Mobile payments have become so commonplace that consumers rarely stop to think about whether their online payment is secure. Mobile app developers can fall into a similar trap of assuming that the necessary security measures are enabled without performing the necessary audits to assure security on a regular basis. A recent settlement between the FTC and two companies offering unsecured mobile application products gives cause to think again.
The FTC alleges that the movie ticketing service Fandango and credit monitoring company Credit Karma failed to adequately protect consumers’ sensitive personal information in their mobile apps because they failed to use Secure Sockets Layer (“SSL”) protocol to establish authentic, encrypted connections with consumers. Generally, an online service will present an SSL certificate to the app on the consumer’s device to vouch for its identity. The app then verifies the certificate to ensure that it is connecting to the genuine online service. When companies fail to use this protocol—especially if consumers use the app over a public wi-fi system—third party attackers can substitute an invalid certificate to the app, thus establishing a connection between the app and the attacker rather than the online service. As a result, any information that the consumer enters into the app will be sent directly to the attacker, including credit card numbers and other sensitive and personally identifying information.
The FTC alleged that Fandango and Credit Karma left their applications vulnerable to interception by third parties by failing to use SSL protocol. The FTC alleged that Fandango misrepresented the security of its application by stating that consumers’ credit card information would be stored and transmitted securely, despite the fact that the SSL protocol was disabled on the app from March 2009 to March 2013. The FTC alleged that Credit Karma’s app failed to validate SSL certificates from July 2012 to January 2013, leaving the app susceptible to attackers which could gather personal identifying information such as passwords, security questions and answers, birthdates, and “out of wallet” verification answers regarding things like mortgages and loan amounts.
In both cases, the online services received warnings of the vulnerabilities from both users and the FTC. In December 2012 a security researcher used Fandango’s online customer service form to submit a warning regarding the vulnerability. However, Fandango mistakenly flagged the email as a password reset request and sent the researcher a stock response on password resetting, then marked the complaint as resolved. A user sent a similar notice to Credit Karma about the SSL certificates in January 2013. Credit Karma responded by issuing a fix in the update to the iOS operating system that same month, however, one month later Credit Karma issued an Android app which contained the same vulnerability.
In both cases, the online services performed a more thorough internal audit of the apps only when issued a warning by the FTC. The FTC issued complaints against the companies for their deceptive representations regarding the security of their systems. While the complaints noted that the apps were vulnerable to third party attacks, they did not allege that any such attacks were made or that any consumer information was in fact compromised. Perhaps due to the lack of consumer harm, the FTC entered into consent agreements with Fandango and Credit Karma in which the services did not have to pay a monetary judgment, but did agree to establish comprehensive security programs and undergo security assessments every other year for the next 20 years. Fandango and Credit Karma are additionally prohibited from misrepresenting the level of privacy and security in their products or services.
SSL certificates are the default validation process that iOS and Android operating systems provide developers using the application programming interface. Therefore, mobile app developers can protect themselves and their users from this vulnerability simply by leaving the default SSL protocol enabled. What’s more, app developers can test for and identify SSL certificate validation vulnerabilities using free or very low cost tools. Therefore, all app developers should take the necessary precautions to ensure the security of their systems, and prevent harm to consumers (and potential lawsuits) down the road.
Herbalife Hit with Civil Investigative Demand – Is the FTC Finally Turning up the Heat on Multi-Level Marketers?
For many, the announcement two weeks ago that the Federal Trade Commission has commenced a formal investigation into Herbalife was not terribly interesting. After all, nutritional supplement company Herbalife has been the focus of intermittent media attention since December 2012 when Wall Street hedge fund manager Bill Ackman claimed that it was an illegal pyramid scheme, and its business practices have already drawn the scrutiny of the Securities and Exchange Commission.
