Posts Tagged ‘FTC’
The Federal Trade Commission’s (FTC) Red Flag Rules have been revised to exclude certain professionals prior to the latest enforcement deadline of December 31, 2010. Specifically, President Obama signed into law on December 18, 2010, the Red Flag Program Clarification Act of 2010 (Clarification Act), which clarifies the scope of the FTC’s Red Flags Rule. Under the amendment, professionals such as doctors, lawyers, and accountants are excluded from the Red Flags Rule. For a full copy of the Act, click here
The Red Flags Rule was enacted to protect consumers from identity theft by requiring “creditors” covered under the Rule to establish written policies and procedures to identify risks of identity theft to their customers. Under the plain language of the Red Flags Rule, a business becomes a “creditor” when it provides products or services in advance and require payment from the customer at a later time. Further, under prior FTC interpretations “creditor” was broadly interpreted to cover lawyers, doctors, accountants, and others because they bill for services after the services have been performed.
Under the the Clarification Act, however, the meaning of the term “creditor” now includes only those who (1) regularly and in the ordinary course of business obtain or use consumer reports in connection with a credit transaction; (2) furnish information to consumer reporting agencies in connection with a credit transaction; or (3) advance funds to or on behalf of a person, based on an obligation of the person to repay the funds. The Clarification Act does not specifically exclude doctors, lawyers, and accountants. But Senator Christopher Dodd (D.-Conn.) and Senator Mark Begich, (D.-Alaska) make clear that the Clarification Act does not extend to these professionals and other small businesses as creditors covered under the Red Flags Rule simply because they provide services and bill clients, patients, and customers for payment at a later time, except to the extent that they furnish information to consumer reporting agencies in connection with a credit transaction. Finally, the Clarification Act allows the FTC to determine in the future whether the scope of the Rule should be expanded to include other types of creditors that offer or maintain accounts subject to a reasonably foreseeable risk of identify theft.
From a practical standpoint, even those professionals and businesses specifically exempted from the Red Flags Rule should establish an identity theft prevention program: It is a good business practice to eliminate or, at least, minimize the chance of a data breach and minimizing the subsequent fall out with your customers. Additionally, there may be other applicable regulations that may require certain protection programs. For example, doctors must have HIPAA security programs in place and there is a patchwork of state statutes that cover data security and reporting requirements for breaches.
For questions about Red Flags Rule Compliance, establishing an information security program, or improving your organization’s current policies and procedures for preventing losses, contact E-Business Counsel, PLC.
Mr. Locke explained that the motivation for this initiative is “[b]ecause of the vital role the Internet plays in driving innovation throughout the economy, the Department has made it a top priority to ensure that the Internet remains open for innovation while promoting an environment respectful of individual privacy expectations.”
Further, the Commerce Department is seeking public comment from all Internet stakeholders through a Notice of Inquiry (NOI) published in the Federal Register. One question the Department seeks to answer is “whether current privacy laws serve consumer interests and fundamental democratic values.”
Please contact me about offering insight on this topic or joining in the submission of a comment pursuant to the NOI. Your suggestions would be greatly appreciated. Thanks.
The concerns employers face over the use of social media – e.g., blogs, Facebook, MySpace, etc. – has been widely discussed, including here and here. The Federal Trade Commission (FTC) has recently added to those concerns. Specifically, the FTC updated its guidelines about protecting consumers from misleading endorsements and advertising. Under these guidelines an employer may face liability over an an employee’s endorsements of the employer’s products or services on social media websites. Further, liability may exist even where the employer did not authorize or approve the employee’s remarks.
An Overview of the Guidelines
The FTC’s revised Guides Concerning the Use of Endorsements and Testimonials in Advertising (16 C.F.R. Part 255) (the “Guidelines”), address the application of Section 5 of the FTC Act (the “Act”) – which prohibits unfair or deceptive acts or practices and unfair competition in or affecting commerce — to the use of endorsements and testimonials in advertising. An endorsement or testimonial subject to these guidelines is one “that consumers are likely to believe reflects the opinions, beliefs, findings, or experiences of a party other than the sponsoring advertiser, even if the views expressed by that party are identical to those of the sponsoring advertiser.” Crystal clear for all, right? Further, the Guidelines require that employees endorsing their employer’s products or services to disclose their relationship to an employer when they give an endorsement or testimonial.
The duty of disclosure applies even when the employee’s endorsement appears on a site that is not maintained by the employer (e.g., Facebook, MySpace) or the employee (bulletin boards) and the statement itself is not misleading. See 16 C.F.R. Part 255.5 (entitled “Disclosure of material connections”). See example No. 8 under 16 C.F.R. 255.5. And failing to make the required disclosure may expose the employer to liability under the Act. For example, the FTC may bring an enforcement action against an employer if an employee makes a misleading statement about the employer’s products and services that result in injury to consumers. Additionally, if I’m an employer, I would be losing sleep over the preceding example because postings on blogs, MySpace, and Facebook pages may quickly reach wide audiences and, therefore, create the risk of large-scale liability like class-action litigation.
