Hunton Retail Law Resource

On May 23, 2017, various Attorneys General of 47 states and the District of Columbia announced that they had reached an $18.5 million settlement with Target regarding the states’ investigation of the company’s 2013 data breach. This represents the largest multi-state data breach settlement achieved to date. 

This past week, several consumer protection actions made headlines that affect the retail industry.

NAD Recommends Kauai Coffee Discontinue and Modify Compost Claims

This week, NAD released their recommendations in their review of Kauai Coffee’s environmental claims for their single-serve coffee pod products. Kauai Coffee’s ads claim that the pods are “100% compostable,” but fail to clearly disclose that the pods are certified compostable only in industrial composting facilities, and are not suitable for home composting. While the pods are certified compostable by the Biodegradable Products Institute (“BPI”), BPI specified in its certification of the pods that they will disintegrate “swiftly and safely in a professionally managed composting facility.” NAD recommended that Kauai Coffee discontinue certain claims, and modify others to include the qualifying language: “Compostable in industrial facilities. Check locally, as these do not exist in many communities. Not certified for backyard composting.” Kauai Coffee said it will comply with NAD’s recommendations.

A year ago, the United States Supreme Court held in Spokeo, Inc. v. Robins that a plaintiff must do more than plead a mere statutory procedural violation to establish standing; to plead an injury in fact, a plaintiff also must allege a harm that is both “concrete” and “particularized.” Two recent decisions by the U.S. Court of Appeals for the Eleventh Circuit—one involving a rare written dissent from the denial of a petition for rehearing en banc—demonstrate the continuing difficulties courts are facing in determining what constitutes a concrete injury under Spokeo. They suggest that the Eleventh Circuit is most likely to find standing for violations of statutes that are intended to protect personal privacy or create a right to information, although judges do not always agree as to which statutes fall within these categories.

As we previously reported, beginning last Friday, and still occurring today, one of the worst and most widespread malware attacks has impacted more than 200,000 victims in at least 150 countries, including Britain’s National Health Service, FedEx, telecommunications companies Telefonica and Megafon, and automakers Renault and Nissan. The malware, known as "WannaCry," disables the user’s computer system and all of its data. A note in a text file then appears stating that in order to unlock the computer, $300 worth of the digital currency bitcoin must be paid to the hackers. A countdown timer appears and the fee increases with time. The hackers threaten to delete all data on the computer system if payment is not sent within one week. Cybersecurity experts believe that the malware was sent to computers through "phishing attacks," which are emails that appear to be from reputable sources and include a download to a link that allows the malware to infect the computer. From these computers, the malware then spreads to other computers on the network. One infected computer can spread this virus network-wide, and quickly.

On May 12, 2017, a massive ransomware attack began affecting tens of thousands of computer systems in over 100 countries. The ransomware, known as “WannaCry,” leverages a Windows vulnerability and encrypts files on infected systems and demands payment for their release. If payment is not received within a specified time frame, the ransomware automatically deletes the files. A wide range of industries have been impacted by the attack, including retailers and other businesses, hospitals, utilities and government entities around the world.

This past week, several consumer actions made headlines that affect the retail industry.

The NAD Refers Sports Drink Maker to FTC

The NAD has referred BA Sports Nutrition, the maker of BodyArmor sports drinks, to the FTC after the advertiser failed to alter certain comparative ads. The ad at issue implores customers to “Ditch artificial Sports Drink[s]: artificial flavors, artificial sweeteners, artificial colors” and depicts a bottle of a competing sports drink. The NAD found that the ad implied that the competing sports drink contained artificial flavors, sweeteners and colors when, in fact, many of the competitor’s sports drinks did not.

On May 2, 2017, the United States Court of Appeals for the Second Circuit issued a summary order affirming dismissal of a putative data breach class action against Michaels Stores, Inc. (“Michaels”). The plaintiff’s injury theories were as follows: (1) the plaintiff’s credit card information was stolen and twice used to attempt fraudulent purchases; (2) the risk of future identity fraud and (3) lost time and money resolving the attempted fraudulent charges and monitoring credit. The plaintiff, however, quickly cancelled her card after learning of the unauthorized charges and did not allege that she was held responsible for any of those charges.

This past week, several consumer actions made headlines that affect the retail industry.

FTC Action Forces Advertiser to Withdraw Claims Regarding Efficacy of Herbal Opioid Cure

The FTC has settled charges against the sellers of the herbal remedies “Withdrawal Ease” and “Recovery Ease,” which claimed to alleviate symptoms of opioid addiction. According to the complaint, Catlin Enterprises and the founder/CEO claimed their products significantly increased the likelihood of a person overcoming opiate dependency. The FTC’s complaint alleged that these claims were unfair and deceptive and were unsubstantiated by clinical studies. The defendants also allegedly misrepresented that clinical studies proved Withdrawal Ease’s effectiveness.

Recently, in a case that should remind retailers and their suppliers to consider their First Amendment rights as they relate to the regulation of product labeling, the Eleventh Circuit Court of Appeals held in Ocheesee Creamery LLC v. Putnam, 851 F.3d 1228, that the actions of the Florida Commissioner of Agriculture and the Chief of the Florida Bureau of Dairy Industry (the “State”) violated the dairy company’s First Amendment rights relating to use of the term “skim milk.”

April served as a microcosm for recent trends in the world of recalls. A gas range manufacturer agreed to pay a $4.65 million civil penalty to the CPSC. In a six-year period, the manufacturer received 170 incident reports that the gas ranges had turned on spontaneously and could not be turned off using the control knobs. But the manufacturer knowingly failed to notify the CPSC immediately. The manufacturer agreed to pay the massive penalty, maintain an enhanced compliance program and maintain a related system of internal controls and procedures.

This past week, several self-regulatory actions made headlines that affect the retail industry.

NAD Finds Sherwin-Williams Claims Don’t Require Substantiation

In a challenge brought by Rust-Oleum Corporation, the NAD concluded that Sherwin Williams’s ads for its “CoverMaxx” spray paints did not require substantiation because they did not communicate a message of superior paint coverage. The NAD also found that the name, “CoverMaxx,” did not require revision because there was no reliable extrinsic evidence of consumer confusion.

The FDA has announced that it will officially delay the compliance date for its Menu Labeling Rule (the “Rule”) to May 7, 2018, in order to consider how to further reduce the regulatory burden or increase flexibility while continuing to achieve regulatory objectives. Among other concerns, the FDA notes that retailers have raised concerns that the Rule lacks flexibility to permit the provision of meaningful nutrition information to consumers in innovative formats.