Issues
Does a company mislead investors when it discloses a future risk without mentioning that the potential bad event has happened before?
This case asks the Supreme Court to determine whether a company’s risk disclosure to investors is false or misleading when the company does not disclose a risk that has materialized in the past, even when that past event poses no risk of ongoing or future harm to the company. In this case, Facebook failed to disclose a past data breach, the Cambridge Analytica Scandal, in its 2016 10-K disclosures. Shareholders sued the company and its executives, arguing that the failure to disclose this information was false or misleading. On one hand, Facebook argues that it does not have to disclose such past events in the form at issue because risk disclosures are forward-looking and investors understand that. On the other hand, Amalgamated Bank contends that companies must disclose information about past bad events because stating a risk as a hypothetical event could mislead investors into believing there have been no past bad events. The outcome of this case will affect the requirements of risk disclosures, which could impact the quantity and quality of disclosure information, how much companies must disclose, and whether investors’ demands are met.
Questions as Framed for the Court by the Parties
Whether risk disclosures are false or misleading when they do not disclose that a risk has materialized in the past, even if that past event presents no known risk of ongoing or future business harm
Facts
In 2014, Professor Aleksandr Kogan created an app that paid users for taking a psychological test. Amalgamated Bank v. Facebook, Inc. at 11–12. The app also collected data on the quiz takers and their Facebook, Inc. (“Facebook”) friends resulting in data collection from over 30 million Facebook profiles. Id. Kogan shared this data with the political consulting firm Cambridge Analytica, which used it to assist Ted Cruz’s 2016 presidential campaign. Id. at 12. When reporters revealed Cambridge Analytica’s use of personal data, Facebook promised to investigate and pledged to “take swift action” against anyone who had misused user data. Id. Cambridge Analytica agreed in January 2016 that it would delete the data it had collected from Facebook users. Id. However, in October 2016, reporters noted that Cambridge Analytica was still using such data, this time to help Donald Trump’s presidential campaign. Id. at 12–13. In its required disclosure 2016 Form 10-K, Facebook disclosed the risk that third parties could misuse user data, which could harm the company’s business in the future. Id. at 13. Specifically, the company wrote in a section labeled “Risk Factors” that “failure to prevent or mitigate . . . improper access to or disclosure of our data or user data . . . could result in the loss or misuse of such data, which could harm [Facebook’s] business and reputation and diminish our competitive position.” Id. at 13.
Reports about Cambridge Analytica’s use of Facebook data continued to emerge throughout 2017 and early 2018. Id. at 13–14. Throughout that period, Facebook said that it had not discovered misconduct by Cambridge Analytica relating to its political activities. Id. at 14. In March 2018, the New York Times published a report detailing the scale of the data leak and how Cambridge Analytica used the data to benefit the Trump campaign. Id. at 14–15. Facebook’s stock dropped by 18% in the week after the report. Id. at 16. A few months later the stock fell by another 19% after Facebook announced weak growth and profitability in an earnings call. Id. at 17–18.
A group of shareholders, including Amalgamated Bank (“AB”), sued Facebook and its executives in October 2018. Id. at 18. The shareholders claimed that Facebook had made false and misleading statements in its 2016 10-K form by describing the misuse of user data as a hypothetical risk when it had already occurred. Id. The United States District Court for the Northern District of California dismissed the amended complaint for failure to state a claim. Id. at 19. On appeal, the United States Court of Appeals for the Ninth Circuit reversed in part, ruling that it was misleading for Facebook to describe the improper use of data as purely hypothetical when it had already occurred. Id. at 24–25. The court held that when a company knows that a risk has materialized but states that the risk “could” or “may” occur, a reasonable investor could be misled about the nature of the risk. Id. at 23–26.
Facebook petitioned for a writ of certiorari, which the United States Supreme Court granted on June 10, 2024. Brief for Petitioners, Facebook, Inc., et al. at 1.
Analysis
THE PURPOSE OF ITEM 105 DISCLOSURES
Facebook contends that the disclosures required in a 10-K form by Item 105 of Securities and Exchange (“SEC”) Regulation S-K are about risks that could harm the company in the future. Brief for Petitioners, Facebook, Inc., et al. at 19. Facebook asserts that whether a statement in an SEC disclosure is “false or misleading” depends on how a reasonable investor would interpret that statement in context. Id. Facebook argues that when a company discloses a future risk in a 10-K form, a reasonable investor would not take that to mean that the possible bad event has not happened before. Id.
Facebook contends that the ordinary meaning of the word “risk” is forward-looking. Id. at 21. Facebook also stresses that typical risk disclosures under Item 105 use forward-looking language that discusses the possibility of harm Id. at 22. Facebook notes that companies often make conditional statements, which warn that if a bad event happens, the business “could” or “may” be harmed. Id. Facebook asserts that that language tells investors that risk disclosures state the company’s opinions on what may affect its business in the future, rather than its current problems. Id.
