If your company has received a civil investigative demand, or CID, from the Federal Trade Commission (FTC), it means that the agency thinks that you have information that is relevant to an ongoing investigation. Whether you are the target of the FTC investigations or not, you still need to take precautions to protect your company from some significant legal liability because an FTC investigation has the potential to lead to civil or criminal charges.

How Does the FTC Use CIDs?

Before reviewing how to best respond to one, it is helpful to understand what civil investigative demands are, and how the Federal Trade Commission (FTC) uses them to enforce the law against unfair and deceptive business practices. 

A civil investigative demand (CID) is a formal request for information by a law enforcement agency. This makes it an administrative subpoena that can demand information like:

• Testimony from a particular person about a particular subject

• Documents

• Computer files

• Physical evidence

A CID is backed up by the threat of legal sanctions, in the form of criminal contempt charges, for non-compliance. However, because the demand for information comes from the agency and not a court, the agency does not need to prove probable cause to send one.

Not all law enforcement agencies have the power to file these potent requests for information. The FTC is one of the few that can: 15 U.S.C. § 57b-1 is its Congressional authority to use CIDs to obtain evidence in its cases. The FTC civil investigative demands (CIDs) cite the Federal Trade Commission Act or other laws and rules that may have been violated.

The FTC uses this power to gather information about a host of unfair and deceptive business practices, including:

• Identity theft

• Cold call scams

• Investment fraud scams

• Mail and wire fraud

• Consumer data privacy

• Antitrust violations and anticompetitive mergers and acquisitions 

What are the Best Ways to Respond to a CID from the FTC?

The best defense strategy to adopt after receiving a civil investigative demand (CID) from the Federal Trade Commission (FTC) will depend on your particular circumstances, the specific requests made in the CID, and your company’s interests and long-term goals. 

However, there are some basic decisions and maneuvers that are usually wise to make.

Implement a Legal Hold

One of the most important first steps to take is to impose a legal hold on your company. This stops all data deletion and ensures that any documents that you have at the time of the CID’s receipt are still in existence when the time comes to disclose them. This avoids a situation where the FTC demands files that are then deleted or overwritten by your standard data retention policies.

The FTC will not care that the files were scheduled for deletion. It will only view the outcome as spoliation, or potentially even as obstruction of justice.

Determine Who is Being Investigated

The FTC has the power to file a CID to gather documents that are relevant to any investigation that is currently ongoing. The investigation does not have to target you for you to be on the receiving end of an onerous demand. 

However, the terms of the CID will rarely explicitly say if you are the target of the investigation or not. You often have to read between the lines and look at the surrounding context to find out.

Making an educated guess as to whether it is your company or someone else that is under FTC investigation is important, though. You should always be careful when dealing with law enforcement agencies. But if you are under investigation it is even more important to aggressively defend your rights. 

Gather Documents Quickly So You Have Time to Review Them

The CID will have deadlines for compliance. Gathering and submitting the disclosure package to comply with the CID at the last minute, though, is unwise.

As Dr. Nick Oberheiden, from the FTC defense law firm Oberheiden P.C., says, “You always want to review the information you have collected before handing it over to the FTC. This gives you an opportunity to find out if there is any potentially incriminating information in the disclosure package. If there is, you may be able to justifiably hold on to it as privileged from disclosure in some way, like under the attorney-client privilege. If that is not an option, you can get ahead of the upcoming issue by explaining to the FTC why it is not something to investigate. Neither of these defense strategies is an option if you do not have the time to review the disclosure before sending it along.”

Consider Challenging the CID

Especially if it appears that you are under investigation by the FTC, you may want to challenge the issuance or the scope of the CID. The motion to quash or limit the CID, though, is filed with the FTC, itself, which generally means that the motion will get denied. Taking the denial to court often leads to a strong judicial preference to let agency actions go undisturbed: Courts will only quash or limit the CID if it exceeded the agency’s authority, the agency did not follow the right procedures, or if the information requested is irrelevant or immaterial to an investigation.

Nevertheless, it can still be a good move to go through these legal maneuvers. If you do not take these steps, your defense that the CID exceeds the FTC’s powers or that it is too broad may be deemed to be waived by the court hearing your case down the road.

Taking this step has to be done right away, though. Under 16 C.F.R. § 2.10 you only have 20 days to file a motion to quash or limit a CID issued by the FTC.

What are the Worst Ways to Respond?

Adopting a good response to a CID is important. It is perhaps even more important to
avoid particularly bad responses. Two of the worst are:

1. Not responding, and

2. Over-responding.

If you receive a CID from the FTC and just ignore it, the CID will not go away and you will likely get charged with criminal contempt. This charge carries a fine or jail time until you comply. Those penalties get imposed, and then you will still have to comply with the CID, anyway.

Handing over too many documents – or information that was not requested – can also be a very bad move to make. It might seem tempting: If the CID demands lots of information, it can be enticing to just throw everything at them to save you the time of diligently gathering and sifting through it. However, if you hand over something incriminating that was outside the scope of the CID’s request, you will have walked into a legal liability that you could have easily avoided.