In early January, after a transfer from the CPSC to the Justice Department (and likely the subject of a public comment by Acting Chairman Adler), the fire extinguisher manufacturer Kidde became reached an agreement The government must pay a civil penalty of $ 12 million for failing to adequately report the extent and nature of the deficiency to the CPSC, not reporting it in a timely manner, providing false information to the CPSC, and misusing a registered safety certification mark. The civil penalty appears to have signaled the beginning of a more aggressive approach to enforcing the CPSC.
A month later, on February 11th, the CPSC announced an agreement with Cybex International, an American manufacturer of exercise equipment, to pay a civil penalty of $ 7.95 million. The penalty arose from the company’s alleged failure to report to the CPSC, given its knowledge of several safety-related incidents for two of its training products, including one that resulted in paralysis and spinal fractures. The comparison Emphasizes the need for manufacturers and retailers of consumer goods to have a robust system for monitoring security incidents and, if necessary, a procedure for timely reporting to the CPSC.
The Settlement Agreement discussed Cybex’s failure to report security incidents for two products: (1) Arm Curl Machines; and (2) Smith Press Machines. CPSC said that between mid-2002 and June 2015, when Cybex finally filed a report with the agency on its Arm Curl Machines, the company had received 85 reports of broken handles, resulting in numerous injuries, including cuts with stitches and one alarming one Incident where a user lost sight in one eye when the handle came off the machine. Cybex eventually participated in a Fast Track Recall of the Arm Curl Machines in August 2015. With regard to the Smith Press Machines, CPSC’s claims go much further back, claiming that Cybex received 27 reports of injuries related to the machines from 1991, including the aforementioned injury that resulted in paralysis and spinal fractures. The company contacted the agency in August 2018, which resulted in a fast track recall August 2018. In particular, the agency is not claiming when Cybex should have reported to the CPSC – only that their eventual reports were not timely.
Cybex’s response to the CPSC’s allegations said the recalled machines were designed, manufactured and sold by Arm Curl and Smith Press previously owned by the Cybex business. The company claims that after the Arm Curl machine was recalled in 2015, new management tried to evaluate its “legacy business” and decided to file a report with the CPSC. The new management certainly believes it took prudent action when it learned it had a problem with a “legacy” machine, and even notes that it has made improvements to its security following its acquisition in 2016 -Compliance program.
This deal should be seen as yet another warning shot for companies that experience low security incidents year after year. In a vacuum, a specific security incident cannot raise the reporting requirement under Section 15. Companies can create “excuses” for most incidents – “the consumer didn’t use the product properly” or “we don’t know what happened here, but it doesn’t seem to be a systemic problem. On behalf of Cybex, the CPSC claimed that in the face of only 27 reports over a 27-year period with regard to its Smith Press Machines, the company had – one per year (certainly some with serious injuries who might themselves be subject to Section 15 reporting) not reported in time). This underscores that at some point a company has to say that “enough is enough” and that there is a process in place that will lead it to the conclusion that it must, or at least should, file a report.
The CPSC’s informal guidance on “When in doubt, report” is not a real approach. It’s not specific enough to let companies know when it’s time to report back. Multinational companies cannot report every security incident. it’s impractical. But, in hindsight, CPSC is a 20/20 approach when it comes to penalties.
Still, “when in doubt, report” is telling how the agency views late reporting, and should your company wait too late for reporting, it indicates a shift towards more aggressive enforcement. This will undoubtedly be reinforced in the next few years under a democratic majority.