You Are Viewing FTC

Remove any P2P filesharing software from your network or be prepared to enter into a 20-year relationship with the Federal Trade Commission. This is what will happen to EPN, Inc., a debt collection business based in Provo, Utah and to Franklin’s Budget Car Sales, Inc., of Statesboro, Georgia, a car dealership. In both cases, the P2P software caused sensitive personal information of thousands of consumers to be accessible to users of other computers connected to the same peer-to-peer network.

On June 7, 2012, the FTC published proposed settlement agreements with these two businesses because they had allowed peer-to-peer file sharing software to be installed on their network.

The FTC case against EPN, Inc. alleges that the lack of security measures at the company allowed the company’s COO to install P2P file-sharing software on the company’s network. As a result, sensitive information including Social Security numbers, health insurance numbers, and medical diagnosis codes of 3,800 hospital patients were available to any computer connected to the P2P network.

The case against Franklin’s Budget Car Sales, Inc. alleges that the installation of P2P software on the company’s network resulted in sensitive financial information of 95,000 consumers such as, names, addresses, Social Security Numbers, dates of birth, and driver’s license numbers to be made available on the P2P network.

In both cases, the companies were charged with failure to observe commonly used best practices:

• Failure to have an appropriate information security plan;
• Failure to assess risks to the consumer information collected and stored online;
• Failure to use reasonable measures to ensure security of the network, such as scanning its networks to identify any P2P file-sharing applications operating on them
• Failure to adopt policies to prevent or limit unauthorized disclosure of information;
• Failure to prevent, detect and investigate unauthorized access to personal information on the company’s networks;
• Failure to adequately train employees;
• Failure to employ reasonable measures to respond to unauthorized access to personal information.

Failure to implement reasonable and appropriate data security measures as described above was an unfair act or practice and violated federal law, namely Section 5 of the FTC Act. In addition, Franklin Car Sales, as a “financial institution” subject to the Gramm-Leach-Bliley Act (GLBA) was found to have violated both the GLBA Safeguards Rule and Privacy Rule by failing to provide annual privacy notices and a mechanism by which consumers could opt out of information sharing with third parties.

The proposed consent order against EPN and Franklin would require the companies to establish and maintain comprehensive information security programs, and cease any misrepresentation about their data handling practices. The settlement orders with the two companies are substantially similar. They:

• Bar any future misrepresentations about the privacy, security, confidentiality, and integrity of any personal information;
• Require the companies to establish and maintain a comprehensive information security program; and
• Require the companies to undergo data security audits by independent auditors every other year for 20 years.

As always with FTC consent orders, each violation of such an order may result in a civil penalty of up to $16,000.

On May 8, 2012, Myspace agreed to settle Federal Trade Commission charges that it misrepresented its protection of users’ personal information.

The two majors issues at stake were misrepresentation of privacy practices, and misrepresentation of compliance with Safe Harbor principles.

Misrepresentation of Privacy Practices

Myspace assigns a persistent unique identifier, called a “Friend ID,” to each profile created on Myspace. A user’s profile may publicly display the user’s name, age, gender, picture, hobbies, interests, and lists of users’ friends. 

The Myspace privacy policy promised that it would not share a user’s personally identifiable information, or use such information in a way that was inconsistent with the purpose for which it was submitted, without prior notice to, and consent from, the user. It also promised that the information used to customize ads would not identify users to third parties and would not share non-anonymized browsing activity.

The FTC charged that Myspace provided advertisers with the Friend ID of users who were viewing particular pages on the site. Advertisers could use the Friend ID to locate a user’s Myspace profile and obtain personal information publicly available on the profile. Advertisers also could combine the user’s real name and other personal information with additional information to link broader web-browsing activity to a specific individual.

Misrepresentation of Compliance with Safe Harbor Principles

Myspace certified that it complied with the U.S.-EU Safe Harbor principles, which include a requirement that consumers be given notice of how their information will be used and the choice to opt out.

The FTC alleged that the way in which Myspace handled personal information was inconsistent with its representations of compliance with the Safe Harbor principles.

Proposed Settlement

The proposed settlement order would:

• Bar Myspace from misrepresenting the extent to which it 
protects the privacy of users’ personal information
• Bar Myspace from misrepresenting the extent to which it belongs to or complies with any privacy, security or other compliance program, including the U.S.-EU Safe Harbor Framework.
• Require Myspace to establish a comprehensive privacy program designed to protect consumers’ information;
• Require Myspace to obtain biennial assessments of its privacy program by independent, third party auditors for 20 years.
• Expose Myspace to a civil penalty of up to $16,000 for each future violation, if any, of the consent order.

