United States: CPSIA Changes Demand Proactive Compliance

The Consumer Product Safety Improvement Act of 2008 (CPSIA) significantly increased the Consumer Product Safety

Commission's (CPSC) power to regulate product hazards that pose a risk of harm to consumers. Among the major changes implemented by the CPSIA are (1) shorter deadlines for responding to the CPSC to prevent the commission from disclosing information publicly, (2) enhanced CPSC enforcement power, and (3) dramatic increases to the upper limits of the civil and criminal penalties that the CPSC can seek. This article focuses on the third category of these changes, discusses how the CPSC has used its newfound powers to penalize offending entities, and offers advice on how companies that are subject to CPSC rules can avoid or lessen their exposure to civil and criminal penalties.

Even before Congress enacted the CPSIA a company was required to report product hazards to the CPSC. But now the potential consequences of failing to do so—or of failing to do so in a timely manner—are much more severe. For example, the CPSIA increased more than tenfold the amount of the civil penalty for each violation that the CPSC can seek for failing to comply with CPSC rules and regulations.

The CPSC has been an extremely active agency since the CPSIA's enactment, and it has had many important goals. Among its initial highest priorities were to better regulate children's products and products manufactured in China. It has concentrated on "fast tracking" recalls designed to streamline and expedite the recall process. The CPSC has also taken a number of steps intended to provide the public with greater access to information regard ing consumer product safety, including launching the publicly available consumer product information database, SaferProducts. gov, improving the commission website, and establishing a presence on social media sites.

Signs indicate that one of the CPSC's current priorities is to send a message to companies that they need to report product hazards in a timely manner by assessing penalties against those companies that belatedly report product hazards. It is now common for the CPSC to initiate post-recall investigations for purposes of evaluating whether imposing penalties for untimely reporting are warranted. For example, on August 3, 2011, the CPSC announced that Black & Decker agreed to pay a $960,000 civil penalty following the recall of about 200,000 weed trimmers and stated, "The settlement resolves CPSC staff's allegations that Black & Decker knowingly failed to report several safety defects and hazards with the Grasshog XP immediately to CPSC, as required by federal law. CPSC staff also alleges the firm withheld information requested by CPSC staff during the course of the investigation." Press Release U.S. Consumer Prod. Safety Comm'n, Black & Decker Agrees to $960,000 Civil Penalty for Failing to Report Defective Grasshog XP Weed Trimmer/Edgers, No. 11-295 (Aug. 3, 2011), http://www.cpsc.gov/cpscpub/prerel/prerel.html (follow "Press Release Number" hyperlink; then search for "11295").

The table below contains a list of civil penalties sought by the CPSC from January 1, 2011, through August 4, 2011, compiled from press releases on the CPSC website: This list suggests that the number of and penalty amounts in the future will increase and could also include criminal penalties. The CPSC successfully secured criminal penalties that included prison sentences for the president and contractors of a Tampa firm convicted of falsifying data in connection with child-resistance testing of cigarette lighters. Press Release, U.S. Consumer Prod. Safety Comm'n, Four Convicted and Sentenced in Youth Research Lighter Testing Fraud Case, No. 11-292 (Aug. 1, 2011), http://www.cpsc.gov/cpscpub/prerel/prerel.html (follow "Press Release Number" hyperlink; then search for "11292"). The commission chair, Inez Tenenbaum, commenting on the convictions, declared, "Firms are on notice that fraudulent testing of hazardous products such as lighters will not be tolerated by the CPSC." Id.

In many instances, a company, to its distress, learns that an investigation is occurring after the company has been involved in months of seemingly cooperative discussions with the CPSC's Compliance Division staff regarding a voluntary recall. Thus, companies seeking to avoid penalties must evaluate their internal systems for identifying reportable products and promptly report potential problems about those products to the CPSC.

Reporting Requirements Under Section 15(b)

Consumer Product Safety Act (CPSA) regulations obligate a manufacturer, distributor, or retailer of a consumer product to notify the CPSC immediately if it obtains information that reasonably supports the conclusion that a product (1) fails to comply with any applicable consumer product safety rule, regulation, standard, ban, or any other act enforced by the commission; (2) contains a defect that could create a substantial product hazard; or (3) creates an unreasonable risk of serious injury or death to consumers. See 15 U.S.C. §2064(b). Companies must understand the rules and regulations applicable to their products to identify rule or regulation noncompliance effectively at the time that it arises.

