Risk Disclosure Issue Remains After Justices Nix Meta Case

On Nov. 22, in a terse one-page order, the U.S. Supreme Court dismissed the writ of certiorari in Facebook Inc. v. Amalgamated Bank, one of two private securities fraud cases the court had agreed to hear this term,¹ as improvidently granted. The unexplained move comes after the court received a full merits briefing and heard oral argument, raising eyebrows among court watchers and securities litigation practitioners.

The court's nondecision effectively leaves untouched a controversial — and very pro-plaintiff — March ruling by the U.S. Court of Appeals for the Ninth Circuit² regarding an issue of federal securities law that recently has become more prominent in private securities fraud suits: Under what circumstances can a publicly traded company be held liable for allegedly false and misleading risk disclosures contained in its filings with the U.S. Securities and Exchange Commission?

Questions naturally arise about what the court's punting of this issue means for the future of private securities fraud litigation. The answer is: not very much, at least in the short term. Nevertheless, the problems in this area of the law are not going away and ultimately still need to be addressed.

The Facebook case specifically concerns risk disclosures that public companies are required to make in their periodic reports on Forms 10-K and 10-Q by Item 105 of Regulation S-K.³ Item 105 requires issuers to disclose in these filings any "material factors that make an investment in the [company] speculative or risky."⁴

Anyone who has flipped through a 10-K in the last 10 years has likely seen pages and pages of such disclosures, covering everything from supply chain and financing risks to competition and regulatory concerns. Frequently, Item 105 disclosures take the form of telling investors that if a specific triggering event were to happen to the company in the future, then a bad consequence for the company could or, in some cases, likely will follow.

Read literally, Item 105 disclosures taking this form notify investors of the hypothetical possibility that an adverse event might occur that could harm the company's business in the future, thereby enabling the investor to take account of that risk in deciding whether to buy or sell the company's securities. While companies sometimes discuss past events in these types of disclosures, an Item 105 risk disclosure will often say nothing explicitly about what has happened in the past.

With rising frequency, many private securities fraud actions rest on allegations by investor plaintiffs that the defendant company made a materially misleading Item 105 risk disclosure because it presented the risk that a triggering event would occur as purely hypothetical, when in fact such an event had already occurred and the risk to the company had already materialized.

Plaintiffs making such claims effectively allege that a company's statement in an Item 105 disclosure that an event might occur in the future and have unfavorable consequences for the company's business contains within it an implied representation that such an event has not occurred in the past and caused similar negative results. Such claims rest on a strong, commonly shared intuition that, by failing to disclose the occurrence of negative past events, a company's statement that a risk hypothetically could materialize in the future will mislead reasonable investors in at least some circumstances.

To take an example that came up at oral argument before the Supreme Court, a company's disclosure of the risk that a fire at its plant could occur in the future and destroy its business would be a materially misleading half-truth if such a devastating fire in fact had already occurred a few weeks before the disclosure was made. No reasonable investor in those circumstances would believe that the company had told the truth about the state of its business — or at least not the whole truth. A company that had already suffered catastrophic loss would not be expected to characterize the risk of such a loss as purely hypothetical in its communications with investors.

It is difficult to contest this point, as it seems grounded in common sense. As many courts have noted in varying contexts, including the U.S. Court of Appeals for the Eleventh Circuit in its 2011 FindWhat Investor Group v. FindWhat.com decision, "to warn that the untoward may occur when the event is contingent is prudent, [but] to caution that it is only possible for the unfavorable events to happen when they have already occurred is deceit."⁵

On the other hand, it is equally obvious that, in other circumstances, characterizing as hypothetical the risk that a bad event will occur in the future without disclosing past occurrences of that same event will not mislead anyone.

To take another example discussed at oral argument, disclosing the risk that baseball games might have to be canceled in the future as a result of inclement weather does not imply to a reasonable investor that rain has never caused a baseball game to be canceled in the past. That is because it is common knowledge that baseball games frequently need to be rescheduled due to rain; it has happened during every baseball season in the past and will happen during every baseball season in the future.

Thus, there are indeed circumstances where a reasonable investor would understand, based on their common experience and knowledge of the particular nature of the company's business, that the occurrence of some kinds of negative events is inevitable, if not routine, for some types of companies. Disclosure of the past occurrence of such events is not necessary to avoid misleading investors.