While not the focus of this post, Bloggers should also consider how the Guidelines may apply to their posts. For example, the Guidelines apply to any endorsement of products or services. And any kind of “material connection” between an endorser (like a blogger) and an advertiser must be disclosed to the consumer, e.g., cash payments, free samples, or other benefits to the endorser from the promoter. This is not an endorsement, and even if it was (read with slight sarcasm) I have not received any benefit in connection with writing this post or referencing to the following post and I have no material connection to the brands, products, or services offered by the following post. With that smooth and beautiful literature out of the way, a post bloggers may want to review is provided by Michael Hyatt (click here) (Again – just a suggestion that you may or may not want to follow, and not an endorsement).
The Take Away for Employers
The take-away for employers is to add another item to the “Things that Keep Me Up at Night” list, followed by a note to consider reviewing the company’s technology policies with an eye towards:
- Determining if you have a policy? You may not. But you should. And if your company has a policy, what does it say about how the use of the company’s name, trademarks, and other proprietary information may be used (if at all) in blogs and other social media;
- Whether the policies include either prohibitions or proper guidance about references to company products or services. Such prohibitions and guidance should go beyond addressing just criticisms of the employer and its products and services;
- If endorsements are permitted, employees must understand (and document this understanding) that any endorsement must be limited to truthful and verifiable statements;
- Whether employees should be required (probably a good idea) to obtain prior approval by management of any proposed endorsement; and
- A requirement that an employee’s statement of endorsement is accompanied by a written disclosure that the employee is not authorized to make statements on behalf of the employer and a disclosure of the employment relationship so that consumers can weigh the testimonial. This statement should be drafted by the company and made readily available to employees.
Additionally, don’t forget to review your marketing contracts. In light of the widespread adoption of “Word of Mouth Advertising” (there is even a trade group for Word of Mouth Advertising, click here) in the Web 2.0 World (I lost track, but I think we are still on 2.0 … right???) companies should also review their contracts with any marketing professionals. This is because such advertising depends upon leveraging social networks in making a product or service go “viral.” Thus, in addition to assessing company employment policies, companies will want to make sure that their marketing contracts properly address compliance with the FTC’s Guidelines (this is a polite way of saying, make sure your marketing firm is going to defend you or reimburse you if you get sued because of an endorsement. After you do this, make sure the marketing firm has the finances/insurance to cover your defense tab – If you can’t avoid risks, make sure someone else has to cover the bill).
Feel free to contact me with questions about this post, about how your company is responding to the FTC’s Guidelines or leveraging social media in general, or about exorbitantly paying me to endorse your products or services, which I’m not above doing if the price and FTC language is right. I’m just kiddin,’ but seriously, I’m not (a little hat tip to Dodgeball).
Smart phones such as the iPhone, BlackBerry, and other devices are as standard in today’s business organizations as business cards. But this standard creates an increasingly problematic security threat for business organizations.
This point was highlighted this past October with the release of a mobile-phone software that allows someone to eavesdrop on the user’s conversations. This program, called PhoneSnoop, can be secretly downloaded to a BlackBerry (company issued or otherwise) and the microphone can be remotely activated allowing one to listen to conversations held in proximity to the device.
In another example, a computer game developer (Storm8) was sued for violation of the Computer Fraud and Abuse Act by allegedly collecting personal data through an iPhone app. The class action litigation alleges that Storm8’s app stole user’s phone numbers. It is reported (click here) that Storm8 admits to collecting the numbers, but the collection was inadvertent due to a glitch in the source code.
For more information on the security threats posed by smart phones, click here for a BusinessWeek article by Olga Kharif, “Smartphones: A Bigger Target for Security Threats.” Also, a “must read” for any business professional using the iPhone is an excellent post “iPhone Secuirty? A Complete Misnomer,” which may be found here. This posts highlights significant iPhone vulnerabilities that can result in major harm to the business organization.
Why Care About Information Security?
So why should business organizations care about the quality of their information security practices? Setting aside bad publicity and loss of customer goodwill, there are a number of legal reasons to care about such practices.
First, for organizations in certain business sectors the short answer is because you are required to care. Gramm-Leach-Bliley Act (GLB) was enacted in 1999 to reform the banking industry and has various provisions concerning information protection. Similarly, the Health Insurance Portability and Accountability Act (HIPAA) governs the protection of medical information. Sarbanes-Oxley Act applies to publicly traded companies and may require effective security controls to be implemented. Also, the Fair and Accurate Credit Transactions Act (FACTA), which amended the Fair Credit Reporting Act (FCRA), requires “any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose” to “properly dispose of such information or compilation.”
Second, there are also at least 45 reasons why business organizations not subject to the preceding federal statutes must be concerned about information security. This is the number of states with breach notification laws on the books that impose (potentially costly) notice requirements on companies that experience security breaches, together with additional potential liabilities for non-compliance.