The proposed settlement is open for comments; it will be finalized and will become effective after the end of the comment period.

The Federal Trade Commission annual report on complaints filed by consumers, released on February 28, 2012, provides a list of the top consumer complaints received by the agency in 2011. For the 12th year in a row, identity theft complaints topped the list.

Of more than 1.8 million complaints filed in 2011, 279,156 or 15 percent, were identity theft complaints. In the past three years, the number of identity theft complaints has significantly declined: from 20% in 2009 to 15% in 2011.

The report also indicates that the number of complaints for credit card fraud has declined by 3 percentage points since 2009, from 17 percent in 2009 to 14 percent in 2011. It is clear that, despite their shortcomings, the security breach disclosure laws have contributed to raising companies and consumers’ awareness, and to identifying security incidents faster and more easily. As a result, credit card companies have been in a better position to promptly block stolen cards or credit card numbers.

On the other hand, the number of identity theft complaints related to tax- or wage-related fraud has doubled since 2009, jumping from 12.7% percent to 24.1 percent in 2011. This area clearly needs more attention. Proper measures need to be identified to reduce this type of fraud.

The 103 page Report breaks out complaint data on a state-by-state basis and contains data about the 50 metropolitan areas reporting the highest per capita incidence of fraud and other complaints. Florida, Georgia, and California have received the highest number of identity theft complaints (computed per capita), while Maine, and North & South Dakota received the smallest number of identity theft complaints.

The Decision and Order settling charges by the Federal Trade Commission that Google used deceptive tactics and violated its own privacy promises to consumers when it launched its social network, Google Buzz, in 2010 became final as of October 24, 2011. Google is barred from future privacy misrepresentations, is required to implement a comprehensive privacy program, and must submit to independent privacy audits every other year, for the next 20 years.

The finalization of the Order gave me an opportunity to refresh my recollections about the terms of the settlement, and reflect upon them.  There are, indeed, many lessons to learn from the FTC – Google settlement:

What is a Comprehensive Privacy Program

The Google settlement order is the first one where the FTC requires a company to implement a comprehensive privacy program to protect the privacy of consumers’ personal information. As a result, there is now FTC guidance on the components of a comprehensive privacy program: from designating an individual responsible for the program, to identifying and assessing the risks that could result from the unauthorized collection, use or disclosure of personal information, to designing and implementing reasonable privacy controls and procedures, and training the personnel and supervising service providers.

What Personal Information is to be Protected

The Google settlement applies to “covered information.” The size of the universe of personal information to be protected is significant. It is much broader than “sensitive information” i.e. social security numbers, credit card and financial information, identity information, and the like, a limited, narrow group of personal information that too many view as the only personal information that must be protected. The “covered information” (or protected information) in the Google order encompasses all of the information that is collected from or about an individual, including, but not limited to, an individual’s:

• First and last name;
• Home or other physical address, including street name and city or town;
• Email address or other online contact information, such as a user identifier or screen name;
• Persistent identifier, such as IP address;
• Telephone number, including home telephone number and mobile telephone number;
• List of contacts;
• Physical location; or
• Any other information from or about an individual consumer that is combined with the above.

In other words, if you collect it, you have to protect it. This is a reminder that personal information need not be confidential, secret, or strategic to require protection.

How to Make a Material Change to a Policy

There is also specific guidance on how to implement a change in policy with respect to the sharing of personal information. If the personal data handling practices that were in effect when the company collected personal information change, the company must:

• Obtain express, affirmative users’ consent before sharing their information with third parties, and
• Prominently disclose, separate from any privacy policy, terms of use or similar document:  that the user’s information will be disclosed to one or more third parties; the identity or specific categories of such third parties; and the purpose(s) for sharing this information.

Safe Harbor Promises Must be Kept

The Google settlement order is also the first time that the FTC has alleges violations of the substantive privacy requirements of the U.S.-EU Safe Harbor Framework. Safe Harbor promises must be kept. It not enough to fill out a form and ignore the commitments made.

Privacy Promises Must be Kept

Misrepresenting the extent to which the privacy and confidentiality of personal information is maintained is not acceptable. A company may not misrepresent the purposes for which it collects and uses the information, and the extent to which consumers may exercise control over the collection, use, or disclosure of personal information. When promises are made, they must be kept.

