Antitrust Law Daily Wrap Up, PRIVACY NEWS: Cord Blood Bank Settles FTC’s Data Security Failure Claims, (Jan 28, 2013)

The operator of a leading umbilical cord blood and tissue bank, Cbr Systems, Inc., has agreed to settle FTC charges that it failed to protect the security of customers’ personal information, and that its inadequate security practices contributed to a breach that exposed Social Security numbers and credit and debit card numbers of nearly 300,000 consumers (In the Matter of CBR Systems, Inc., FTC File No. 112 3120, announced January 28, 2013).

The proposed settlement would require Cbr to establish and maintain a comprehensive information security program and submit to security audits by independent auditors every other year for 20 years. The settlement also would bar Cbr from misrepresenting its privacy and security practices.

In its privacy policy, Cbr claimed that “[w]henever CBR handles personal information, regardless of where this occurs, CBR takes steps to ensure that your information is treated securely and in accordance with the relevant Terms of Service and this Privacy Policy… ”

However, according to the FTC, Cbr failed to use reasonable and appropriate procedures for handling customers’ personal information, making its privacy policy claim deceptive under the FTC Act. According to the complaint, Cbr did not have reasonable policies and procedures to protect the security of information it collected and maintained. In addition, Cbr allegedly created unnecessary risks to personal information by, among other things, transporting backup tapes, a thumb drive, and other portable data storage devices containing personal information in a way that made the information vulnerable to theft. According to the FTC, Cbr also failed to take sufficient measures to prevent, detect, and investigate unauthorized access to computer networks.

The FTC charged that Cbr’s failures to provide reasonable and appropriate security for consumers’ personal information contributed to a December 2010 security breach during which unencrypted backup tapes containing consumers’ personal information, a Cbr laptop, a Cbr external hard drive, and a Cbr USB drive were stolen from a Cbr employee’s personal vehicle in San Francisco, California. According to the complaint, the unencrypted backup tapes included, in some cases, the names, gender, Social Security numbers, dates and times of birth, drivers’ license numbers, credit and debit card numbers, card expiration dates, checking account numbers, addresses, email addresses, telephone number and adoption type (e.g., open, closed, or surrogate) of approximately 298,000 Cbr customers.

The FTC complaint also alleges that the unencrypted Cbr laptop and unencrypted Cbr external hard drive contained network information, including passwords and protocols, that could have permitted an intruder to access Cbr’s network, where sensitive personal health information was stored.

Companies: Cbr Systems, Inc.

News: Privacy ConsumerProtection FederalTradeCommissionNews