Here’s how the shutdown is affecting federal agencies responsible for overseeing and enforcing advertising and privacy laws:

• The FTC closed as of midnight December 28, 2018. All events are postponed and website information and social media will not be updated until further notice. While some FTC online services are available, others are not. More information here.
• The CPSC is also closed, although a December 18, 2018 CPSC memorandum summarizing shutdown procedures indicates that certain employees “necessary to protect against imminent threats to human safety” will be excepted employees and continue work during the shutdown. The CPSC consumer hotline also continues to operate. Companies should remember that obligations to report potential safety hazards are not furloughed, so the mantra of “when in doubt, report” still applies, even if public announcement of a recall may be delayed.
• Roughly 40% of FDA is furloughed according to numbers released by its parent agency, the Department of Health and Human Services. In a post on its website, the agency explained that it will be continuing vital activities, to the extent permitted by law, including monitoring for and responding to public health issues related to the food and medical product supply. The agency is also continuing work on activities funded by carryover user fee balances, although it is unable to accept any regulatory submissions for FY 2019 that require a fee payment.
• Because the CFPB is funded through the Federal Reserve and not Congress, it remains in operation.

To use the tool, developers answer a series of high-level questions about the nature of their app, including about its function and the data it collects. Based on the answers to those questions, the tool advises the developer about whether the FTC Act, the FTC’s Health Breach Notification Rule, HIPAA, or the Federal Food, Drug and Cosmetic Act likely applies to the app. In some cases, the tool links out to other guidance that may be relevant for the app, such as FTC’s guidance for complying with the Health Breach Notification Rule. The FTC developed the tool in conjunction with the Department of Health and Human Services’ Office of National Coordinator for Health Information Technology, Office for Civil Rights and the Food and Drug Administration.

Along with the tool, the FTC released recommended best practices for privacy and security in mobile health apps. The guidance encourages developers to minimize the information their apps collect, to limit and control access to the apps and to the data they collect, and to implement “security by design.” This health-app-specific guidance builds upon the FTC’s general guidance for mobile app developers. For those developing apps, FDA’s policies regarding whether such apps are regulated as medical devices should also be considered.

The main lesson that is underscored in all of these tools is the same: Consider the nature of the information collected and its potential use at the concept phase and rather than after development is complete. All too often, as companies rush to submit apps for approval on an app store, legal compliance is an afterthought. As we have learned from the 100+ privacy and data security settlements that the FTC has released, these issues can be very difficult to cure on the back end.

Persons responsible for facilities subject to the fees should review the guidance and note that although the FDA began assessing fees for reinspection of domestic and foreign facilities and for failure to comply with a recall order on October 1, 2011, the fees for import reinspection will not be assessed until the FDA has resolved the issues raised in comments on the fee schedule released in the August 1, 2011 Federal Register.