Second Circuit Upholds FCC Forfeiture After Identifying Delegation of Discretionary Authority as Required Under Loper Bright

Last week, in Verizon Communications Inc. v. Federal Communications Commission, the Second Circuit rejected a petition for review of a forfeiture order imposing nearly $47 million in penalties for violation of the confidentiality provisions of the federal Communications Act.  In doing so, the Circuit offered an important example of how courts will apply the de novo standard of review required by Loper Bright Enterprises v. Raimondo, as well as the limits of that standard when it is clear the best reading of a law is that it delegates some discretionary authority to an agency.

The FCC and the Communications Act

Under the Communications Act, the Federal Communications Commission (“FCC”) is responsible, among other things, for ensuring that telecommunications carriers respect the confidentiality of their customers’ proprietary information.  To that end, the agency has the power to impose monetary forfeitures on carriers who breach this duty of confidentiality.

For years, Verizon’s “location-based services” program sold access to customer device-location data to third-party aggregators, who could repackage the data for various uses ranging from roadside assistance to marketing.  In May 2018, the New York Times published an article exposing various security breaches in Verizon’s program, including the fact that one aggregator had been offering law-enforcement officers access to customer-location data without those customers’ knowledge or consent, at least so long as the officials claimed to have a warrant or legal authorization.  That information sharing was outside the scope of the aggregator’s approved use.  Even more worryingly, the aggregator did not even review the purported legal authorizations uploaded by law enforcement, thus depriving Verizons’ customers of any legal process.

The New York Times’s reporting prompted Verizon and other companies to terminate or limit their location-data programs.  But developments also caught the attention of the FCC’s Enforcement Bureau, which served Verizon with a notice of apparent liability under the Communications Act.  The FCC imposed a $46.9 million penalty, which Verizon paid before filing a petition for review in the Second Circuit.  Verizon advanced several arguments in court, including its principal objection that the Act’s definition of “customer propriety network information” only covered call-location data, but not customers’ device-location data.  Verizon also argued the FCC’s forfeiture order violated statutory limits on penalties.

The Second Circuit’s Decision Applying Loper

The Verizon court confirmed Loper Bright’s central holding that courts must interpret statutes de novo, without any deference to an agency’s construction.  And its approach to the question of whether the Communications Act only protected customers’ call-location data—that is, “data concerning voice plans” rather than all data collected as part of the carrier-customer relationship—reflects the sort of text-based approach anticipated by the Loper Bright court.

Past caselaw construing key phrases, such as “relating to,” as well as broader statutory context and legislative purpose buttressed the Circuit’s holding.  To the extent legislative history might have been relevant—which Verizon tried to argue—the Second Circuit concluded that history was “inconclusive at best and, in any event [could not] override the statute’s plain meaning.” 

The Verizon court’s separate handling of whether the Communications Act limited the FCC’s forfeiture order is not only more interesting but also more important for understanding how Loper Bright is being applied in the lower courts.  Under the Act, Congress has set maximum forfeiture amounts.  For any given continuing violation, the FCC may impose a penalty of up to $200,000 per day, so long as the aggregate total does not exceed $2 million.  Here, the FCC concluded Verizon engaged in sixty-three continuing violations, or “one for each ongoing relationship with a third-party . . . provider or aggregator.”  Yet Verizon insisted it only committed a single violation in maintaining “one set” of flawed policies.  The interpretive question disputed by the parties, accordingly, was whether the FCC was statutorily permitted to conclude there had been distinct and multiple violations arising from the same set of facts, or whether it was limited to prosecuting an overarching “single act or failure to act.”    

The Circuit ultimately explained Verizon had misframed the interpretive question.  Citing Loper Bright, the Verizon court reiterated that, sometimes “the best reading of a statute is that it delegates discretionary authority to an agency.”  In these cases, a court’s review is limited to ensuring the “agency has engaged in reasoned decisionmaking” within the “boundaries” of Congress’s delegation.  The Communication Act’s phrase “single act or failure to act” is precisely the sort of capacious language that represents a delegation of discretionary authority:

To put it differently, for the Verizon court, neither party disputed the objective meaning of a “single act.”  The parties’ disagreement hinged on whether, given the facts, Verizon’s actions (or omissions) vis-à-vis breaches arising from its location-based services program were properly characterized as a “single act” or multiple “acts,” each of which could give rise to a distinct forfeiture penalty.  That fight, however, implicated the FCC’s discretionary authority and therefore had to be considered under the APA’s relatively deferential arbitrary-and-capricious standard.  And the Second Circuit did conclude the FCC’s forfeiture order passed muster.

So What?

The Verizon decision provides useful insight into how courts are likely to interpret the Supreme Court’s caveat in Loper Bright that, sometimes the best reading of a law is that it delegates discretion to an agency.  Verizon also demonstrates how such discretion can be exercised not just in the rulemaking context—say, with regulatory definitions that flesh out the details of statutory scheme—but also with enforcement proceedings.  Finally, the Second Circuit’s opinion helps illustrate how, once a “Loper Bright delegation” is at hand, the appropriate approach for courts is to conduct “hard look” review under the APA’s arbitrary-and-capricious standard.