## Facts

- Congress enacted the Gramm–Leach–Bliley Act (GLBA) requiring “financial institutions” to protect customers’ nonpublic personal information and provide privacy notices.
- GLBA’s privacy regime applies through regulators’ implementing rules to covered “financial institutions,” and incorporates “financial activities” concepts drawn from the Bank Holding Company Act and Regulation Y.
- The Federal Trade Commission (FTC) adopted rules construing GLBA to cover certain lawyers and law firms when they performed services the FTC characterized as “financial activities” (e.g., tax preparation and real-estate closing/settlement work).
- The American Bar Association and New York State Bar Association sued in federal district court seeking declaratory and injunctive relief, contending the FTC exceeded its statutory authority by applying GLBA rules to attorneys engaged in the practice of law.
- The district court granted summary judgment for the bar associations and enjoined the FTC’s application of the GLBA privacy rules to lawyers engaged in the practice of law.
- The FTC appealed, and the consolidated appeals were decided by the U.S. Court of Appeals for the District of Columbia Circuit.

## Issues

1. Whether GLBA authorizes the FTC to treat lawyers engaged in the practice of law as “financial institutions” subject to GLBA’s privacy provisions and implementing regulations.
2. Whether the FTC’s interpretation of “financial institution,” resting on cross-referenced “financial activities” definitions, is entitled to Chevron deference given the traditional state role in regulating the legal profession and the clear-statement requirement for federal intrusion into that domain.

## Decision

- The D.C. Circuit affirmed the judgment for the bar associations.
- The court held the FTC exceeded its statutory authority by attempting to apply GLBA privacy regulations to lawyers engaged in the practice of law.
- The court rejected the FTC’s theory that performing any activity listed as “financial in nature” or “incidental” under the Bank Holding Company Act and Regulation Y automatically makes a law firm a GLBA-covered “financial institution.”
- The court concluded GLBA does not clearly authorize federal regulation of attorneys’ practice through FTC privacy-notice requirements, particularly given the longstanding state control over attorney regulation.
- The court declined to apply Chevron deference to uphold an interpretation that would materially shift the federal–state balance absent a clear congressional statement.

## Legal Principles

- Federal statutes are not read to displace traditional state authority over regulation of the legal profession without a clear statement from Congress.
- An agency may not expand regulatory jurisdiction into areas of traditional state control through ambiguous statutory terms, especially when the asserted authority depends on layered cross-references.
- Chevron deference does not justify an agency interpretation that would effect a major shift in the federal–state balance without clear statutory authorization.
- GLBA’s reference to “financial institutions,” read in statutory context, does not extend to lawyers engaged in the practice of law merely because some legal services resemble or accompany transactions listed as “financial activities” in other regulatory schemes.

## Conclusion

The D.C. Circuit held that the FTC lacked statutory authority under GLBA to impose GLBA privacy-rule obligations on attorneys engaged in the practice of law, requiring a clear congressional statement before allowing federal agency regulation to intrude into an area traditionally governed by the states.


Am. Bar Ass’n v. FTC, 430 F.3d 457 (D.C. Cir. 2005)