What this means is that figuring out when the failure to disclose a past event in an Item 105 risk disclosure is materially misleading, and when it is not, is often a tricky endeavor.

In the Facebook case, news reports appeared in 2015 accusing Cambridge Analytica, a political consultancy firm, of improperly obtaining access to the private data of 30 million Facebook platform users in violation of the policies of Facebook, now known as Meta Platforms Inc. Meta, at that time, did not publicly confirm the accusation, announcing instead that it would conduct an investigation and, if necessary, take swift action against unauthorized users of its customers' data.

In February 2017, Meta filed a Form 10-K that contained an Item 105 risk disclosure discussing, among other things, the risk that unauthorized third parties could improperly access or use its customers' personal data in the future, which could then harm Meta's business. Meta did not disclose Cambridge Analytica's improper acquisition and misuse of massive amounts of such data in its Form 10-K, even though Meta — allegedly — had by that time confirmed that the allegations against Cambridge Analytica were true. When Meta subsequently revealed the truth in March 2018, its stock price declined by nearly 18%.

In March 2024, the Ninth Circuit held — over a dissent — that Meta's Item 105 disclosure was a materially misleading half-truth, and thereby actionable under Section 10(b) of the Securities Exchange Act of 1934, because it represented the risk that third parties would improperly obtain Facebook user data as merely hypothetical when in fact that very risk had already materialized as a result of Cambridge Analytica's misconduct.

This decision is consistent with prior Ninth Circuit precedent, including its 2021 decision in In re: Alphabet Inc. Securities Litigation, holding that "[r]isk disclosures that 'speak entirely of as-yet-unrealized risks and contingencies' and do not 'alert the reader that some of these risks may already have come to fruition' can mislead reasonable investors."⁶

It also accords with a wide consensus in the federal courts of appeals that risk disclosures can be actionable under some circumstances, such as when the undisclosed past event carries a risk that is virtually certain to occur in the future.⁷ It's debatable how much daylight there is between the Ninth Circuit's test for determining whether Item 105 risk disclosures are actionable and the standard applied by these other circuits, and this issue was hotly contested in the merits briefing before the Supreme Court.

In response to Meta's petition, the Supreme Court agreed to hear the case in order to decide the narrow issue of whether a risk disclosure is false or misleading when it fails to disclose that a risk has materialized in the past, even if that past event presents no known risk of ongoing or future business harm.

In its merits briefing, however, Meta pivoted from that question and decided to go for the grand prize: Ignoring the second half of the question presented, it argued that an Item 105 risk disclosure is always inherently forward-looking and that no reasonable investor would ever understand such a disclosure as making any representation about the occurrence or nonoccurrence of past events. Alone among the federal courts of appeals, the U.S. Court of Appeals for the Sixth Circuit endorsed that argument in a 2015 nonprecedential opinion in Bondali v. Yum! Brands Inc.⁸

In a savvy tactical move, the respondents told the court that they agreed with Meta about how to answer the question the court had agreed to decide: An undisclosed past event that presents no known risk of ongoing or future business harm could not give rise to liability under Section 10(b) because it by definition would be immaterial.

But, according to the respondents, the Ninth Circuit had not held anything to the contrary because the undisclosed event at issue here — Cambridge Analytica's misappropriation of the personal data of 30 million Facebook users — was clearly material under any standard and clearly presented a known risk to Meta's business at the time it filed its 10-K in February 2017. The respondents — supported by the U.S. — also argued that the bright-line judicial safe harbor Meta now sought for Item 105 disclosures was inconsistent with decades of precedent, SEC guidance and common sense.

When the Supreme Court heard argument on Nov. 6, the justices seemed genuinely confused by what they were hearing, with several of them — from both the conservative and liberal wings of the court — expressing concern that the arguments the parties were making did not address the question the court had taken the case to decide.

On one level, then, the court's subsequent dismissal of the writ as improvidently granted is not surprising, as it is known sometimes to take that tack when the parties ignore the question on which the court granted certiorari and instead at the merits stage argue a different question that the court might not have taken if it had been properly presented at the certiorari stage.

