Summer is always an interesting time for lawyers, because it’s the time of year when the Supreme Court’s term comes to a close and when, typically, they issue their most controversial or difficult rulings. In fact, the Court sometimes waits until the actual last day of the term before handing out the tough, 5-4 split decisions on things like applying the Second Amendment to the states, striking down DOMA, or the boundaries of federalism. But while there is always attention on hot-button issues — the culture wars are deeply ingrained in the legal world — those very rarely have the most important effects on how the law works in this country. Which is why you probably haven’t heard anything about Kisor v. Wilkie, even though it may be the most important decision the Supreme Court reached this year.
Kisor covers a lot of ground and manages to demonstrate that all nine Justices of the Supreme Court are uncomfortable with how federal agencies have been issuing regulations recently. So let’s talk about administrative law, judicial deference, and how Kisor affects privacy regulations!
A Matter of Interpretation
The vast majority of decisions the federal government makes are decisions the agencies issue. They have the power, under a landmark 1946 law called the Administrative Procedure Act (“APA”) to promulgate regulations which are enforceable as law, which is slightly different than saying the regulations are themselves the law, because only Congress can write those. But there isn’t a meaningful difference in what happens if you violate a regulation and a law, and often, the regulations are more detailed, clearer, and more focused than the laws Congress passes. That’s the point, largely: Congress delegates some of its power to an agency staffed, generally, by people with more time and more knowledge of the subject matter.
It’s all very convoluted, largely because Congress is torn between wanting the agencies — staffed by experts — to have leeway to make decisions and needing to maintain control over the legislative process, as required by the Constitution, which is just always getting in the way you guys.
Sometimes, though, the agency doesn’t issue a rule through the formal process outlined in the APA which is lengthy, complicated, and a lot like writing a law. Agencies will, instead, adopt formal interpretations of a law or regulation. This makes sense too, because not every regulation can cover every situation, but private actors need to understand how the law is to be enforced. By publicly adopting an interpretation, the agency can resolve ambiguities or set priorities.
Regulatory interpretation falls into two categories: interpreting a law passed by Congress and interpreting a law the agency itself issued. In the first example, an agency will say something like: “Congress gave us the power to regulate for workplace safety. Although the law itself doesn’t say so, we conclude that the parking lot is included in the scope of the term ‘workplace,’ and so if a business provides a parking lot or garage for its employees, the business must, at its own cost, ensure that the parking area is reasonably safe.”
When an agency interprets a regulation, it looks to ambiguities in a regulation it issued and explains them. So, to continue our example, the agency might say that to satisfy the “reasonably safe” standard, a parking area needs a certain number of lights, or a gate, or video-recording system. Congress still set the broad guidelines (“Make workplaces safe”) and the agency has still followed the formal rulemaking process (“Congress meant that parking lots must be safe, too”), and now the public understands how the agency views both the primary law and the regulation it wrote.
There is a long line of cases that goes back more than seventy years and which sets out the degree to which the courts need to defer to an agency’s interpretation of a law or regulation. Striking that balance is never easy, and even a basic understanding takes up an entire semester of one of the hardest classes in law school, Administrative Law. So, naturally, I’m going to break the primary kinds of deference down into three one-sentence bullet points.
- Chevron Deference – When an agency interprets its primary statute (that is, the law that creates and empowers the agency), courts should defer to any authoritative, permissible interpretation unless Congress has directly said otherwise.
- Auer Deference – When an agency authoritatively interprets its own regulations, courts must defer to the agency unless the interpretation is “plainly erroneous or inconsistent with the regulation.” In other words, unless the interpretation flatly contradicts the regulation itself, courts defer.
- Skidmore Deference – In all other circumstances, courts can defer to an agency’s interpretation in the sense that the interpretation has the “power to persuade,” but the court can adopt the view it thinks appropriate.
These standards are endlessly debateable and have been endlessly debated. The fundamental question in every case is the same, though: what if the agency’s interpretations are wrong? That’s what the Supreme Court addresses in Kisor.
When is Deference Too Deferential?
Kisor is one of that very long line of cases addressing the question of how much deference an agency gets when it interprets its own regulations. Justice Kagan gives a few good examples of this phenomenon in the opinion:
The Transportation Security Administration (TSA) requires that liquids, gels, and aerosols in carry-on baggage be packed in containers smaller than 3.4 ounces and carried in a clear plastic bag. Does a traveler have to pack his jar of truffle pâté in that way?