AB counters that disclosures can be misleading if they characterize events that have already occurred as hypothetical future risks. Brief for Respondents, Amalgamated Bank et al. at 20. AB contends that disclosures of future risks can imply that no past bad event has happened. Id. at 20–21. AB asserts that the common law has long recognized that statements about future events can be misleading. Id. at 23–24. AB points to the Restatement of Torts to show that a “statement about the future may imply a representation concerning an exciting or past fact.” Id. at 23. AB argues that when an Item 105 form raises a past event, and a closely related risk is described in purely hypothetical terms, a reasonable investor would assume that the latter risk has not materialized. Id. at 26.
AB asserts that the regulation requires the disclosure of “factors” that make an investment risky, and that investors would interpret the regulation to require companies to disclose recent bad events. Id. at 27–28. AB asserts that past bad events could also lead a reasonable investor to conclude that those events would likely recur and to draw broad inferences about the competency or integrity of a company’s management. Id. at 28. AB notes that the SEC has issued guidance and examples, which include both past and present events, and not just events that could occur in the future. Id. at 29.
ITEM 105 & OTHER SEC DISCLOSURE FORMS
Facebook also argues that viewing Item 105 disclosures as purely forward-looking makes sense in the context of other SEC disclosure rules. Brief for Petitioners at 23. Facebook points out that other SEC disclosure forms require companies to list a company’s present and past challenges, so it does not make sense to view Item 105 as requiring the same thing. Id. Facebook cites the Item 106 form, which the SEC adopted last year, as an example of a form that clearly requires the disclosure of previous cybersecurity incidents that have affected a company. Id. Facebook claims this form shows that when the SEC intends to require companies to disclose past events, they clearly indicate so. Id. Facebook contends that, if anything, a reasonable investor would make the opposite inference—that a forward-looking risk disclosure implies that the triggering event had been an issue in the past. Id. at 24. Facebook notes that SEC regulations discourage companies from disclosing risk factors that could apply to any company, so there should be a specific reason the company is making the disclosure, such as that the event has occurred in the past. Id.
Facebook acknowledges that Item 105 disclosures can be misleading, such as when a company states an opinion about the probability of an adverse event occurring that it does not believe, or if it misstates the nature of a risk. Id. at 25. However, Facebook asserts that a disclosure is not misleading merely because it fails to disclose past instances of past bad events that are like the future risk described. Id. Facebook notes that in any event, its disclosure did inform investors about past events, by pointing out that computer viruses and hacking “have occurred on our systems in the past and will occur on our systems in the future.” Id. at 28.
AB asserts that Facebook wrongly claims that investors will look at all required disclosure forms, know the regulations, and can infer that Item 105 is different. Brief for Respondents at 30–31. Instead, AB argues, investors likely think that all forms require disclosure of past, present, and future events. Id. at 31. AB then points out that SEC guidance, which a lay investor would likely read to understand the regulations, has warned companies that failure to disclose a past event can be misleading. Id. AB claims that Facebook overstates how much information about the Cambridge Analytica scandal was publicly available when Facebook filed its disclosure. Id. at 48. AB asserts that investors only knew about allegations, which the parties involved, including Facebook, denied. Id. at 49. AB contends that reasonable investors would believe those allegations were unsubstantiated because Facebook said it would investigate them, stayed silent for years, and then said it had not discovered any misconduct. Id. AB also points out that investors would have wanted to know about the misconduct because they reacted “violently” in 2018 when Facebook acknowledged that its data was misused. Id.
AB contends that Facebook is asking the Court for a categorical rule: that risk-factor statements are incapable of misleading investors about past events. Id. at 34. AB also argues that categorical rules are poorly suited to determining which statements are misleading or not. Id. AB notes that the Court has often rejected the use of such categorical rules, stressing that whether a statement is misleading depends on the particular facts of each case. Id. at 34–36.
“SAFE HARBOR” PROVISIONS
Facebook contends that the Ninth Circuit’s approach undermines the “safe harbor” provisions that securities laws typically grant to companies that make forward-looking disclosures. Brief for Petitioners at 37–38. Facebook notes that some circuit courts have adopted a different standard than the Ninth Circuit, requiring companies to disclose a previous adverse effect only if it is “virtually certain” to harm the company’s business. Id. at 39. Facebook argues that this standard is also flawed, but still better than the Ninth Circuit’s holding. Id. at 39. Facebook contends that it would prevail if the Court adopted this “virtually certain” standard. Id. at 40. Facebook asserts that it was not “virtually certain” that the Cambridge Analytica scandal would harm the company’s business because its share price did not drop, even though information about the scandal had been public for over a year when Facebook made the disclosures at issue. Id. at 41.