On the other hand, because the FTC focuses on deceptive trade practices, its investigation into Herbalife– and the allegation that it constitutes a pyramid scheme – may offer a valuable opportunity for the FTC to clarify its rules on what constitutes a pyramid scheme and what a multi-level marketing (MLM) company can or must do to protect itself from the accusation.
The MLM industry has been an established networking sales model for several decades. The FTC defines “multi-level marketing” as networking that uses individuals to sell products by word of mouth or direct sales where distributors typically earn commissions not only for their own sales, but for sales made by the people they recruit. MLM has become increasingly popular in recent years – and for good reason given that it has become extremely profitable: A 2012 study reported the MLM industry was worth approximately $30 billion.
The sole FTC guidelines for MLM arose from litigation in 1979 when the FTC accused the MLM Amway of operating an illegal pyramid scheme. (Amway ultimately prevailed four years later.) The case gave rise to what is known as the “Amway Safeguard Rules”– a set of rules relating to distributors that Amway had in place that protected itself from the FTC accusation that the company was a pyramid scheme. As described in the administrative law judge’s decision, these three critical criteria provided an “umbrella of legal protection”:
1. Amway required its representatives to engage in retail selling, under the “ten retail customer police,” which appeared in the agreement that representatives signed upon enrollment. This rule required that representatives make 10 sales to retain customers as a qualification for eligibility to receive commission and bonuses on sales/purchases made by other representatives in their personal sales organization.
2. Amway required its representatives to sell a minimum of 70 % of previously purchased products before placing a new order. (Amays’ rules recognize “personal use” for purposes of the 70% rule.)
3. Amway had an official “buy-back” policy for unsold, unopened inventory. This policy had some reasonable restrictions, including a specified maximum length of time since the item was originally purchased by the representative and that the item was still current in the company’s product offerings to consumers. The policy also included a minimal “restocking” fee. (Buy-back policies are significant especially for protection of representatives who choose to terminate their affiliation with a company, and do not want to be “stuck” with unsold inventory.)
By adhering to these rules, MLM companies gain some protection from pyramid scheme accusations. And, aside from a staff advisory opinion in 2004, the FTC has offered little or no further guidance on what it perceives as a pyramid scheme and what companies can or must do to show that their businesses are legitimate and legal.
Will the FTC use the Herbalife investigation to provide greater guidance for MLM companies? To do so would be in the interests of MLM companies, the regulators themselves, and those in the financial services industry who have taken great interest – and large financial positions – in MLM companies.
After the FTC secured a $163MM judgment against Kristy Ross in the US District Court of Maryland, the 4th Circuit affirmed, and so ends the FTC’s six-year “scareware” enforcement action. From beginning to end, this odyssey has been quite colorful, to say the least. The nine-figure judgment against Ross is no exception.
Originally, there were eight codefendants: Innovative Marketing, Inc., ByteHosting Internet Services, LLC, and five of the companies’ officers and directors, including Ms. Ross. The case was based on FTC allegations that their massive “scareware” scheme was deceptive in violation of Section 5 of the FTC Act. Specifically, the FTC alleged that the defendants falsely warned consumers that (imaginary) scans of their computers detected security or privacy issues (e.g., viruses, spyware, system errors, and pornography). After receiving the fraudulent security alerts, the consumers were prompted to purchase the Defendants’ software to remedy the (imaginary) problems. More than one million consumers purchased the scareware – of them, roughly three thousand filed complaints with the FTC.
Ross was the only co-defendant remaining at trial, and the judgment was entered against her individually and as a member of Innovative Marketing, Inc. (IMI). Four of the eight original defendants settled with the FTC in February 2010. The same month, the trial court entered default judgments against the remaining three – IMI, Mr. Jain, and Mr. Sundin – for their failure to appear and participate in the litigation. Ross retained counsel but failed to file an answer, respond to the FTC’s discovery requests, or appear at trial. As such, the lone defendant Ross was tried in absentia. Though not explicitly expressed in the trial judge’s opinion, one can only imagine that the optics did not bode well for Ms. Ross at trial.
