US-EU Safe Harbor: FTC Proposed Consent Orders with 12 companies for false claims.

Yesterday the FTC announced proposed consent orders with twelve companies that falsely claimed compliance with the Safe Harbor framework.  Interestingly it involved a broad range of companies, including collection agencies and NFL teams(!):

• Apperian, Inc.: Company specializing in mobile applications for business enterprises and security;
• Atlanta Falcons Football Club, LLC: National Football League team;
• Baker Tilly Virchow Krause, LLP: Accounting firm;
• BitTorrent, Inc.: Provider of peer-to-peer (P2P) file sharing protocol;
• Charles River Laboratories International, Inc.: Global developer of early-stage drug discovery processes;
• DataMotion, Inc.: Provider of platform for encrypted email and secure file transport;
• DDC Laboratories, Inc.: DNA testing lab and the world’s largest paternity testing company;
• Level 3 Communications, LLC: One of the six largest ISPs in the world;
• PDB Sports, Ltd., d/b/a Denver Broncos Football Club: National Football League team;
• Reynolds Consumer Products Inc.: Maker of foil and other consumer products;
• Receivable Management Services Corporation: Global provider of accounts receivable, third-party recovery, bankruptcy and other services; and
• Tennessee Football, Inc.: National Football League team.

The companies were previously certified, but allowed their certifications to lapse. However, their privacy statements continued to claim they were in compliance, which in turn is a violation of Section 5 of the FTC Act. The FTC did not assert data violations per se, but focused only upon disclosure violations. EU data protection authorities have complained for some time that companies either do not due adequate due diligence of their own practices behind their certifications or let their certifications lapse with impunity.

The moral of the story? Make privacy review and recertification an annual event!

Also, the settlement allows for interested persons to provide public comments on the proposed consent orders through February 20, 2014 before making the consent orders final. We recommend our clients follow this process because it should be enlightening. We will continue to post on the status of this...  Stay tuned!

Read More...