TL;DR
The recent Supreme Court rulings, including the overturning of Chevron and the implications of Corner Post, signal significant potential changes to the U.S. administrative law landscape, affecting areas such as cybersecurity, data protection, privacy, and responsible AI. The risks posed by these changes are substantial and will impact digital laws such as cybersecurity, data protection, privacy, and AI regulation, regardless of which agency or department administers the rules. It will be a challenge for lawyers and their clients to keep up, but for now existing regulations remain in place.
A Blurred Week
My fever dream induced by COVID around the time these opinions were released made me think I might have been in a weird alternate universe. I did not, however, wake up to find that the Supreme Court decisions were not as impactful as some pundits made them out to be (although I do remain optimistic that the end to all regulations is somehow imminent). With so much else happening legally and politically—such as immunity cases and election chaos—I’ll focus on the cases most relevant to my field of digital compliance and transformation, aka “Administrative Law.” Specifically, I’m examining Loper Bright Enterprises v. Raimondo (the “Fisheries” case) read together with Corner Post v. Board of Governors (“Corner Post”).
“Read together” because no sooner had I finished reading the Fisheries case opinion than SCOTUS released the Corner Post decision. While my initial thoughts on the Fisheries opinion were fairly restrained (“power play; arrogant but workable; doesn’t necessarily end every regulation; media, calm down”), it was only in the second paragraph of the Corner Post syllabus that I realized the potential scale of the impact due to the overturning of the Chevron doctrine in the Fisheries. Perhaps I had been too lenient in my initial assessment. I tend to assume the judiciary acts with good intent and that the Supreme Court wouldn't deliberately harm the country and its citizens.
Keep Calm and Carry On Analyzing
At first, I thought media reports were somewhat exaggerated (as is often the case), considering that despite the evident power shift and ego displayed in the Court's opinion, there was still an indication that the Court would listen to expert opinions from all sides. Although Chevron has fallen, the Administrative Procedures Act remains in place. The Court acknowledged that Congress could grant rule-making authority to administrative agencies under the Constitution and that agencies’ expertise should not be disregarded. The Court's reasoning for not deferring to agencies wasn’t about potential oversights in their expertise or the need for up-to-date science (which is difficult for agencies due to lengthy rulemaking processes) but rather because the Court deemed itself uniquely capable of handling complex matters.
Despite the Court’s claimed omniscience, it seemed so confused by the Chevron doctrine that it couldn’t reconcile the Fisheries case with it. The Court didn’t even attempt to adhere to precedent—there was no assessment of arbitrariness, as if this Court alone possessed the capability for complex analysis, unlike any before it. Additionally, the Court’s assertion that “the concept of ambiguity has always evaded meaningful definition” was puzzling. How can a Court that claims to have perfect insight struggle with defining “ambiguity”? [I had a boss like that—would criticize without seeking to understand. But I digress…]
Hope Followed by Disappointment
My hope was somewhat restored when the Court noted it wasn’t required to use a de novo standard of review, even if deference wasn’t mandated. At least we aren’t starting from scratch. The idea of overturning fifty years of administrative law seemed unlikely. Loper Bright Enterprises had their case sent back to the lower courts, but that was expected—it’s not like fifty years of administrative case law would vanish overnight, right?
Except for Corner Post. Corner Post held that the statute of limitations for administrative harm doesn’t start until a business experiences actual harm, regardless of how long the rule has been in place, basically creating a full right to de novo review. A business aware of existing regulations could challenge those rules based on compliance costs—costs known when the business was established. Moreover, “harm” occurs only after the final adjudication by the administrative body, not just when the rule is implemented. This means the statute of limitations might not begin until an entity has been fined, exhausted all administrative remedies, and pursued legal action with the court upholding the fine.
What about stare decisis and res judicata, you might ask? (OK, only if you’re a lawyer.) Res judicata isn’t addressed at all. Will prior court upholding of a regulation be considered? It’s unclear. Given that the credit card fees central to Corner Post’s argument were previously litigated and the Court’s high regard for itself, res judicata may be as dead as Chevron when it comes to administrative rules. Stare decisis is mentioned only in footnotes but only to justify vacating unlawful administrative rules. The Court acknowledges it but doesn’t feel compelled to adhere to it when overturning precedents they disagree with.
What Does This Mean for the Future of Cybersecurity, Data Protection, and Other Admin-Driven Law?
In short, expect more churn, uncertainty, and larger margins of error in risk analysis. There’s now a longer timeframe to challenge rules—you can even wait to assess compliance costs before deciding to challenge. Disagree with an administrative rule? Violate it, wait for agency action, go through the process, and then sue on the results. If the court sides with the agency, you can claim new “harm” under Corner Post and seek to have the rule invalidated by the Supreme Court.
Yes, this process is likely to be time-consuming and costly. Don’t expect an immediate surge in new challenges, but be prepared for a lot of them, especially from major players in heavily regulated industries. These entities, which often spend substantial amounts on legal compliance, will likely initiate many challenges. Lawyers in this field will need to stay updated on administrative processes, court findings, and trial and appeal stages. The rules will and can change.
So Here We Are
Kagan’s dissent in the Fisheries case aptly captures the Court’s attitude this year: hubris. The Court, despite struggling to define “ambiguity” and reconcile forty years of precedent, believes it alone possesses the wisdom to interpret administrative law. Why? Because a group of white men in the 1700s thought so, and the Court considers itself free from outside influence (which is questionable) and uniquely capable of understanding their views. How Alexander Hamilton would view the regulation of internet data or security of massive information systems remains uncertain.
With Corner Post holding that only the Courts can initiate the statute of limitations for administrative harm and that earlier decisions impacting other plaintiffs need not be considered, existing regulations are now in play for anyone up for the challenge. With no Chevron doctrine to rely on anymore, all previous decisions that deferred to agency expertise are also up for grabs. The primary constraint for those wanting to dismantle administrative law seems to be only time and volume. The sheer volume of regulations, combined with a limited number of courts and packed dockets, will likely influence the pace of change and the industries in which it first happens. I’m not sure digital regs will be the first to fall (more likely environmental), but with the costs of compliance increasing, insurance getting harder to obtain, and enforcement actions on the rise, it might be near the top. The only certainty is that it will be a bumpy ride—make sure you have a good lawyer ready when needed.
Comments