Header graphic for print
HL Chronicle of Data Protection Privacy & Information Security News & Trends

Tag Archives: FTC

Posted in Cybersecurity & Data Breaches, Privacy & Security Litigation

Federal Judge Upholds FTC’s Authority to Regulate Commercial Data Security Practices

A New Jersey federal judge yesterday issued the much-anticipated opinion in Federal Trade Commission v. Wyndham Worldwide Corp., denying Wyndham’s challenge to the FTC’s authority to regulate data security under Section 5 of the FTC Act. Although it only represents one district court’s findings on the issue, and was not a complete surprise given some of the judge’s statements during oral argument, the Commission for now has dodged a major bullet that threatened to derail its status as the lead commercial data security regulator in the United States.

Posted in Consumer Privacy

FTC Continues to Enforce Security Statements

The Federal Trade Commission (“FTC”) has settled with two mobile application developers, Fandango and Credit Karma, over charges that they misrepresented the security of their mobile applications. According to the FTC, the developers failed to provide reasonable and appropriate security when their mobile applications transmitted consumers’ sensitive information. The particular issues noted by the FTC in its complaints against the developers differ to some degree, but the complaints share a common thread: the developers disabled the Secure Sockets Layer (SSL) protocol, which authenticates and encrypts communications across networks. In our post, we provide a high-level description of how SSL works, summarize the FTC’s complaints against Fandango and Credit Karma, and identify some important takeaways from these settlements.

Posted in News & Events

Hogan Lovells Engages at IAPP Global Privacy Summit

The Hogan Lovells Privacy Team looks forward to seeing many of you this week at the International Association of Privacy Professionals (IAPP) Global Privacy Summit in Washington, D.C. We are delighted to once again participate in the Summit as a gold level sponsor and hope you will visit us at Booth 7 in the Exhibition Hall to learn more about our Global Privacy and Information Management Practice. Hogan Lovells attorneys will also be featured at a number of breakout sessions.

Posted in Cybersecurity & Data Breaches, Health Privacy/HIPAA

FTC Data Security Settlement Highlights Need for Third-Party Vendor Management and Oversight

On January 31, the Federal Trade Commission announced a settlement with GMR Transcription Services following the public exposure of thousands of medical transcript files containing personal medical information. According to the FTC complaint, GMR failed to adequately verify that its overseas service provider implemented reasonable and appropriate security measures to protect personal information being transmitted and processed. This settlement, the FTC’s 50th with respect to data security, highlights the need for companies to engage in thorough vendor management and oversight with respect to data security practices.

Posted in Cybersecurity & Data Breaches, Health Privacy/HIPAA, Privacy & Security Litigation

LabMD Blames its Shutdown on FTC Legal Battle over Security Protections

LabMD recently announced its plans to wind down operations, citing its ongoing legal battle with the Federal Trade Commission over the company’s data security practices as a major cause. In a letter dated January 6, LabMD president Michael Daugherty informed the company’s customers and workforce that the medical testing laboratory would no longer be accepting new specimens after January 11 and that the company’s phones and internet access would be discontinued shortly thereafter. Daugherty’s letter blamed the FTC’s “debilitating investigation and litigation” as a major source of the company’s decision to wind down operations.

Posted in Consumer Privacy, International/EU Privacy

FTC Settles Actions Against Twelve Companies for Improperly Representing Safe Harbor Certification

Less than two months after the European Commission issued a report urging the Federal Trade Commission to step up enforcement of the EU-U.S. Safe Harbor framework, the FTC announced a settlement with twelve companies — including an Internet service provider, makers of consumer goods, three National Football League teams, and a developer of mobile applications — over allegations that they deceptively claimed to be certified under Safe Harbor. According to the FTC, each of these companies represented that they maintained a active Safe Harbor certification with the U.S. Department of Commerce when in fact they did not.