Substantial Product Hazards

Manufacturers do not need to report every defective product to the CPSC. Only a defect that creates a substantial product hazard to consumers implicates a reporting requirement under the CPSC regulations. The CPSA defines "substantial product hazard" as "a product defect which (because of the pattern of defect, the number of defective products distributed in commerce, the severity of the risk, or otherwise) creates a substantial risk of injury to the public." 15 U.S.C. §2064(a)(2). But a defect need not manifest itself through actual product failures or injuries to trigger an obligation to report: "Even one defective product can present a substantial risk of injury and provide a basis for a substantial product hazard determination under section 15 of the CPSA if the injury which might occur is serious and/or if the injury is likely to occur." 16 C.F.R. §115.12(g)(1)(ii).

In deciding whether to report a risk to the CPSC, firms may use the following criteria, which the CPSC staff also considers in determining whether a substantial product hazard exists:

16 C.F.R. §115.12(g).

If a company determines that a defect could create a substantial product hazard, it must immediately report to the commission because the commission has decided that "[m]ost defects could present a substantial product hazard if the public is exposed to significant numbers of defective products or if the possible injury is serious or is likely to occur." 16 C.F.R. §1115.4. The CPSC urges companies not to wait for injuries to occur before reporting a potential product hazard: "Since the extent of public exposure and/or the likelihood or seriousness of injury are ordinarily not known at the time a defect first manifests itself, subject firms are urged to report if in doubt as to whether a defect could present a substantial product hazard." Id. The CPSC guidance on this issue is consistent and clear: when in doubt report.

The duty to report arises the moment that a company receives information of a potential hazard. The Ninth Circuit Court of Appeals has held that "[w]here a manufacturer fails to report a potential defect, but it turns out that no actual defect exists, the Commission may decide not to seek a penalty. That does not mean, however, that there was no violation of section 2064(b)." United States v. Mirama Enterprises, 387 F.3d 983, 988 (9th Cir. 2004). As the court further explained, "[i]nformation about a possible defect triggers the duty to report, which in turn allows the Commission either to conclude that no defect exists or to require appropriate corrective action." Id. So a violation can occur and the commission may impose a penalty even if a product ultimately is not determined to be defective.

Unreasonable Risk of Serious Injury or Death

The CPSC requires a report if a reasonable person could conclude, given the information available, that a product under any circumstances creates an unreasonable risk of serious injury or death. 16 C.F.R. §1115.6(b). According to the commission, "[t]he use of the term 'unreasonable risk' suggests that the risk of injury presented by a product should be evaluated to determine if that risk is a reasonable one." Id. In determining whether an unreasonable risk exists, a manufacturer should examine the

Id. And a "firm should also evaluate the state of the manufacturing or scientific art, the availability of alternative designs or products, and the feasibility of eliminating the risk."

Id. If a company discovers that one of its products poses "an unreasonable risk of serious injury or death," the company "should not wait for such serious injury or death to actually occur before reporting." 16 C.F.R. §1115.6(a). A company may obtain such information, triggering the duty to report, from experts, test reports, lawsuits or claims, complaints, quality control data, or any other relevant information. Id.

Reporting Timing

Once a duty to report under section 15(b) arises, a company must do so immediately. 15 U.S.C. §2064(b). As a general rule, "immediately" means that a company must inform the CPSC within 24 hours of obtaining information that reasonably supports the conclusion that a product does not comply with CPSC regulations, a product defect generates a substantial product hazard, or a product creates an unreasonable risk of serious injury or death.

Although a company may conduct a reasonably expeditious investigation to evaluate the existence of reportable information, the investigation should not take more than 10 days unless the company can demonstrate why more time is reasonable. 16 C.F.R. §115.14(d). However, the 24-hour period will begin the moment that a firm obtains information implicating a duty to report under section 15(b). 16 C.F.R. §115.14(e).

Penalties for Failing to Report

The CPSA, section 19, makes it unlawful for a manufacturer, distributor, or retailer to fail to report to the CPSC in accordance with section 15(b). 15 U.S.C. §2068(a)(4). So any person who knowingly fails to furnish the required information under the section 15(b) reporting requirements is subject to civil penalties. 15 U.S.C. §2069.

"Knowing" means "the having of actual knowledge" or "the presumed having of knowledge deemed to be possessed by a reasonable man who acts in the circumstances, including knowledge obtainable upon the exercise of due care to ascertain the truth of representations." 15 U.S.C. §2069(d); 15 U.S.C. §1264(c)(5). This "known or should have known" standard is a low threshold. Thus, if a company had information about a product, and if a reasonable person based on that same information would have perceived the product to pose a hazard, and the company failed to report to the CPSC, the regulations deems it a "knowing failure to report" and a violation subject to a civil penalty.