Before trial, the FTC moved for summary judgment. In her opposition, Ross argued that she was just an employee at IMI (not a “control person”) without requisite knowledge of the misconduct and that she could not therefore be held individually liable under the FTC Act. The court found there to be no issues of material fact with regard to whether the scareware scheme was deceptive in violation of the FTC Act. And a bench trial was ordered to determine the extent of Ross’ control over, participation in, and knowledge of IMI’s deceptive practices.
At trial, Judge Bennett found that Ross had actual knowledge of the marketing scheme, was fully aware of many of the complaints from customers, and was in charge of remedying the problems. The court issued a permanent injunction (as authorized by the FTC Act) and held her individually liable for the total amount of consumer injury (calculated by the FTC $163,167,539.95), finding that to be the proper measure for consumer redress.
On appeal, Ross asked the court to apply the SEC standard for individual liability, which essentially requires a showing of specific intent/subjective knowledge. The Fourth Circuit declined, finding that such a standard would leave the FTC “with a futile gesture of obtaining an order directed to the lifeless entity of a corporation, while exempting from its operation the living individuals who were responsible for the illegal practices in the first place.” The appeals court also rejected Ross’ arguments that district courts do not have authority to award consumer redress, noting that “[a] ruling in favor of Ross would forsake almost thirty years of federal appellate decisions and create a circuit split,” an outcome that it refused to countenance.
The factual and procedural history of this case are pretty outlandish, and it is not clear why Ross opted to take the FTC to the mat (in absentia) on case with so much weighing against her. Had she settled with the others back in 2010, maybe she would have only been on the hook for the gross revenues she received from the alleged scam. Then, almost certainly the FTC would have followed its common practice of suspending all but the amount she was able to pay. But, alas, she did not.
Advertisements for electronic cigarettes, or “e-cigarettes,” are increasingly drawing scrutiny from consumer advocates and public health groups who are calling for the federal government to regulate these advertisements in the same manner that traditional cigarette advertisements are regulated.
The e-cigarette industry is growing at a rapid pace, particularly among younger people. Last year, the industry generated roughly $2 billion and industry sources estimate sales are on pace to hit $5 billion this year.
Currently, there are no regulations governing advertisements of e-cigarettes. In contrast, advertisements of traditional cigarettes are heavily regulated. For instance, various federal laws and regulations prohibit cigarette manufacturers from sponsoring sporting events, and advertising cigarettes on television is also barred. Under the terms of a settlement from a lawsuit in 1998, tobacco companies agreed to not use cartoon characters to market cigarettes.
For roughly 10 years, the marketing team at R. J. Reynolds used the cartoon character “Joe Camel” to promote cigarettes. After years of pushback and under pressure from a pending lawsuit, Congress and various consumer groups, R.J. Reynolds announced that it would settle the pending lawsuit out of court and voluntarily end its use of Joe Camel.
BlueCigs, a leading manufacturer of e-cigarettes, uses a cartoon character named Mr. Cool in a television advertising campaign. Industry watchdogs have criticized the television ads, particularly given the growth of the industry and the regulations faced by traditional tobacco manufacturers. Some in the industry have noted the similarity between Mr. Cool and Joe Camel and worry that these advertisements will have the same effect of luring young people to try e-cigarettes that many believe Joe Camel had with traditional cigarettes.
Last month, a group of Senate Democrats introduced legislation to prohibit e-cigarette producers from marketing their products to children. This bill marked the first legislative attempt to regulate the e-cig industry. The bill would ban marketing e-cigarettes to children based on standards promulgated by the Federal Trade Commission (FTC), and would empower the FTC and state attorneys general to enforce the advertising ban.
Additionally, the White House Office of Management and Budget has been reviewing a rule proposed by the U.S. Food and Drug Administration that would bring e-cigarettes under its jurisdiction. The regulations have been under review since October. We have previously written about FDA plans to regulate the e-cigarette industry here.