If one Product fails, the Entire Company will Bear the Consequences

Finally, the FTC Settlement does not cover just the Google Buzz and Gmail products. It applies broadly to all products and services of Google. For a large company like Google, the repercussions of a single error are extensive and significant. Do not assume that a little mistake can only have little consequences.

Now, Google has twenty years to think about what it could have done better, and how it could have avoided to be elected to the FTC’s Hall of Shame. May the lessons from the FTC Google settlement order be learned by other companies.

A proposed Federal Trade Commission consent order applicable to Ceridian Corporation, establishes that failure to protect against potential SQL injection attacks is an “unfair practice” actionable under Section 5 of the FTC Act. Despite representations that it maintained “worry-free safety and reliability” and that it had a security program designed in accordance with the ISO 27000 standard, the company’s security system had several flaws. Among other things, Ceridian failed to use readily available defenses to SQL attacks. When a successful SQL attack caused the exposure of sensitive personal information of nearly 28,000 individuals, the FTC initiated an enforcement action.  This action lead to the development of the proposed FTC consent order, which was published on May 3, 2011.

Ceridian operates the Powerpay website, and provides payroll processing, payroll-related tax filing, benefits administration, and other human resource services. Customers enter their employees’ personal information, Social Security numbers, dates of birth, home addresses, bank account and other information on the website. This information is transmitted to Ceridian’s computer network, where payroll amounts are computed, payroll checks are processed, and direct deposits initiated.

Ceridian stored personal information in clear, readable text for an indefinite period of time, and failed to employ reasonable measures to detect and prevent unauthorized access to personal information. Hackers executed an SQL injection attack on the Ceridian system. These deficiencies allowed the SQL injection attack to succeed, and the personal information of individuals to be exposed.

The proposed FTC consent order is consistent with prior consent orders issued in similar circumstances. What makes the Ceridian case interesting is the list of acts and deficiencies that the FTC identifies as having created vulnerabilities and that should have been avoided. The FTC complaint against Ceridian notes in particular the following security deficiencies:

• Storing information in clear, readable text;
• Storing information indefinitely, and for longer than needed;
• Failure to assess the vulnerability of the system to known or reasonably foreseeable attacks such as SQL injection attacks;
• Failure to use readily available, free, or low-cost defenses to SQL attacks; and
• Failure to employ reasonable measures to detect and prevent unauthorized access to personal information.

This list provides examples of the minimum measures that the FTC expects from a security system intended to protect personal information such as financial information or social security numbers. Of note, in particular, is the need to have in place systems and defenses that resist SQL injection attacks and other known or reasonably foreseeable attacks.
The proposed consent decree establishes a 20-year supervision period, during which Ceridian will be required to obtain and provide, or make available to the FTC, on a biennial basis, an assessment and report from a qualified third-party professional, certifying that it has in place a security program that meets or exceeds specified requirements, and that provides reasonable assurance that the security, confidentiality, and integrity of personal information in the company’s custody is protected. The security program must contain administrative, technical, and physical safeguards appropriate to Ceridian’s size and complexity, the nature and scope of its activities, and the sensitivity of the information collected from or about consumers and employees. Specifically, the proposed order requires Ceridian to:

• Designate one or several employees to coordinate and be accountable for the information security program;
• Identify material risks to the security, confidentiality, and integrity of personal information and assess the sufficiency of any safeguards in place to control these risks;
• Design and implement reasonable safeguards to control these risks;
• Regularly test or monitor the effectiveness of the safeguards’ key controls, systems, and procedures;
• Develop and use reasonable steps to select and retain service providers capable of appropriately safeguarding personal information of Ceridian’s clients;
• Require service providers by contract to implement and maintain appropriate safeguards; and
• Evaluate and adjust its information security programs in light of the results of testing and monitoring, and of any material changes to operations or business arrangements.

For over 10 years the Federal Trade Commission has had an active, leading role in defining the basic requirements for the collection, use, storage, disclosure and protection of personal information. During this period, the consent decrees issued by the Federal Trade Commission have identified the security practices that the FTC deems unacceptable. These consent decrees provide a clear view on the expectation of the regulators.  With Ceridian, it is now established that protecting against SQL injection attacks is an essential, basic, requirement for a reasonable information security program.