Supreme Court to Address Whether Risk Disclosures Can Be False or Misleading

On June 10, 2024, the United States Supreme Court agreed to hear argument in Facebook, Inc. v. Amalgamated Bank, No. 23-980, to address whether risk disclosures can be false or misleading if they do not describe a risk that materialized in the past, even if that past event presents no known risk of future or ongoing business harm.

The Supreme Court will review a decision by a divided Ninth Circuit panel holding that Facebook could be held liable for securities fraud under Section 10(b) for disclosing in its 10-K that security breaches and improper third-party access to user data “could harm” its business, when Facebook was aware that Cambridge Analytica had, in fact, improperly collected and harvested user data. We previously wrote about the Ninth Circuit decision in our article “The Risk in Disclosing Risk Factors”.

For years, federal appeals courts have disagreed about whether and when companies can be held liable for securities fraud for risk disclosures. The Sixth Circuit has held that a disclosure that something is a “risk” is necessarily a forward‑looking statement that no reasonable investor should read as an assessment of a company’s past or current affairs.[1] Several other circuits have held that a risk disclosure is actionable only when the risk has materialized, and it is known or near certain that the risk has had a negative impact on the company’s business.[2]

But, in Facebook, the Ninth Circuit took a different approach. As the dissent noted, “for the majority, it[ ] [was] irrelevant that Facebook did not know whether its reputation was . . . harmed at the time of the 10-K filing.”[3] Instead, the majority found that “the problem is that Facebook represented the risk of improper access to or disclosure of Facebook user data as purely hypothetical when that exact risk had already transpired. A reasonable investor reading the 10-K would have understood the risk of a third party accessing and utilizing Facebook user data improperly to be merely conjectural.”[4] The Facebook defendants argued in their petition for certiorari that “The Ninth Circuit’s extreme rule in this case—which has not been adopted by any other circuit—would require companies to chronicle past instances a risk came to fruition, even if the company has no reason to suspect those events pose any risk of business harm.  That outlier approach will spur lawsuits alleging fraud-by-hindsight, make compliance with 10-K disclosure requirements burdensome and unworkable, and ultimately reduce the usefulness of risk-factor disclosures by drowning investors in irrelevant information.”[5]

As the petition suggested, the Supreme Court’s decision on this issue could help provide some clarity and resolve the patchwork of legal theories about the importance of risk disclosures across the country. The Court will hear oral argument in this case during its term starting in October 2024, with a decision expected by summer of 2025.

[1] Bondali v. Yum! Brands, Inc., 620 F. App’x 483 (6th Cir. 2015).

[2] See, e.g., Williams v. Globus Medical, Inc., 869 F.3d 235, 242 (3d Cir. 2017); Indiana Public Retirement Systems v. Pluralsight, Inc., 45 F4th 1236 (10th Cir. 2022); Karth v. Keryx Biopharmaceuticals, Inc., 6 F.4th 123, 137 (1st Cir. 2021); Wilson v. Merrill Lynch & Co., 671 F.3d 120, 133–34 (2d Cir. 2011); Lormand v. US Unwired, Inc., 565 F.3d 228, 247 (5th Cir. 2009); In re Harman Int’l Indus., Inc. Sec. Litig., 791 F.3d 90, 104 (D.C. Cir. 2015).

[3] In re Facebook, Inc. Sec. Litig., 84 F.4th 844, 959–60 (citing Maj. Op. at 950) (9th Cir. 2023), opinion amended and superseded on denial of reh’g, No. 22-15077, 2023 WL 8365362 (9th Cir. Dec. 4, 2023).

[4] 87 F.4th at 949.

[5] Facebook, Inc., et al., Petitioners, v. Amalgamated Bank, et al., Respondents, 2024 WL 1009159, at *17–18.