By dismissing the writ, the court leaves the parties and the state of the law where it found them. Practitioners and litigants in securities fraud cases remain free to make all the same arguments they were able to make before the court agreed to hear Meta's appeal.

But there may also have been a deeper reason for dismissing the appeal: This was not the right case for the court to wade into this particular morass.

The oral argument underscored how difficult and messy it sometimes actually is to determine whether the disclosure of a hypothetical risk is materially misleading because it fails to reveal the materialization of that same risk in the past. The justices were certainly skeptical of Meta's all-or-nothing proposed bright-line rule that Item 105 risk disclosures can never mislead investors about the past.

However, they also expressed some consternation at the sometimes-they-are-actionable-and-sometimes-not approach taken by the respondents and the U.S., which was grounded in traditional securities law principles governing materiality and the prohibition on misleading half-truths that by their nature are inherently fact-specific — and, in the case of materiality, often ill-suited to summary disposition.

Several members of the court — again, from different ends of the ideological spectrum — feared that the respondents' approach provided insufficient real-world guidance to companies that need to make these disclosures in their SEC filings without the benefit of knowing how a court or jury will later assess, or second-guess, their truthfulness.

When is a past event material? How recent or significant does it have to be to require disclosure? What if the past event's significance does not become apparent until after the risk disclosure is made? Under what circumstances is it appropriate to conclude that reasonable investors would likely know that the risk has materialized in the past even if the company does not expressly disclose that fact? How does the probabilistic assessment of risk factor into the analysis?

Numerous justices expressed concern that taking a case-by-case approach to these issues created too much real-world uncertainty for companies trying to comply with the securities laws, and would incentivize the overdisclosure of immaterial information — which everyone agreed would be counterproductive for investors — in order to mitigate the risk of shareholder lawsuits.

What role the SEC should play in helping to clear this thicket also came up. Justice Brett Kavanaugh, in particular, raised the question of whether the issues that had been aired in the case warrant further rulemaking by the SEC, which would have the ability to solicit wide public comment and balance the competing interests at issue in a way that might produce a better policy outcome than leaving the matter to the judiciary.

These issues are not going away, and the justices' comments during oral argument indicate that they recognize that some further clarification of the circumstances under which an Item 105 risk disclosure can be actionable under Section 10(b) for failure to disclose a past event is warranted.

Yet, they may have concluded that the particular event that Meta concealed was so obviously material that the case before it provided a poor vehicle for developing the applicable legal principles. So they decided to let matters rest for now.

It would not be surprising, however, for the court to revisit the parameters of securities fraud liability for Item 105 risk factor disclosures in an appropriate case, assuming the SEC does not do so first.

Thomas E. Redburn Jr. is a partner and chair of the securities litigation practice at Lowenstein Sandler LLP. Maya Ginsburg is counsel at the firm.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of their employer, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

Reprinted with permission from the December 9, 2024 edition of Law360 © 2024, Portfolio Media, Inc. All rights reserved.

¹ The other private securities fraud action is NVIDIA Corp. v. E. Ohman J:or Fonder AB, No. 93-270 (U.S.), which was argued before the Court on Nov. 13. 
² In re: Facebook, Inc. Securities Litigation, 87 F.4th 934 (9th Cir. 2023). 
³ 17 C.F.R. 229.105. 
⁴ Id.
⁵ E.g., FindWhat Inv. Grp. v. FindWhat.com, 658 F.3d 1282, 1299 (11th Cir. 2011) (cleaned up). 
⁶ In re: Alphabet, Inc. Securities Litigation, 1 F.4th 687, 703 (9th Cir. 2021) (quoting Berson v. Applied Signal Tech., Inc. 527 F.3d 982, 986 (9th Cir. 2008)). 
⁷ See, e.g., Ind. Pub. Ret. Sys. v. Pluralsight, Inc., 45 F.4th 1236, 1255 (10th Cir. 2022); Karth v. Keryx Biopharmaceuticals, Inc., 6 F.4th 123, 137-38 (1st Cir. 2021). 
⁸ Bondali v. Yum! Brands, Inc., 620 Fed. Appx. 483, 491 (6th Cir. 2015).