As 2014 draws to a close, we see that Section 15(b)’s reporting requirement continues to be a powerful tool for CPSC to punish companies who manufacture, distribute, or sell products that are ultimately recalled. In 2014, CPSC entered into six settlements resolving Section 15(b) allegations that included civil penalties ranging from US$600,000 to US$4.3 million, representing the majority of all concluded CPSC enforcement actions in 2014.

Section 15(b) reporting

Section 15(b) of the Consumer Product Safety Act requires companies that manufacture, distribute, import, or sell consumer products to immediately report to the Consumer Product Safety Commission products that do not comply with a CPSC-enforced product safety rule or contain a defect that could create a substantial risk of injury or an unreasonable risk of serious injury or death. Section 15(b) requires reports from all parties in the supply chain unless the “manufacturer, distributor, or retailer has actual knowledge that the Commission has been adequately informed.”

Immediate reporting

According to regulations implementing Section 15(b), immediate reporting means within 24 hours of obtaining information that “reasonably supports the conclusion” that the product fails to comply with a standard or poses a substantial product hazard (with up to ten days to investigate if necessary). Product complaints, injury reports, and QA/QC data can all trigger reporting. Companies should not delay reporting to obtain certainty.

Penalties

Failure to report is a “prohibited act” under the CPSA. Knowing violation are subject to civil penalties of up to $100,000 per violation capped at US$15 million for a related series of violations.

The settlements

In five of the settlements, the companies ultimately submitted Section 15(b) reports for the products, but CPSC alleged that they should have reported sooner. In the sixth, the company did not file a Section 15(b) report, but claimed it did not know of the products until CPSC announced their recall, eliminating the reporting duty.

It is no surprise that these settlements involve claims that the companies failed to report when they should have. Under the regulations, it is very easy to look back at a company’s actions and claim it should have acted sooner. Knowledge triggering a report is imputed to the company if it is obtained by “an official or employee of a subject firm capable of appreciating the significance of the information.”  Under this broad language, CPSC can look back at a recall timeline and allege that the knowledge of any employee that saw a defective product or received a customer complaint is imputed to the company. This claim becomes more likely as information travels up to managers and executives.

Reporting and compliance plan requirements

These settlements show an additional risk associated with failure to report: we are now seeing CPSC using settlements to obtain companies’ agreements to implement compliance and reporting programs with CPSC-specified elements, including:

  • a system of internal controls for reporting and disclosing information to CPSC;
  • written standards and policies;
  • systematic procedures for reviewing and referring incident reports for safety issues;
  • confidential employee reporting to management of compliance concerns;
  • training;
  • senior manager responsibility for compliance and accountability for violations;
  • oversight of compliance by the firm’s governing body; and
  • records retention.

Rather than simply being “best practices” for an effective product safety compliance program, these have now become legally enforceable provisions.

Tracking compliance

Review of these settlements shows that companies should have mechanisms in place to receive, evaluate, and act on information regarding products. In particular, companies should ensure that customer incident reports, product reviews, and other negative customer feedback get elevated to appropriate personnel for assessment. In some of these settlements, the companies received relatively few complaints/incident reports (single digits over several years), but CPSC argued that this was sufficient to trigger a reporting obligation.