The e-cigarette industry should be aware that their marketing and advertisements are being closely monitored. Regulation and potential lawsuits could be on the horizon and companies should review their policies and practices to make sure they are prepared. The use of cartoon characters may be one advertising method to forego at this point, instead focusing on mature individuals using the product.
Attorney General Holder Calls on Congress to Establish Strong National Data Breach Notification Standard
By Michelle Cohen, CIPP-US
Yesterday, in his weekly video address, Attorney General Eric Holder urged Congress to create a national data breach notification standard requiring companies to quickly notify consumers of a breach of their personal or financial information. In the wake of the high profile holiday season data breaches at retailers Target and Neiman Marcus, Holder stated that the Department of Justice and the U.S. Secret Service continue to work to investigate hacking and cybercrimes. However, Holder believes that Congress should act to establish a federal notification requirement to protect consumers. Holder’s video address is available here .
Currently, at least forty-six states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private or government entities to notify individuals of security breaches of information involving personally identifiable information. As might be expected, the laws vary widely from state to state, particularly in the timing requirement for the breach notifications. Most laws allow delay to accommodate a law enforcement investigation.
Some states require notification as soon as reasonably practicable. Others require notification within 45 days. Yet organizations have faced lawsuits for failing to notify on a timely basis, even where there is no set standard. This presents a difficult situation for companies. Organizations need to investigate a data breach and determine the type of information affected, who was affected (and thus needs to be notified), and importantly, whether the breach is ongoing such that the company must immediately implement remedial measures.
Attorney General Holder believes Congress should set a national standard that will better protect consumers. Holder asserts that a federal requirement should enable law enforcement to investigate the data breaches quickly and to hold organizations accountable when they fail to protect personal and financial information. Holder’s video message did include a reference that this requirement should create “reasonable exemptions” for companies to avoid creating unnecessary burdens.
The Target and Neiman Marcus data breaches have certainly raised the profile of cybersecurity issues on Capitol Hill, with several bills having been introduced in recent weeks addressing data breaches. While the states certainly took the lead in protecting consumers by enacting data breach laws over the past several years, a properly-crafted national standard could provide more consistent guidance for industry and a uniform rule for consumers irrespective of their home states. Should Congress move forward on a data breach law, reasonable accommodations need to be made for companies to have time to investigate data breaches, to determine scope, persons affected, and the type of information affected. A national standard setting forth a notification deadline would also presumably alleviate the “rush to the courthouse” from the plaintiff’s bar with data breach notification timing allegations.
A federal court in California recently ruled that a plaintiff who was required to enter her phone number to purchase a plane ticket online had consented to receive a text message, and dismissed her claim under the Telephone Consumer Protection Act (TCPA). A plaintiff’s prior express consent is a major issue in TCPA litigation and this decision represents a victory for companies that obtain phone numbers from consumers who are purchasing goods or services from them.
The plaintiff, Shaya Baird, booked flights online for herself and her family on the Hawaiian Airlines website. During the purchase, Baird was required to enter her contact information. The website required at least one phone number, which Baird provided by entering her mobile phone number. A few weeks later Baird received a text message inviting her to reply “yes” if she wanted to receive flight notification services. Baird did not respond and she did not receive any more text messages.
Baird then filed suit alleging that Sabre, which contracted with Hawaiian Airlines to provide traveler notification services to passengers, violated the TCPA by sending her the unsolicited text message. The TCPA bars the sending of autodialed or prerecorded “calls” (which the Federal Communications Commission (“FCC”) has interpreted to include text messages) to mobile numbers without “prior express consent.” An individual’s granting of consent to receive texts constitutes an affirmative defense in a TCPA lawsuit.
Sabre moved for summary judgment on the ground that Baird consented to receive its text message when she made her flight reservation on the Hawaiian Airlines website. Baird responded that she did not voluntarily provide her cell phone number, but was instead told that she was required to enter a phone number. She further argued that she was not informed that by providing her cell phone number she was consenting to receiving text messages.
