Antitrust Law Daily Wrap Up, ADVERTISING NEWS: LifeLock to pay $100M to settle FTC contempt claims, (Dec 17, 2015)

By Greg Hammond, J.D.

The FTC has filed a stipulated order requiring LifeLock, Inc. to pay $100 million to settle FTC contempt claims that LifeLock violated the terms of a 2010 federal court order requiring the company to secure consumers’ personal information and prohibiting the company from engaging in deceptive advertising. The settlement marks the largest monetary award the FTC has obtained in an order enforcement action, the agency claims (FTC v. LifeLock, Inc., File No. X100023, Dkt. 2:10-cv-00530-MHM).

LifeLock violated the 2010 court order, the FTC alleged, by: (1) failing to establish and maintain a comprehensive information security program to protect users’ sensitive personal information, including their social security, credit card and bank account numbers; (2) falsely advertising that it protected consumers’ sensitive data with the same high-level safeguards used by financial institutions; (3) falsely advertising that it would send alerts as soon as it received any indication that a consumer may be a victim of identity theft; and (4) failing to abide by the order’s recordkeeping requirements.

Under the terms of the new settlement, LifeLock must remit $100 million into the court’s registry within five business days, $68 million of which may be used to provide consumer redress. In addition, the record keeping provisions have been extended to 13 years from the date of the original order.

Ohlhausen dissent. FTC Commissioner Maureen K. Ohlhausen filed a dissenting statement claiming that the record lacks clear and convincing evidence that LifeLock failed to establish and maintain a comprehensive information security program designed to protect the security, confidentiality, and integrity of consumers’ personal information. In particular, she noted that reputable third parties certified that LifeLock complied with the industry-standard Payment Card Industry Data Security Standard (PCI DSS) and other data security standards. However, the record, according to Ohlhausen, did not rebut the existence of LifeLock’s biennial PCI DSS or other certifications or show they were not performed by qualified, third-party professionals. There was also no evidence that LifeLock subscribers’ information suffered a breach, Ohlhausen wrote.

Companies: LifeLock, Inc.

News: Advertising ConsumerProtection Privacy FederalTradeCommissionNews