In addition to seeking civil penalties from a company that violates the CPSC regulations, those individuals responsible for the violation may face criminal penalties if the commission deems the violation knowing and willful: "Any individual director, officer, or agent of a corporation who knowingly and willfully authorizes, orders, or performs any of the acts or practices constituting in whole or in part a violation of section 19 shall be subject to penalties under this section without regard to any penalties to which that corporation may be subject." 15 U.S.C. §2070(b) (emphasis added). A "criminal violation" is one for which a violator is sentenced to pay a fine, to imprisonment, or both. 15 U.S.C. §2070(c)(2). A criminal violation may include the forfeiture of assets associated with the violation. 15 U.S.C. §2070(c) (1). Violations of section 19 are punishable by (1) imprisonment for not more than five years, (2) a fine determined under 18 U.S.C. §3571, or (3) both. See 15 U.S.C. §2070(a)(1). United States Code, specifically 18 U.S.C. §3571, contains the criminal procedure provision setting forth the maximum fines that the CPSC may seek from a corporation or individual when found guilty of various offense categories.

Increased Penalties Under the CPSIA

Although before Congress enacted the CPSIA companies were penalized for failing to comply with section 15(b) reporting requirements, the CPSIA significantly increased the dollar amounts. The maximum penalty for a knowing failure to inform the CPSC increased from $8,000 for each violation to $100,000 for each violation. 15 U.S.C. §2068(a)(4); 15 U.S.C. §2069(a)(1). Violations "shall constitute a separate offense with respect to each consumer product involved," and the maximum penalty increased from $1,825,000 to $15,000,000 for a related series of violations. 15 U.S.C. §2069(a)(1). The United States Court of Appeals for the Ninth Circuit has interpreted "each consumer product" to mean that "a company commits a separate offense for every potentially dangerous unit it fails to report." United States v. Mirama Enterprises, 387 F.3d 983, 987 (9th Cir. 2004). This means that a civil penalty could theoretically reach a sizeable amount even if a company only distributes a small number of units of a product.

The CPSIA's most notable change to the laws authorizing criminal penalties removed a provision from the Consumer Product Safety Act that required the CPSC to notify an offending party that it had violated a consumer product rule or regulation. If, after receiving notice, the offending party continued to violate the rule or regulation, then the CPSC could seek criminal penalties. Prior notice of prohibited conduct is no longer required, and the CPSC simply may impose criminal penalties upon finding that a violation is knowing and willful.

Factors Considered

The CPSC is required to take into account various factors relating to the nature, circumstances, extent, and gravity of a violation in determining the amount of a civil penalty, including:

• The nature of the product defect. The commission will consider the nature of the product defect associated with a CPSA violation. This consideration will include, for example, whether the defect arises from the product's design, composition, contents, construction, manufacture, packaging, warnings, or instructions, and will include consideration of conditions or circumstances in which the defect arises;
• The severity of the risk of injury. The commission will consider, among other factors, the potential for serious injury, illness, or death (and whether any injury or illness required medical treatment including hospitalization or surgery); the likelihood of injury; the intended or reasonably foreseeable use or misuse of the product; and the population at risk (including vulnerable populations such as children, the elderly, or those with disabilities);
• The occurrence or absence of injury. The commission will consider whether injuries, illnesses, or deaths have or have not occurred with respect to any product or substance associated with a violation, and, if so, the number and nature of injuries, illnesses, or deaths. Both acute illnesses and the likelihood of chronic illnesses will be considered;
• The number of defective products distributed. The commission will consider the number of defective products or amount of substance distributed in commerce. The statutory language makes no distinction between those defective products distributed in commerce that consumers received and those defective products distributed in commerce that consumers have not received. Therefore both could be considered in appropriate cases. This factor will not be used to penalize a person's decision to conduct a wider-than- necessary recall out of an abundance of caution;
• The appropriateness of such penalty in relation to the size of the business of the person charged, including how to mitigate undue adverse economic impacts on small businesses. The commission is required to consider the size of the business of the person charged in relation to the amount of the penalty. The commission may look to several factors including, but not limited to, the number of employees, net worth, and annual sales. A business's size and a business's ability to pay a penalty are separate considerations. In some cases for small businesses, however, these two considerations may relate to each other. The commission must consider how to mitigate undue adverse economic impacts on small businesses;
• Such other factors as appropriate. Both the commission and the party charged may raise factors they believe are relevant in determining an appropriate penalty amount. The commission will look at a totality of the circumstances in making a penalty determination. Other factors may include, but are not limited to, whether the violator has a history of noncompliance, programs the violator has implemented to prevent noncompliance or safety violations, whether the violator gained economically from the failure to comply, and whether the violator responds timely to the commission's requests for information or remedial action.