The court rejected Baird’s argument and found that although she was required to provide her phone number to book a flight on the Hawaiian Airlines website, the act of providing her phone number was a voluntary act. Baird was not forced to book a flight on the Hawaiian Airlines website. The court found that under the FCC’s interpretation of the TCPA, Baird had consented to be contacted on her cell phone about flight related matters. The court looked to the FCC’s 1992 Order implementing the TCPA to determine if the act of providing a cell phone number in connection with a transaction constitutes the required consent under the TCPA to receive autodialed calls. The court found that since it was undisputed that Baird “knowingly released” her cell phone number when she booked her tickets, under the FCC’s 1992 TCPA Order she had consented to receiving text messages.
This decision represents a victory for TCPA defendants. TCPA litigation has been increasing significantly in the past few years and recent changes have gone into effect that placed stricter requirements on businesses that engage in marketing via mobile messaging and prerecorded telephone calls. While we recommend businesses obtain “prior express written” consent for TCPA-covered calls and texts, now at least one court has recognized the knowing provision of a mobile number as consent. However, companies engaging in text messaging should proceed cautiously as the new rules do impose strict requirements when it comes to telemarketing messages in particular, different from the informational text messages Ms. Baird received here. Under the new TCPA rules purely informational calls/texts and calls/texts to mobile phones for non-commercial purposes require prior express consent – oral or written. “Telemarketing” calls/texts to mobile phones require prior express written consent. Covered telemarketing calls include those made by advertisers that offer or market products or services to consumers and calls that are generally not purely informational (such as “mixed messages” containing both informational content and offering a product, good, or service for sale).
A California court ruled earlier this month that Overstock must pay a roughly $6.8 million penalty to settle claims that the retailer “routinely and systematically” made false and misleading claims about the prices of its products on its website. If upheld, this ruling could have significant effects on how companies use price comparisons in advertisements in the future.
A group of California District Attorneys sued Overstock in 2010 for $15 million, alleging that Overstock was deceptive in the way it determined and displayed price comparisons on its website. Overstock used a comparative advertising method based on price, which is commonly referred to as “advertised references prices” or “ARPs” that showed the price of a certain product on Overstock compared to the price of the same product from a different retailer. The lawsuit alleged that the ARPs that Overstock used were false or misleading because Overstock employees chose the highest price that they could find as an ARP or constructed ARPs using arbitrary formulas. The lawsuit alleged that as a result of Overstock’s method of constructing its ARPs, its savings comparisons were inflated.
A California state judge’s tentative ruling earlier this month levied civil penalties against Overstock of just over $6.8 million. The court dismissed some of the claims in the lawsuit, but found that Overstock’s pricing comparison violated the state’s laws on unfair competition and false advertising.
The court also issued an injunction that prohibits Overstock from comparison price advertising unless it is done in conformity with a lengthy set of court mandated practices outlined in the opinion. Among those requirements, the court ordered that Overstock explain its pricing more clearly on its website, including a disclosure of how it computes the price comparisons. The ruling also prohibits Overstock from setting average retail prices based on anything other than the actual retail price offered in the marketplace.
Overstock has said that they plan to appeal the court’s ruling by arguing that the court’s decision is misreading California law and is holding the company to a higher standard than other e-commerce sites. If this ruling is upheld, this could have a significant ripple effect on retail advertising for both online and brick-and-mortar businesses. Almost every state has a law regarding deceptive pricing in advertisement, and the Federal Trade Commission also has jurisdiction to pursue claims against deceptive advertising in price comparisons. Companies need to be aware if they are using comparative price advertising that those advertisements, and the formulas for determining the prices on those advertisements, will be scrutinized by government agencies.