The Mine Safety and Health Administration issues a rule requiring employers to report occupational diseases within two weeks after they are “diagnosed.” 30 CFR §50.20(a) (1993). Do chest X-ray results that “scor[e]” above some level of opacity count as a “diagnosis”? What level, exactly?
Kisor‘s underlying facts are actually of relatively little importance to the outcome of the case. That’s uncommon, which is probably why Justice Kagan, who wrote the majority opinion, starts off by noting it.
We begin by summarizing how petitioner James Kisor’s case made its way to this Court. Truth be told, nothing recounted in this Part has much bearing on the rest of our decision. The question whether to overrule Auer does not turn on any single application, whether right or wrong, of that decision’s deference doctrine.
Kisor’s argument is that the VA improperly denied him retroactive benefits based on the agency’s interpretation of its own regulations. Adopting a line of argument that has gained academic and judicial support in recent years, Kisor threw his entire argument behind the notion that that Auer deference is improper. The Court rejected his arguments, reaffirmed Auer both as a matter of substance and because stare decisis compels it, and ordered that the lower court simply reexamine whether the VA met Auer‘s standards.
So, if Kisor lost, what’s the big deal? As with many Supreme Court rulings, it isn’t what they say, it’s how they say it. Justice Kagan spends a lot of time explaining why Auer deference to agencies is a valid approach, but only by emphasizing very strict limitations on when it applies. An agency is entitled to Auer deference only when:
- The regulation is genuinely ambiguous,
- The interpretation the agency applies is reasonable, and
- The interpretation involves a matter of the agency’s special competency
The first two statements do, in fact, signal to lower courts that they should take a more skeptical approach when an agency asks for Auer deference. But the third statement is much more important as a limiting tool. As the Court explained:
Next, the agency’s interpretation must in some way implicate its substantive expertise. Administrative knowledge and experience largely “account for the presumption that Congress delegates interpretive lawmaking power to the agency.” So the basis for deference ebbs when “the subject matter of the dispute is distant from the agency’s ordinary” duties or “falls within the scope of another agency’s authority.”
Thus, Auer does not apply when an agency’s interpretation of its regulations goes beyond the specialized knowledge the agency holds. For instance, a TSA interpretation of whether truffle paste qualifies as a liquid under the 3.4 ounce rule for carry-on items is a matter of “substantive expertise,” but any interpretation that goes beyond travel safety and antiterrorism? Auer won’t apply.
“Privacy is our Specialty”
What does all of this mean, and what does it mean in particular for privacy regulation? Broadly, Kisor means that the Supreme Court is a hairsbreadth away from rolling back the power of administrative agencies. Justice Kagan — no big fan of Chevron or overly flexible administrative review — cobbled together a majority to preserve Auer, but only just. She signaled, too, that future reviews may invoke a more stringent approach from the Court. As for the dissenters, led by Justice Gorsuch, the position is clear: Auer has to go and if it survived Kisor, it was no more than a “stay of execution.”
As we’ve discussed here many times, privacy law in the United States is largely within the purview of the Federal Trade Commission. The basis for the FTC’s privacy remit is its authority to prevent “unfair or deceptive trade practices” under the FTC Act of 1915. But Congress has never specifically authorized FTC to be the privacy watchdog for the US, and any privacy regulations outside the scope of consumer law would, therefore, be outside of FTC’s “special competency” under Kisor. Other agencies also make their own privacy regulations, like the SEC or the FCC, but with rare exceptions, these have no direct tie to a Congressional authorization. Even the Privacy Rule in HIPAA — the most venerable and widest-ranging privacy law in the US — is an agency creation (by the Dep’t of Health and Human Services).
Under Kisor, then, a challenge to an agency’s interpretation of its own privacy regulations may not be entitled to anything more than Skidmore deference, which is to say, really no deference at all. Until and unless there is a Federal Privacy Protection Act or a Privacy Protection Agency within DOJ, for instance, a fair reading of Kisor is that no agency can claim special competency in privacy, and so no agency can rightly claim entitlement to (what remains) of Auer deference. That uncertainty will compound as long as Congress continues to dither about enacting meaningful privacy legislation, as it seems committed to doing for another year. The risk is that, as more states (and cities!) enact their own privacy laws, compliance costs will rise even as the likelihood of compliance with the confused, confusing, and conflicting regulations falls. And, if even the authority of the FTC to speak authoritatively on privacy matters is in doubt, there is no safety valve in the absence of direct action by Congress. The privacy law crisis in the United States continues to deepen, and there appears to be no solution in sight.