Posted in Consumer Privacy

FTC Approves New Method for Obtaining COPPA Verifiable Parental Consent

The Federal Trade Commission (FTC) recently approved appropriately implemented “knowledge-based authentication” as a method for obtaining verifiable parental consent (VPC) under the Children’s Online Protection Act (COPPA). To be “appropriately implemented,” operators should assess whether any knowledge-based authentication technology:
•Generates “dynamic, multiple choice questions”;
•Asks “a reasonable number of questions with an adequate number of possible answers” to ensure that “the probability of correctly guessing the answer is low”; and
•Uses “questions of sufficient difficulty that a child age 12 or under in the parent’s household could not reasonably ascertain the answers.”

The FTC’s action provides online operators some welcome flexibility in implementing COPPA-compliant VPC strategies and demonstrates that the FTC will give serious consideration to VPC proposals.

Posted in Social Media

Financial Regulators Finalize Social Media Guidance and Address Industry Questions

The Federal Financial Institutions Examination Council (FFIEC) has released final supervisory guidance on the use of social media by financial institutions. We last reported on the guidance when it was published in draft form in January 2013. The final guidance is substantially similar to the proposal (and we encourage you to read our prior post for more details on the elements of the guidance), but the FFIEC made certain revisions in light of the 81 public comments it received on the proposal.

Posted in Consumer Privacy, News & Events

Privacy a Top Agenda Item for FTC, NTIA Entering 2014

With the new year fast approaching, the Federal Trade Commission and the National Telecommunications & Information Administration, a bureau within the Department of Commerce, recently announced a number of privacy initiatives for 2014 that will break new ground for both agencies and will impact a wide array of industries.

Posted in Consumer Privacy

New Paper Considers Privacy Paradigm for Internet of Things

  A new paper published by the Future of Privacy Forum examines the appropriate privacy paradigm for the world of the Internet of Things.  The paper was co-authored by Hogan Lovells Privacy and Information Management practice leader Christopher Wolf who also is the founder and co-chair of the Future of Privacy Forum (with co-author Jules Polonetsky).  The [...]

Posted in Consumer Privacy

IAPP Piece Sets Stage for Upcoming Internet of Things Workshop

On November 19, 2013 the Federal Trade Commission will hold its first ever workshop on the Internet of Things. The Workshop does not aim to debate regulation or codes of conduct, but is rather a fact finding mission aimed at uncovering the privacy and security concerns inherent in the Internet of Things, where a range of devices collect and communicate personal information perpetually.

Posted in Consumer Privacy, Privacy & Security Litigation

FTC Settles Case Against “Rent-to-Own” Franchisor that Guided Franchisees’ Use of Spyware

On October 22, the FTC announced a settlement with national “rent-to-own” retailer Aaron’s, Inc. on charges that it knowingly assisted its franchisees in tacitly collecting images and information about their customers. Specifically, the FTC alleges that Aaron’s “played a direct and vital role in its franchisees’ installation and use of software on rental computers that secretly monitored consumers including taking webcam pictures of them in their homes.”

Posted in Consumer Privacy

Hogan Lovells Contributes Focus on Privacy and Trade to Global Privacy Meeting

At the 35th annual Conference of Data Protection Authorities and Privacy Commissioners in Warsaw, Poland today, Hogan Lovells partner and privacy practice lead Christopher Wolf spoke on the issue of privacy and trade in light of the ongoing Transatlantic Trade and Investment Partnership negotiations between the EU and the U.S. This post contains prepared remarks to the commissioner’s on the need for interoperable cross-border privacy standards and the merits of the U.S. privacy regime.

Posted in Cybersecurity & Data Breaches, Health Privacy/HIPAA, Privacy & Security Litigation

FTC Files Complaint Against Healthcare Company LabMD, Alleging Inadequate Security Controls

On August 28, the Federal Trade Commission (FTC) filed an administrative complaint against medical testing laboratory LabMD based on allegations that the company engaged in “unfair acts or practices” by failing to employ “reasonable and appropriate measures to prevent unauthorized access to personal information.” The FTC’s action in this case stems from an incident in which a file containing personal information on approximately 9,300 individuals allegedly was shared on a peer-to-peer (P2P) network from a company computer with P2P file-sharing software installed. The complaint follows other recent FTC actions in which the agency has relied on its Section 5 authority under the FTC Act to claim that companies’ exposure of data to P2P networks constituted an unlawful, unfair data security practice. The FTC’s action against LabMD makes clear that institutions governed by the Health Insurance Portability and Accountability Act (HIPAA) must also be mindful of the FTC’s increasing enforcement activity related to security controls, including actions against healthcare providers.

