Employee Use of P2P Software Results in FTC Enforcement Actions

By Mehmet Munur

The Federal Trade Commission announced that it brought two separate enforcement actions against a debt collector and a car dealership because of the unauthorized sharing of sensitive personal information through P2P network software installed by their employees. As is common in most FTC enforcement actions, the companies will be required to cease misrepresentations about privacy and security of personal information, maintain a comprehensive information security program, and submit to third-party security audits for 20 years. These enforcement actions, once again, point to the importance of having privacy policies that align with privacy practices and the importance of having reasonable security practices in place.

The FTC complaint against the debt collector, EPN, alleges that it collected personal information without reasonable and appropriate security. EPN collected name, address, date of birth, gender, Social Security number, employer address, employer phone number, and in the case of healthcare clients, physician name, insurance number, diagnosis code, and medical visit type from its clients for debt collection purposes. EPN’s Chief Operating Officer installed a P2P application on its systems. One of its clients found the files shared on the same network and alerted EPN about it. In fact, EPN shared through this P2P application information about 3800 individuals. EPN did not have a business need for the application. FTC stated that EPN did not have an incident response plan, risk assessment, measures against P2P software use by its employees, and procedures for detecting unauthorized access to personal information. FTC alleged that these were unfair and deceptive practices under the FTC act.

It is interesting that the FTC did not point to a privacy policy for representations relating to the privacy and security of the information collected by EPN—even though EPN, doing business as Checknet, Inc., has a website privacy policy. However, the privacy policy does not have an effective date and it may have been added after the FTC investigation began.

The FTC complaint against the car dealer, Franklin’s Budget Car Sales, alleges that the dealership shared a privacy notice with its customers stating that it would restrict access to non-public personal information and that it maintained physical, electronic, and procedural safeguards that complying with federal regulations. The dealership then collected personal information such as names, Social Security numbers, addresses, telephone numbers, dates of birth, and drivers’ license numbers from consumers. FTC also alleges that the dealership did not provide an annual notice. Currently, Franklin Toyota’s website privacy policy shows the model privacy clauses—instead of a web privacy policy. They are also still the model form—without some of the choices for creating the form having been made. FTC alleges that the dealership failed to put into place reasonable security procedures—similar to EPN’s alleged failures. As a result of those failures, information relating to 95,000 consumers was shared on the P2P networks. Therefore, the FTC alleged violations of the Section 5 of the FTC Act (for misrepresenting its privacy and security measures in its privacy notice), Safeguards Rule of the GLBA (for failing to implement reasonable security practices), and the Privacy Rule of the GLBA (for failure to send annual privacy policies).

Both companies agreed to similar terms as a result of these complaints. The consent order with the dealership requires it not to misrepresent its privacy, security, and confidentiality of personal information it collects nor violate GLBA. It also requires the dealership to designate an employee accountable for information security, conduct a risk assessment, design and implement reasonable safeguards, among other things. The dealership must also submit to third-party assessments once every two years for 20 years. The debt collector’s consent order is similar—but for the GLBA requirements.

There are several lessons to be learned from the enforcement actions—some new, some old.

First, the enforcement action highlights the importance of having a privacy policy and abiding by the letter and spirit of that privacy policy to avoid an enforcement action under the FTC Act. Google, Facebook, Twitter and others ran into this same trap of having a privacy policy that did not align with their privacy and security practices.

Second, failure to have reasonable security without making any representations regarding the importance of privacy and security to an organization can still result in an enforcement action—especially where the harm to consumers may include sharing of sensitive personal information. Here, the FTC seemed perturbed by the fact that some of the personal information shared with the P2P networks may never be taken out of circulation due to the decentralized nature of P2P networks. In fact, some of this information likely included information relating to healthcare procedures.

Finally, the FTC appears to be following a “study, report, then bring enforcement actions” plan for topics of interest—as any reasonable regulator should. In the P2P space, the FTC obtained comments and looked at consumer protection and competition issues in a 2005 staff report. More recently, the FTC completed a study on widespread data breaches as a result of P2P software use by businesses in 2010 and notified about 100 organizations. The FTC also published guides for consumers and businesses relating to the P2P software use. Then, the FTC had an enforcement action against Frostwire LLC for the default settings in the P2P software that shared too much personal information. Now, the FTC brings this enforcement action against businesses that cause breaches due to the use of P2P software. The FTC has been following a similar study-report-bring-enforcement-actions plan with mobile privacy, mobile payments, and behavioral advertising issues. Therefore, I would expect more enforcement actions in those fields as a result of the plan FTC has been carrying out in this P2P area.

These latest enforcement actions are reminders that businesses must pay attention to their privacy and security practices or risk being subject to onerous consent orders prescribing privacy and security programs.

Read More...

New England Banks to Sue TJX

The Boston Globe reports that a group of New England banks are planning to sue TJX Cos. over TJX's data breach.

Read More...

Data Breaches and Buyer Behavior

Javelin Strategy & Research has a study for purchase entitled "Data Breaches and Buyer Behavior: Moving PCI Compliance from Costly Burden to Competitive Advantage" (link is to the free preview).

Hat tip to Payments News which states:

The study concludes that "77% of consumers intend to stop shopping at merchants that suffer from data breaches. Retailers and merchants are viewed by 63% of consumers as the least secure when protecting consumer’s data, compared with processors (16%), card networks like Visa or MasterCard (5%) and issuers (5%). When little is known about a data breach, half of all consumers automatically consider the merchants where they shop to be at fault. However, 85% will reward merchants who are perceived as security leaders with increased purchases."

Read More...

TJX Companies 10K on Computer Intrusions

This InternetNews story says that TJX Companies, Inc. revealed to the SEC that as many as 47.5 million customer records were stolen during TJX's highly publicized computer intrusion. For those interested, here's TJX's 10-K filing. Pages 7-10 are devoted to a discussion of the computer intrusion and pages 18-21 detail the 19 legal proceedings related to the computer intrusion. Page 21 also details the various government investigations in regards to the computer intrusion.

Obviously, the security breach will not be cheap for TJX.

Recent News Stories:

• State cracks down on identity theft in wake of TJX security breach
• TJX customers subject to security breach
• How the TJX breach may change security awareness
• Do data breaches really hurt retailers?
• Locals upset at TJX Companies security breach
• TJX security breach affected at least 47.5m
• Revealed: World's largest security breach

Read More...

Ohio Senate Bill No. 6

Senate Bill Number 6 was introduced:

• to allow consumers to place a security freeze on the consumer's credit report
• to specify that Social Security numbers are confidential
• to specify that certain personal information is not a public record
• to require a public office to redact from a document that is otherwise a public record certain personal information
• to require a public office to redact Social Security numbers and other confidential information from any document that is made available online to the public through the Internet
• to require the Office of Criminal Justice Services to make state funding grants available to local law enforcement agencies for enforcement of identity fraud laws
• to require the attorney general to support local law enforcement agencies with the enforcement of identity fraud laws, and
• to enact a special statute of limitations for criminal prosecutions and civil actions against identity fraud

The bill, if passed, would help erase the problem reported last year where a number of records from the Ohio Secretary of State's Office was displayed with Social Security numbers.

While I agree that government websites should not post information such as SSN's on their websites, I expect that this bill would either cost taxpayers money to find and redact SSN's already posted (which is not a trivial task). Alternatively, some agencies may take the information offline as they assess the scope of confidential information contained in their online records.

Read More...