Third, even if your business is not subject to the preceding state and federal regulations, chances are it is subject to the Federal Trade Commission oversight. Specifically, the Federal Trade Commission Act (FTC), 15 U.S.C. § 45(a)(1) states that “Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.” Under the provisions of the FTC Act, the FTC can take action against businesses that either: (a) publicly promise to keep sensitive personal information secure and confidential and then suffer a security breach; or (b) fail to implement reasonable and appropriate controls to secure sensitive personal information. Further, the FTC has promulgated its “Red Flags” rule, which address identity theft under the Fair and Accurate Credit Transactions Act of 2003. These rules, which were to originally take effect May 1, 2009, have been delayed (several times now) and are scheduled to go into effect June 1, 2010 … seriously … just trust the government … this time they will go into effect.
Fourth, in addition to statutory and regulatory sources of liability for mismanagement of information security, liability may be based on a breach of contract theory (make sure you know what you’re signing and what you are agreeing to).
Fifth, liability may also arise under a theory that the business organization was negligent in failing to secure sensitive information or information systems. See for example, a 2005 Michigan Court of Appeals case, Bell v. Mich. Council, that held a union had a special relationship with its members giving rise to a duty to safeguard personal data that the members entrusted to the union. Among the distinguishing facts cited by the court in finding a duty-imposing relationship were the union’s obligation to act in the best interests of its members, the foreseeability (under the circumstances) of theft and misuse of the data, and the union’s lack of safeguards to prevent unauthorized access to members’ personal data.
Steps towards Protecting Information
Information security is rapidly emerging as a “mission critical” component for business organizations. This is because virtually all of a company’s daily transactions and all of its key records are created, used, communicated, and stored in electronic form using networked computer technology. In other words, business organizations are, quite literally, completely dependent upon information technology and an interconnected information infrastructure. While this has provided organizations with tremendous economic benefits, e.g., reduced costs and increased productivity, it also creates a legal and public relations time-bomb for organizations that ignore information security.
Unfortunately, there is not a “silver bullet” app for responding to these challenges. But based on experience in working with business professionals, there are steps that should be considered. While far from the “Gospel,” the following measures should be evaluated because they concern the two biggest sources of security risks that I address on a regular basis:
- Laptops and portable storage devices routinely create information security risks for organizations. Accordingly, in addition to passwords (which may be – at best – a speed bump for cyber thieves) consider encryption software. A great open-source (and free) application is Truecrypt, which creates a virtual encrypted disk within a file and mounts it as a real disk and can encrypt an entire partition or storage device such as USB flash drive or hard drive; and
- Home computers used to access work may not have the appropriate protections, e.g., firewall or virus protection necessary to safeguard information. Additionally, information may be accessible by spouses and children (and if teenagers, their friends). Accordingly, it is critical for employees with home access to work information appreciate the risks and expectations for protecting company/consumer information. Also, it is important for employers to be prepared to step in if such information may be compromised or otherwise exposed due to litigation involving the employee. For example, it is a common scenario for an employee to be involved in a divorce or some other litigation. In such circumstances, the other side will commonly request access to a company provided laptop, Black Berry or related devices. Thus, it is a good practice to require employees to immediately notify their employers of any incident that may compromise the business organization’s information.
For additional information security resources, click here (FTC Resources) or feel free to contact me discuss what steps can be taken to decrease the risks and liabilities your business organization faces.
As a follow up to two prior posts on the FTC’s Red Flags Rule (here and here), a friend over at Kroll Fraud Solutions, was kind enough to forward me additional Red Flag Resources relating to resources from Kroll that explain how to comply with the new regulations: Kroll’s FAQ on the Red Flag Rules and Kroll’s podcast on the Red Flag Rule. Enjoy.
In a follow up to my earlier post regarding the Federal Trade Commission’s (FTC) Red Flags Rule (Click here for the post), the FTC issued an eleventh hour statement that it will extend the May 1, 2009 deadline for businesses to comply with the regulation through August 1, 2009. For the full FTC statement, click here.
The Rule applies to “creditors,” which includes any business organization that does not require payment in full for services (or supplies) at the time of service. If a business organization falls into the category of a “creditor” then the next question is whether the organization has “covered accounts” that will be covered by the Red Flags Rule. A “covered account” includes a consumer account designed to permit multiple payments or transactions or any other account for which there is a reasonably foreseeable risk of identity theft.
Originally, this regulation and the law it’s based on targeted financial institutions. But the plain language of the FTC’s rule makes it much more expansive and unclear as to how it would be applied to organizations outside of the intended regulatory field.
In this regard, the FTC Chairman Jon Leibowitz noted:
“Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further.”
For smaller businesses organizations, the FTC is developing a template to implement a relatively simple Red Flags Rule compliance program. This template will be available at this site.
Businesses organizations, especially smaller organizations, no doubt have enough challenges to weather in this economic storm. But business organizations may be able to use the FTC’s Red Flag Rules as an opportunity to set their organization apart in the minds of customers and clients with privacy concerns by having a Red Flags Compliance Program in place in advance of the August 1 deadline. Now we just have to figure out how to financially survive until August. Sorry – I can’t help you in that department.