AB asserts that Congress has given the SEC the responsibility to balance how much disclosure is appropriate, and the agency has decided that Item 105 strikes the correct balance. Brief for Respondents at 40–41. AB contends that Facebook misunderstands the purpose of the statutory “safe harbor” provisions for disclosures. Id. at 36–37. AB asserts that safe harbors apply only to a defined set of forward-looking disclosures, contain several exceptions, and impose more requirements for complete immunity from suit. Id. at 37. AB claims that Facebook’s argument would expand safe-harbor provisions far beyond what Congress intended. Id. AB also urges the Court to reject Facebook’s proposed “virtually certain” rule and claims Facebook misunderstands how the circuit courts apply that rule. Id. at 43–44. AB argues that lower courts use the rule when a company’s statement is misleading because it describes a risk that is almost certain to happen as only a possibility. Id. at 44.
Discussion
DISPUTE ABOUT MATERIALITY AND DISCLOSURE COST AND COMPLEXITY
In support of Facebook, Law Professors and Former Officials of the SEC (“Law Professors”) argue that affirming the Ninth Circuit would undercut the SEC’s risk-disclosure regulations because it would frustrate the SEC’s goal of trying to limit disclosure to material risks only. Brief of Amici Curiae Law Professors and Former Officials of the Securities and Exchange Commission, in Support of Petitioners at 3, 5. Law Professors explain that the Ninth Circuit’s standard would require companies to disclose many past events that are unlikely to affect their business and are therefore irrelevant to investors’ forward-looking risk assessments. Id. at 5–6. Moreover, the Washington Legal Foundation, in support of Facebook, contends that the Ninth Circuit’s approach would reverse cost savings from the SEC’s recent amendments to the risk-disclosure form and make disclosures more complex as companies inundate them with extraneous details. Brief of Amicus Curiae Washington Legal Foundation, in Support of Petitioners at 13–14.
In support of AB, the United States argues that affirming the Ninth Circuit would not undermine the SEC’s risk-disclosure regime because companies would not have to disclose every prior instance of a relevant risk. Brief of Amicus Curiae The United States, in Support of Respondents at 26. The United States explains that a plaintiff who sues under Rule 10b-5 must show that the defendant made “a material misrepresentation or omission,” but a disclosure statement that omits a past instance of the relevant risk is not necessarily misleading. Id. Furthermore, the United States argues that Facebook’s “virtual certainty” approach is more demanding than materiality and would therefore impede plaintiffs’ ability to sue for misleading statements. Id. at 27–28. Securities Law Scholars, in support of AB, also contend that Facebook’s approach would be harmful by creating a bright-line rule to distinguish between “forward-looking” events and “previous events” and to determine what events are material. Brief of Amici Curiae Securities Law Scholars, in Support of Respondents at 17. Securities Law Scholars further explain that this would “muddy the waters for jurists, practitioners of securities law, and reasonable investors” because it would combine materiality with new rules. Id.
CONCERNS ABOUT OVERDISCLOSURE AND DILUTION
In support of Facebook, the Chamber of Commerce of the United States of America and the Securities Industry and Financial Markets Association (“Chamber of Commerce”) argue that affirming the Ninth Circuit would adversely affect companies and investors because companies would over disclose information to investors. Brief of Amici Curiae Chamber of Commerce of the United States of America and Securities Industry and Financial Markets Association, in Support of Petitioners at 14. The Chamber of Commerce explains that the Ninth Circuit’s rule would encourage companies to disclose any incident that could potentially lead to some future harm, to avoid liability. Id. The Washington Legal Foundation further highlights that over disclosure would negatively affect investors by burying them under an “avalanche of trivial information” that would detract from making an informed decision. Brief of Washington Legal Foundation at 15. In addition, it claims that affirming the Ninth Circuit’s decision would create a “new wave of lawsuits” that are based on a company’s failure to disclose past events, which would allow for meritless securities litigation to proliferate. Id. at 17.
In support of AB, Technology Industry Policy Advocates and Investors (“TIPAI”) contend that affirming the Ninth Circuit would not adversely affect companies and investors because it is already the law in many circuits, and Facebook has not shown that companies do in fact over-disclose. Brief of Amici Curiae Technology Industry Policy Advocates and Investors, in Support of Respondents at 17. TIPAI suggest that affirming would benefit investors because it would give them otherwise unobtainable information that they need for making informed decisions. Id. at 18. Moreover, Institutional Investors argue in support of AB that disclosure of past events is important because it would be damaging to let companies declare that a risk is only an issue if something happens in the future when it has already occurred. Brief of Amici Curiae Institutional Investors, in Support of Respondents at 21. Institutional Investors add that even if companies over-disclose, the costs would be minimal because risk-factor disclosures are mostly read by sophisticated parties who can process dense reports, rather than casual investors. Id. at 29.
Conclusion
Additional Resources
- Jordan Eth & Jocelyn Greer, The Risk in Disclosing Risk Factors, Mealey’s Emerging Securities Litigation (May 2024).
- Kevin LaCroix, Supreme Court Agrees to Take Up Facebook User Data Disclosure Case, The D&O Diary (June 10, 2024).