Antitrust Law Daily Wrap Up, PRIVACY NEWS: Children’s online gaming company settles FTC charges that it misrepresented “current” participant status in the U.S.-EU Safe Harbor Framework, (Feb 11, 2014)

By Jeffrey May, J.D.

Fantage.com, Inc., a children’s online entertainment company, has agreed to settle FTC charges that it misrepresented, expressly or by implication, that it was a “current” participant in the U.S.-EU Safe Harbor Framework when its self-certification under the program had lapsed (In the Matter of Fantage.com, Inc., FTC File No. 142 3026).

Fantage, which operates a multiplayer online role-playing game directed at children, set forth on its website, privacy policies, and statements about its practices, that it participated in the U.S-EU Safe Harbor Framework, according to the Commission’s complaint. The Safe Harbor framework allows U.S. companies to transfer data outside the EU consistent with European law. To join the Safe Harbor framework, a company must self-certify that it complies with a set of principles and related requirements that have been deemed by the European Commission as providing “adequate” privacy protection. These principles include notice, choice, onward transfer, security, data integrity, access, and enforcement.

The FTC alleged that Fantage falsely represented that it was a “current” participant in the U.S.-EU Safe Harbor Framework when, in fact, its self-certification had lapsed. In June 2011, Fantage submitted a Safe Harbor self-certification to the government; however, Fantage allegedly did not renew its self-certification in June 2012 and was subsequently deemed “not current” on the government’s website. In January 2014, Fantage renewed its self-certification to the Safe Harbor Framework, and its status was changed to “current.” While it was not certified, the company represented that it “follow[ed] the privacy principles of the U.S.-EU Safe Harbor Framework,” when collecting personal information from European Union residents, the FTC alleged.

The proposed FTC consent order would prohibit Fantage from making misrepresentations about its membership in any privacy or security program sponsored by the government or any other self-regulatory or standard-setting organization, including, but not limited to, the U.S.-EU Safe Harbor Framework. In addition, the settlement imposes certain reporting and compliance obligations on Fantage.

Last month, the FTC announced consent orders with twelve other entities (Apperian, Inc.; Atlanta Falcons Football Club, LLC; Baker Tilly Virchow Krause, LLP; BitTorrent, Inc.; Charles River Laboratories International, Inc.; DataMotion, Inc.; DDC Laboratories, Inc.; Level 3 Communications, LLC; PDB Sports, Ltd., d/b/a Denver Broncos Football Club; Reynolds Consumer Products, Inc.; Receivable Management Services Corporation; and Tennessee Football, Inc.) prohibiting misrepresentations about participation in a privacy or data security program sponsored by the government or any other self-regulatory or standard-setting. Those settlements are currently awaiting final Commission approval.

The actions underscore the need for companies to constantly monitor representations on their websites and in their privacy policies to ensure that they are completely accurate. If a company’s Safe Harbor self-certification lapses, it should immediately update its website to delete representations that suggest otherwise.

News: ConsumerProtection Privacy FederalTradeCommissionNews