Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC actions to protect consumer privacy outlined by Director Rich, (Jun 16, 2016)

By Edward L. Puzzo, J.D.

While serious privacy concerns have been raised by the explosive growth of Internet-connected mobile and other devices, and the personal data they collect, the FTC has been acting in a variety of ways to protect consumers, according to Jessica Rich, Director of the FTC's Bureau of Consumer Protection. On June 11, Rich presented an annual update on the FTC's recent activities relating to privacy and advertising at the Advertising and Privacy Law Summit, sponsored by Kelley Drye & Warren LLP.

Privacy. The FTC has worked to keep pace with the recent explosion in round-the-clock tracking, profiling, personalization, and predictions, whether though social networks, mobile devices, smart cars, or thermostats, Rich stated. The FTC has targeted deceptive claims regarding how collected data is used, the sale of sensitive data to scam artists, the failure to protect unauthorized access to sensitive data, and scammers such as those who extort private data and demand money to remove it.

Health privacy. Health-related apps, devices, websites, and services—allowing consumers to track their diet, exercise and glucose levels; share information with other patients with the same condition; and store personal health records—are generally not covered by the privacy protections of HIPAA. The FTC Act, then, must be used to protect confidential health information, Rich said. The FTC recently obtained a settlement with Practice Fusion, a provider of management services to physicians, for soliciting reviews of doctors—many containing consumers’ full names, medications, health conditions, and treatments received—without disclosing that the reviews would be posted publicly on the internet. The FTC also took action against dental practice office management software provider Henry Schein Practice Solutions for representing that it used HIPAA-compliant encryption for private patient data, when it in fact used a much weaker encryption method.

Rich also noted that the FTC, in conjunction with HHS and the FDA, has developed an interactive tool for businesses to use to determine which laws—HIPAA; the Food, Drug, and Cosmetic Act; the FTC Act; or the FTC’s Health Breach Notification Rule—apply to them.

Device security. As more and more data is collected by more and more Internet-connected devices, the security of the devices themselves has increased in importance, Rich indicated. She noted that the FTC has recently acted against computer hardware company ASUS for critical security flaws in its routers that put at risk the home networks of hundreds of thousands; and against TRENDnet for security lapses in home security monitoring cameras. The FTC is also conducting a study of mobile device security and has request information from eight mobile device manufacturers.

Data security. The FTC has challenged data security failures, including strengthening existing Payment Card Industry standards. It has also presented educational programs to stop data breaches before they occur, such as the "Start with Security" events that the FTC has hosted around the country, and the new IdentityTheft.gov website for consumers to use to report identity theft.

Workshops. Rich noted that the FTC's Office of Technology Research and Investigations (OTech) will be presenting a series of workshops around the country to address privacy issues raised by ransomware, drones, smart TVs, marketplace lending, and crowdfunding.

Advertising. The FTC has focused its consumer protection activities regarding advertising on the areas of health claims, endorsements, and native advertising, Rich stated.

Deceptive health claims. The changing marketplace has created new ways to reach and deceive consumers, such as mobile apps marketed as medical devices. In the last year, the FTC brought an enforcement action against Ultimeyes for claiming without proof that doing visual exercises on its app would improve consumers' vision. The agency reached a $2 million settlement with Lumosity for making unfounded claims that its subscription "brain-training" program could stave off memory loss, dementia, and Alzheimer’s disease. It also reached a $1.5 million settlement with athletic apparel company Tommie Copper for its false or unsubstantiated claims that its copper-infused compression clothing would relieve severe and chronic pain and inflammation caused by arthritis and other diseases. Currently pending in federal court is a case against Sunrise Nutraceuticals for claiming that its supplement could cure opiate addiction.

Deceptive endorsements. Consumers have a right to know when supposedly objective opinion is actually a marketing pitch, Rich stated. The FTC recently charged entertainment network Machinima with posting online videos touting Xbox One, appearing to be the objective views of "influencers" without disclosing they were actually paid endorsements. The FTC also recently went after Roca Labs. Not only had Roca promoted unproven weight loss supplements, but they also had a hidden "gag clause" in the fine print of their terms and conditions which allowed them to sue consumers who posted negative reviews of their product online.

Native advertising. Advertising and marketing should be readily identifiable as such, Rich stated. The FTC just brought its first case against native advertising—the use of formats or promotional messages to make advertising appear to be objective content—against Lord & Taylor. The retailer had presented a seemingly objective article in an online fashion publication without disclosing that it was actually a paid promotion for its 2015 clothing launch. The retailer had used online "influencers" to promote their products without disclosing that it had paid the influencers. When designing marketing campaigns and hiring other companies to implement them, Rich stated, companies must make clear that advertising is advertising.

News: Advertising Privacy FederalTradeCommissionNews