Antitrust Law Daily Wrap Up, PRIVACY NEWS: Twelve U.S. companies settle FTC charges of false claiming to comply with international safe harbor privacy framework, (Jan 22, 2014)
Organizations Mentioned:Apperian, Inc. | Atlanta Falcons Football Club, LLC | Baker Tilly | Baker Tilly Virchow Krause, LLP | BitTorrent, Inc. | Charles River Laboratories International, Inc. | DDC Laboratories, Inc. | DataMotion, Inc. | Level 3 Communications, LLC | PDB Sports, Ltd. | PDB Sports, Ltd., d/b/a Denver Broncos Football Club | Receivable Management Services Corporation | Reynolds Consumer Products, Inc. | Tennessee Football, Inc. | U.S. Department of Commerce
By Linda O’Brien, J.D., LL.M.
The FTC has announced that twelve U.S. businesses have agreed to settle FTC charges that they falsely claimed they were abiding by an international privacy framework, known as the U.S.-EU Safe Harbor, that enables U.S. companies to transfer consumer data from the European Union to the United States in compliance with European Union law.
The companies settling with the FTC represent a cross-section of industries, including retail, professional sports, laboratory science, data broker, debt collection, and information security. The companies handle a variety of consumer information, including in some instances sensitive data about health and employment. The twelve companies are:
Apperian, Inc. (In re Matter of Apperian, Inc., File No. 142-3017)
Atlanta Falcons Football Club, LLC (In re Matter of Atlanta Falcons Football Club, LLC, File No. 142-3018)
Baker Tilly Virchow Krause, LLP (In re Matter of Baker Tilly Virchow Krause, LLP, File No. 142-3019)
BitTorrent, Inc. (In re Matter of BitTorrent, Inc., File No. 142-3020)
Charles River Laboratories International, Inc. (In re Matter of Charles River Laboratories International, Inc., File No. 142-3022)
DataMotion, Inc. (In re Matter of DataMotion, Inc., File No. 142-3023)
DDC Laboratories, Inc. (In re Matter of DDC Laboratories, Inc., also a/d/a DNA Diagnostic Center, File No. 142-3024)
Level 3 Communications, LLC (In re Matter of Level 3 Communications, LLC, File No. 142-3028)
PDB Sports, Ltd., d/b/a Denver Broncos Football Club (In re Matter of PDB Sports, Ltd., a/d/a Denver Broncos Football Club, File No. 142-3025)
Reynolds Consumer Products, Inc. (In re Matter of Reynolds Consumers Products, Inc., File No. 142-3030)
Receivable Management Services Corporation (In re Matter of Receivable Management Services Corporation, Inc., File No. 142-3031)
Tennessee Football, Inc. (In re Matter of Tennessee Football, Inc., File No. 142-3032)
According to the twelve complaints filed by the FTC, the companies deceptively claimed they held current certifications under the U.S.-EU Safe Harbor framework and, in three of the complaints, also deceptively claimed certifications under the U.S.-Swiss Safe Harbor framework. The U.S.-EU and U.S.-Swiss Safe Harbor frameworks are voluntary programs administered by the U.S. Department of Commerce in consultation with the European Commission and Switzerland, respectively. To participate, a company must self-certify annually to the Department of Commerce that it complies with the seven privacy principles required to meet the EU’s adequacy standard: notice, choice, onward transfer, security, data integrity, access, and enforcement. A participant in the U.S.-EU Safe Harbor framework may also highlight for consumers its compliance with the Safe Harbor by displaying the Safe Harbor certification mark on its website.
The FTC complaints charge each company with representing, through statements in their privacy policies or display of the Safe Harbor certification mark, that they held current Safe Harbor certifications even though the companies had allowed their certifications to lapse. The Commission alleged that the conduct violated the FTC Act; however, it did not necessarily mean that the company committed any substantive violations of the privacy principles of the Safe Harbor framework.
Under the proposed settlement agreements (Apperian, Inc.; Atlanta Falcons Football Club, LLC; Baker Tilly Virchow Krause, LLP; BitTorrent, Inc.; Charles River Laboratories International, Inc.; DataMotion, Inc.; DDC Laboratories, Inc.; Level 3 Communications, LLC; PDB Sports, Ltd., d/b/a Denver Broncos Football Club; Reynolds Consumer Products, Inc.; Receivable Management Services Corporation; and Tennessee Football, Inc.), the companies are prohibited from misrepresenting the extent to which they participate in any privacy or data security program sponsored by the government or any other self-regulatory or standard-setting organization.
“Enforcement of the U.S.-EU Safe Harbor Framework is a Commission priority. These twelve cases help ensure the integrity of the Safe Harbor Framework and send the signal to companies that they cannot falsely claim participation in the program,” said FTC Chairwoman Edith Ramirez.
The Commission votes to accept the consent agreement packages containing the proposed consent orders for public comment were 4-0.
Companies: Apperian, Inc.; Atlanta Falcons Football Club, LLC; Baker Tilly Virchow Krause, LLP; BitTorrent, Inc.; Charles River Laboratories International, Inc.; DataMotion, Inc.; DDC Laboratories, Inc.; Level 3 Communications, LLC; PDB Sports, Ltd., d/b/a Denver Broncos Football Club; Reynolds Consumer Products, Inc.; Receivable Management Services Corporation; Tennessee Football, Inc.
News: Privacy FederalTradeCommissionNews