Posted in Consumer Privacy, Financial Privacy

FTC Issues New Red Flags Rule Guidance

The Federal Trade Commission (“FTC”) recently issued a revised guidance (“Guide”) on the Red Flags Rule (“Rule”) (see “Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business”). The Red Flags Rule requires certain businesses to develop, implement and administer an identity theft protection program. The purpose of this Guide is to [...]

Posted in Consumer Privacy

FTC Votes to Retain July 1, 2013 COPPA Rule Compliance Date

Less than two weeks after providing additional guidance on the recent changes to the Children’s Online Privacy Protection Act (“COPPA”) Rule, in the form of updated Frequently Asked Questions, the Federal Trade Commission (“FTC”) voted unanimously to retain the July 1, 2013 effective date for the changes to the COPPA Rule.

Posted in Privacy & Security Litigation

Limiting Litigation Risks from Privacy and Data Security Missteps

In Bloomberg BNA’s Privacy and Security Law Report, Hogan Lovells attorneys Des Hogan, Michelle Kisloff, and Chris Wolf have published an article addressing the increased litigation and regulatory risks that companies must address in the evolving privacy and data security landscape. After summarizing recent developments involving class actions and regulatory activities, the article offers guidance on how companies can reduce their financial and reputational exposure.

Posted in Consumer Privacy

FTC Updates Guidelines for Online Advertising Disclosures

Recognizing the changes enabled by mobile devices and social technologies, the Federal Trade Commission has published the first update in over twelve years of its guidelines for online advertising. The new guide, .com Disclosures: How to Make Effective Disclosures in Digital Advertising, parallels the 2000 original, Dot Com Disclosures: Information About Online Advertising, and uses much [...]

Posted in Consumer Privacy, Financial Privacy

FTC Issues Report on Emerging Mobile Payments Services

There has been an explosion in the number and variety of mobile payment services available to consumers in the last couple of years, with new innovations and players growing exponentially. The release of the Federal Trade Commission’s (FTC) March 8, 2013 staff report, “Paper, Plastic… or Mobile? An FTC Workshop on Mobile Payments,” indicates the potential [...]

Posted in Consumer Privacy

FTC Text Spam Enforcement on the Rise

On March 7, the FTC announced a major new initiative cracking down on text message spammers and drove home the point by commencing eight new lawsuits against alleged spammers. In eight complaints filed in four different federal courts across the country, the FTC has charged a total of twenty-nine defendants, alleging that they collectively sent [...]

Posted in Consumer Privacy, News & Events, Social Media

FTC Releases Mobile Privacy Report and Announces Settlement with Mobile App Operator

Today the FTC released Mobile Privacy Disclosures: Building Trust Through Transparency, a report containing recommendations for the mobile industry.  The report encourages mobile app platforms to play a significant role in providing consumers with privacy-related information, devoting more pages to recommendations for platforms than it does for developers, ad networks, third-party service providers, and trade [...]

Posted in Consumer Privacy

The FTC Revised COPPA Rule: Reflections After a Night to Sleep on It

Yesterday saw dozens of instant summaries of the Federal Trade Commission’s long- awaited revision to the Children’s Online Privacy Protection Act (COPPA) Rule, which becomes effective on July 1, 2013.  We took a night “to sleep on it,” in order provide not just a summary, but some focused comments about the impact of yesterday’s rule [...]

Posted in Consumer Privacy, Cybersecurity & Data Breaches, Financial Privacy

FTC Amends Red Flags Rule to Adopt Narrower Definition of “Creditor”

The FTC has issued an interim final rule to amend the Identity Theft “Red Flags Rule,” which requires certain “financial institutions” and “creditors” to develop and implement a written identity theft prevention program to identity, detect, and respond to possible incidents of identity theft.  The interim rule amendment conforms the Red Flag’s Rule’s definition of [...]