See 15 U.S.C. §2069(b); 16 C.F.R. §1119.4. "Any civil penalty... may be compromised by the Commission" upon consideration of the above factors. 15 U.S.C. §2069(c).

Preventing and Mitigating Penalties

Companies can reduce the risk of violating reporting obligations by creating strong compliance systems and present mitigating factors to the commission to reduce penalties if the commission does seek them for violations.

Compliance Systems

Companies can reduce the risk of violating reporting obligations and incurring penalties by developing systems for ensuring compliance with CPSC regulations. A company should design a compliance program to establish, monitor, and maintain protocols for identifying product hazards or noncompliance and reporting to the CPSC.

It is vital to remember that a company can have a duty to report before it verifies that a hazard does exist. If a company has information sufficient to reasonably support the conclusion that a defect could create a substantial product hazard, then the company has a duty to report that information to the CPSC. A company must report that information immediately. As previously explained, a company should adopt a policy of reporting whenever it is uncertain whether an obligation to report exists. If a company later determines that a defect does not in fact create a substantial product hazard, it can inform the CPSC of that determination. However, if a company does not report a potential hazard and later determines that one does exist, the company has already violated its reporting obligations and may face penalties.

Companies should identify a team of individuals to take on responsibility for product safety compliance. This compliance team should include the persons responsible for monitoring the compliance program and keeping track of safety incidents involving a company's products, as well as members of relevant departments within the company, such as the product safety, legal, public relations, and marketing departments. A compliance coordinator should lead the team, and a company should assign responsibility to him or her for ensuring that the company follows compliance policies and procedures. The compliance coordinator should communicate with the CPSC and be the contact point for information or incident reports sent to the company from the CPSC. See John Kuppens, Paula Burlison, & Thomas Graham, The 'Wooden Approach' to Consumer Product Safety: How to Maximize Risk Prevention, DRI In-House Defense Quarterly (Spring 2010) (discussing compliance programs in-depth).

A company should establish procedures to identify and keep track of potential hazards that will follow up on safety indicators such as customer complaints and customer incident reports. A company should have clear guidelines for reporting hazards, both within the company and to the CPSC, and for determining whether a recall is necessary. A company should prepare in advance to evaluate the many issues that may require immediate action if the company must recall a product, such as needing to stop production, to isolate a product, and to inform distributors, retailers, consumers, and the media about the danger. Again, a company's compliance coordinator should be the point-person handling those communications and should have guidelines directing when and how to report to the CPSC.

Mitigating Penalties

It is important to note that a company's voluntary cooperation with the CPSC or voluntarily initiated recall of a product does not immunize that company from liability for penalties. A company that initiates a voluntary recall of a hazardous product is still subject to scrutiny. The CPSC will investigate the circumstances leading up to a voluntary recall to determine whether the company timely reported the defect. If the CPSC conducts a post-recall investigation that means that a Compliance Division staffer likely flagged the matter for review to determine if penalties are appropriate. If so, the Compliance Division already has determined informally that evidence may exist that a company should have filed a report earlier.

A company that realizes that it has untimely reported a product hazard can mitigate resulting penalties. Openly cooperating with the CPSC can be a factor that the CPSC will consider in determining an appropriate penalty, and communicating with the CPSC at this point is as important as ever. Requesting to meet with the CPSC staff in person to respond to issues and inquiries can be an effective way to build a line of communication and establish credibility.

A company can also use the same factors considered by the CPSC in determining an appropriate penalty to mitigate a penalty. However, a company has responsibility for providing the commission with mitigating factor information. For example, when considering how to mitigate an undue adverse impact from a penalty on a small business, the company has the burden to present clear, reliable, relevant, and sufficient evidence relating to the business's size and ability to pay a penalty. 16 C.F.R. §1119.4.

Presenting evidence of a robust compliance system such as the type discussed above may also help mitigate a penalty. If a company can show the CPSC that it has good systems in place that it rigorously adheres to, even if that system failed for explainable reasons in a particular instance that will not likely reoccur, then the company can establish a pattern of good faith rules and regulations compliance efforts. If defiance deterrence is the purpose of penalties, then penalizing a company that maintains rigorous compliance standards and proactively operates in a genuine effort to comply with rules and regulations will have little utility.

Presenting evidence that a company has a good track record of reporting to the CPSC and evidence that the commission has not penalized a company for violations in the past also helps. In addition, offering good procedures for, and a good history of, informing the public and those in the chain of distribution to eliminate a product danger will show a commitment to protecting consumers.

