Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC seeks information on data security auditing in credit card industry, (Mar 7, 2016)

By Michael Menzhuber, J.D., LL.M.

Nine companies have been issued orders requiring them to provide the Federal Trade Commission (FTC) with information on how they conduct assessments of companies to measure their compliance with the Payment Card Industry Data Security Standards (PCI DSS), the agency announced today. The orders were issued following the FTC adoption of a March 4, 2016, resolution—“Resolution Directing Use of Compulsory Process to Collect Information Regarding Data Security Auditors.”

In its effort to gain insight into data security compliance auditing and its role in protecting consumers’ information and privacy, the FTC is seeking details about the assessment process employed by the nine companies, including: (1) the ways assessors and companies they assess interact; (2) copies of a limited set of example PCI DSS assessments; and (3) information on additional services provided by the companies, including forensic audits.

PCI DSS audits are required by the major payment card issuing companies of retailers and other business that process more than 1 million card transactions in a given year. They are intended to ensure that companies are providing adequate protection to consumers’ sensitive personal information.

The nine companies receiving the FTC orders—including Foresite MSP, LLC; Feed Maxick CPAs, P.C.; GuidePoint Security, LLC; Mandiant; NDB LLP; PricewaterhouseCoopers LLP; SecurityMetrics; Sword and Shield Enterprise Security; Inc.; and Verizon Enterprise Solutions (also known as CyberTrust)—are required to file their special reports containing the requested information and documents within 45 days after the date of service.

News: ConsumerProtection FederalTradeCommissionNews