enforcement proceedings applying laws substantially similar to CPSC laws and/or would aid a Commission investigation or enforcement proceeding. Foreign law enforcement agencies may obtain such information with the approval of the Attorney General for offenses covered by a mutual legal assistance treaty. It is currently unclear whether agency certification of confidentiality will encompass the full scope of 6(b) protections.

This expansion in availability of information previously deemed unavailable to other government agencies provides additional potential areas of exposure for consumer product manufacturers. On the domestic front, the CPSIA also provides that state attorneys general may now bring actions against consumer product manufacturers for engaging in certain acts prohibited by the CPSA, including:

• Importation, distribution or sale of any product not in conformity with any consumer product safety rule, regulation, standard, ban or order issued under the CPSA or other laws enforced by the CPSC, or that a manufacturer knew or should have known is the subject of a voluntary recall;

• Failure to furnish a Certificate of General Conformity or, for children's products, a Third-Party Testing Certification required under the CPSIA;

• Stockpiling of products for sale prior to the effective date of a new CPSC rule; or

• Importation, distribution or sale of a product bearing a safety certification mark that the manufacturer knew or should have known was used in a manner not authorized by the certifying body.

States are required to provide 30 days' notice of such suits to the CPSC. In addition, a state may file suit against a product it perceives to be a "substantial product hazard" immediately upon notifying the Commission.

Numerous state attorneys general have become very aggressive in bringing legal actions against industries or companies whose products assertedly pose risks to public health. Providing state attorneys general with enforcement powers under the CPSA increases consumer product manufacturers' risks when there are reports of alleged defects in consumer products.

While foreign governments cannot bring suit against manufacturers in the United States, the new information-disclosure provisions provide them with access to manufacturer documents provided to the CPSC in the course of investigations or voluntary recalls. International manufacturers should be aware that in a number of foreign markets, including Canada, France, the United Kingdom and China, government agencies have become far more aggressive in pursuing manufacturers and distributors of consumer products alleged to pose a public health risk.

A Public Consumer Product-Safety Database

Perhaps the biggest risk to consumer product manufacturers is the requirement that, by no later than August 14, 2011, the CPSC develop and implement a publicly available database on which the agency must post all reports of harm alleged to have been caused by a consumer product received from consumers, local, state or federal government agencies, health care professionals, child service providers and public safety entities. The CPSC will provide manufacturers five business days to provide any comments on a report prior to posting it, which comments will, if the manufacturer wishes, be added to the database. Only trade secrets and information protected by the FOIA will be redacted from such reports. The CPSC must post the information within ten business days of providing notice to the manufacturer. The database will be available to and searchable by the public at large.

While the database will provide manufacturers with yet another source of alleged product defects to monitor, investigate and, where necessary, correct, it could also prove to be a fertile business development source for the trial bar. Much like the pharmaceutical industry, among others, consumer product manufacturers, importers, distributors and retailers may find themselves faced with an increasing number of lawsuits, including potential class action suits, based on a limited number of unproven allegations of injury. This risk stems from the fact that the CPSIA for the first time establishes a private right of action for alleged violations of a consumer product safety rule. Remedies in such suits are limited to injunctive relief and reasonable attorney's and expert witness fees. However, a person who sustains injury due to a knowing or willful violation of a consumer product safety rule may also recover damages. The costs of defending such suits, and the risk of pendant state law unfair trade practice claims may open the door for substantial damage awards.

These new provisions further emphasize the need for every consumer product importer, manufacturer, distributor and retailer to have in place a strong risk-management program that includes:

• Design and manufacturing controls to prevent potential defects;

• Effective quality control monitoring to enable immediate identification, evaluation, review and addressing of consumer complaints alleging injury;

• Regular review by upper management of reports of product damage, breakage or injury that may indicate an emerging problem;

• A strong surveillance program to ensure that complaints received by the company (such as from retailers, retail website comments, media reports and other sources) are identified and addressed; and

• Designated person(s) trained in and charged with evaluating the company's compliance with reporting and other obligations to the CPSC.

William A. McGrath is a Partner with Wiley Rein LLP. He counsels clients on federal and state regulatory and liability issues in the development, safety, advertising and marketing of drugs, medical devices, food and beverages, nutritional supplements, cosmetics and consumer products.

Please email the author at wmcgrath@wileyrein.com with questions about this article.