Penalty Settlement and Compromise

Since Congress enacted the CPSIA in 2008 the CPSC has used its enhanced enforcement authority and has sought substantial penalties ranging from $25,000 to $2.3 million. Usually, a civil penalty amount results from a compromise between the commission and a company based on the factors discussed above. Reviewing the settlement agreements published in the Federal Register has revealed that settlement agreements often include a provision in which a company denies that a particular product contained a defect creating a product hazard or that the company knowingly violated its reporting obligations. Often, a company will pay a penalty over time. The penalty settlement for Winter Bee, Inc., for selling children's hooded sweatshirts with drawstrings in violation of a CPSC ban on drawstrings in children's clothing, is a good example of compromising. The CPSC not only found that Winter Bee violated a drawstring ban and thus the Federal Hazardous Substance Act section 15(c) and 15 U.S.C. §1274(c), but it also found that Winter Bee violated its reporting requirements under section 15(b) by failing to immediately report the substantially hazardous sweatshirts that it had sold. See Winter Bee, Inc., Provisional Acceptance of a Settlement Agreement and Order, 75 Fed. Reg. 76,405 (U.S. Consumer Prod. Safety Comm'n Dec. 8, 2010).

Winter Bee settled its civil penalty with the CPSC. The agreement imposed a $200,000 penalty on Winter Bee, suspending all except $40,000, which the company agreed to pay in four installments over 20 months. Id. Winter Bee had instituted a voluntary recall of the hazardous sweatshirts upon discovering the violation, but it did not inform the CPSC until four months after initiating recall measures. According to Commissioner Nancy Nord, the commission did not impose the penalty against Winter Bee "for selling the hazardous product but for not telling [the CPSC] about it in a timely manner." Statement of Commissioner Nancy Nord on the Proposed Civil Penalty Settlement for Winter Bee, Inc. (U.S. Consumer Prod. Safety Comm'n Dec. 1, 2010), http://www.cpsc.gov/ pr/statements.html (then scroll to "Commissioner Nancy A. Nord").

Notably, Commissioner Nord opposed the proposed Winter Bee settlement. She disagreed with the commission staff's application of the penalty factors. Specifically, the settlement agreement showed that the staff asserted that Winter Bee's violation warranted a penalty of $200,000 but would only require Winter Bee to pay $40,000 due to the firm's inability to pay more. See id. Commissioner Nord suggested that applying the penalty factors led to a penalty of $40,000, not $200,000, because the staff should have considered company's size and ability to pay in determining an appropriate penalty. She believed that appropriately applying penalty factors, would lead to a $40,000 penalty and, accordingly, mitigation should have reduced that amount. Id.

Negative Exposure

The damage that a penalty can do to a company's public image or to a particular brand can often outweigh the financial burden of paying the penalty. While the commission will confidentially hold reports submitted under section 15(b) and protect them from public disclosure, generally it will not keep penalties imposed for failing to furnish such information confidential. The CPSC is generally prohibited from disclosing to the public information submitted to the commission in accordance with a company's reporting requirements under section 15(b), unless (1) the CPSC has issued a complaint and instituted a proceeding alleging that a product presents a substantial product hazard; (2) in lieu of a proceeding against a product, the CPSC has accepted in writing a remedial settlement agreement dealing with the product; (3) the person submitting the information agrees to public disclosure; or (4) the commission publishes a finding that the public health and safety requires public disclosure foregoing the required period of notice. 15 U.S.C. §2055(b)(5).

Unless public health and safety require disclosure without notice, the CPSC notifies a company of its intent to disclose information that will permit the public to ascertain readily the identity of the company 15 days before disclosure, to give the company an opportunity to respond and comment on the proposed disclosure. 15 U.S.C. §2055(b). But the commission should not disclose trade secrets or otherwise confidential business information. 15 U.S.C. §2055(a).

Penalties for failing to furnish the information required under section 15(b), however, are published in the Federal Register and on the CPSC website. In addition, all commission settlement agreements are published in the Federal Register. Although a company may be able to negotiate language in a settlement agreement that softens the negative public impact, generally the company will not be able to prevent the commission from publishing the settlement agreement.

Conclusion

The CPSC now has increased powers to impose civil and criminal penalties against companies for tardy reporting, and it is exercising those powers with vigor. To prevent violations and the resulting penalties companies will need to take proactive measures to comply with reporting requirements. If a company becomes the subject of a post-recall investigation, it should not only defend the timing of its reporting decision but also marshal evidence to mitigate penalties that the commission staff may assess that a violation warrants.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.