By Michelle Cohen, CIPP-US
On January 28th, in an effort raise awareness of privacy and data privacy, the United States, Canada and 27 countries of the European Union celebrate International Data Privacy Day. Many organizations use Data Privacy Day as an opportunity to educate their employees and stakeholders about privacy-related topics. With the recent, high-profile data breaches as Target, Neiman Marcus, and potentially, Michaels, the need for training and instruction on data security is more critical than ever before. In this vein, we’ve set forth our views on what we see as the year ahead in legal developments relating to data security and what companies can do to prepare.
Legislation Introduced but on the Move?
Data security and data breaches will continue to be the focus of regulators and Congress through 2014. In fact, Congress summoned Target’s Chief Financial Officer to appear before the Senate Judiciary Committee on February 4th and a House committee is seeking extensive documents from Target about its security program. Meanwhile, Senator Leahy re-introduced data breach legislation which would set a federal standard for data breach notifications (most states now require notifications, though the requirements differ state-to-state).
Senators Carper and Blunt introduced a separate bipartisan bill intended to establish national data security standards, set a federal breach notification requirement, and also require notification to federal agencies, police, and consumer reporting agencies when breaches affect more than 5,000 persons. Many companies have suffered data breaches and then faced civil lawsuits under various causes of actions, including allegations that they did not notify customers promptly. As a result, there may be strong support for federal standards rather than facing a patchwork of state laws. While the Target breach has certainly renewed interest in data security, and we expect Congress will conduct numerous hearings, ultimate passage of data breach legislation this Congress is still probably a longshot.
Watching Wyndham Take on FTC
As covered in this blog, various Wyndham entities have struck back at the FTC, challenging the FTC’s authority to bring an action against Wyndham for alleged data security failures. The Wyndham entities claim that the FTC may not set data security standards absent specific authority from Congress. Yet, with Congress having not set data security standards thus far, the court in oral arguments seemed concerned about leaving a void in the data security area. Wyndham’s motion to dismiss remains pending in federal court in New Jersey. Most observers think the court will be hard pressed to limit the FTC’s authority under Section 5 of the FTC Act, which broadly prohibits ”unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce” and provides the FTC with administrative and civil litigation enforcement authority. The agency has used this administrative authority with great success, bringing numerous data privacy actions that usually result in settlements by companies rather than risk further litigation expenses, penalties, and reputational damage. We think the FTC will remain vigilant in this space, including attention on the security of mobile apps.
Class Actions Jump on Breaches
Whether breaches affect Sony Playstation, Adobe, Target, or some other company, the class action firms have been busy filing lawsuits based upon data breaches. For example, by year end, at least 40 suits had already been filed against Target, with seven filed the day Target disclosed the breach. The plaintiffs use various theories – including violations of consumer protection statutes, negligence, fraud, breach of contract, breach of fiduciary duty, invasion of privacy and conversion. But, if a consumer’s information was potentially breached, yet nothing happened to the consumer as a result, does that consumer have cognizable damages? That has been a huge sticking point for these lawsuits. Yet, the class action lawyers will continue to file these suits and some companies will settle to avoid further reputational damages and litigation expenses.
Don’t Count out the States
States have taken the lead in setting data breach notification standards, and in some cases data security requirements. For instance, in March 2010, Massachusetts enacted strict data security regulations. Organizations that own or license personal information of Massachusetts residents are required to develop and implement a written comprehensive information security program (“CISP”) to protect that information. Almost all of the states have standards setting forth what types of information are covered by data breaches, who gets notified, what content goes in the notifications and, the timing of the notifications. Multiple states are investigating the Target breach; certainly less well known breaches get state regulators’ attention as well. We predict the states will continue to be active regulators and enforcers of data security and data breaches, and will likely continue to “rule the roost” while federal legislation lags behind.
Preparation and Training Still Key
We’ve said before that, unfortunately, no company is immune from data breaches. Companies cannot assume that they have the best anti-malware or security features and that these other newsworthy breaches resulted from lapses that would not apply to them. Whether it is a sophisticated hacker or, more commonly, a well-meaning but negligent employee, data loss and data breaches will occur. All organizations should have procedures in place NOW to prevent data loss and to prepare for a breach. This includes IT, human resources, legal, and communications resources. Companies should designate a “data security/data breach” team with representatives from these key departments (working with outside counsel and other privacy breach specialists when needed). The team should meet periodically to review procedures, recommend improvements, and engage in periodic training on data security.
We can’t stress here enough about employee training. An employee who, for instance, wants to finish a project at home after stopping by the gym might download information that contains sensitive personal information onto a flash drive. Let’s say the gym bag gets stolen, along with the flash drive. Well, the employee’s unlucky company may now have a huge data breach situation on its hands requiring notices to customers, state attorneys general, and potential litigation and other expenses (such as paying for creditor monitoring, now industry standard). Employees need training about securing sensitive information – from shredding documents instead of putting them in the dumpster, to encrypting information that is being taken offsite, to avoiding “phishing” scams, to having unique passwords they change periodically. According to recent reports, “password” and “123456” are still among the most popular passwords. While data breaches cannot be avoided completely, we can ameliorate some risks with better practices in our organizations.
FTC Clamps Down on EU Safe Harbor Compliance: If Your Company Says It Is Certified, Keep Your Certification Current
Once again using its administrative litigation process, the Federal Trade Commission (“FTC”) announced settlements with twelve large businesses, including the Atlanta Falcons and Denver Broncos football teams, the Baker Tilly accounting firm, BitTorrent, Inc., a peer-to-peer file sharing protocol, Level 3 Communications (one of the largest Internet service providers in the world), and Reynolds Consumer Products, all relating to alleged deceptive claims of U.S.-E.U Safe harbor certifications.
The “Safe Harbor” certification, overseen by the U.S. Department of Commerce, is a voluntary privacy certification; however, it requires an annual reaffirmation to maintain “current” certification status. The FTC filed complaints against these companies alleging that the organizations made statements in their privacy policies or displayed the Safe Harbor certification mark indicating that they held current Safe Harbor certifications, even though these companies had allowed their certifications to lapse. The European Commission has recently criticized what it views as lax enforcement of the Safe Harbor process in the U.S., and issued a report with recommendations for improvements. The European Commission will review its participation in the Safe Harbor framework in a decision to be issued by summer 2014.
The process is entirely voluntary. Once a company self-certifies to the Department of Commerce and Commerce reviews and accepts the filing, a company may state that it has certified compliance with the Safe Harbor. Most companies state this certification in their privacy policies. Organizations may use the Safe Harbor “seal” on their websites and elsewhere. Annually, by the anniversary of its original filing date, a company must “reaffirm” its compliance in order for its certification to remain current.
The FTC’s action this week alleges that the twelve companies stated that they held current certifications under the U.S.-E.U. (and in three cases, the similar U.S. –Swiss) Safe Harbor frameworks, when in fact the certifications were not current. Companies which have self-certified compliance with the Safe Harbor framework should check their certifications to ensure they are up-to-date with their annual reaffirmations. The Department of Commerce maintains a public database listing the status of every self-certifying company. While the annual reaffirmation is not an overly taxing task, the FTC’s settlements with these companies demonstrate that the agency is taking its Safe Harbor enforcement role seriously and that it is monitoring compliance.
While the proposed settlements do not contain monetary penalties, the companies are barred from any further misrepresentations about their participation in any privacy or data security program sponsored by the government or any other self-regulatory or standard-setting organization. The organizations must also maintain relevant advertisements and promotional materials for five years, and the consent order (once approved) would be in place for 20 years. The proposed settlements are subject to public comment for 30 days and then require final approval of the FTC commissioners.
In privacy law and FTC enforcement, in particular, a guiding principle is “if you say it, do it, and if you don’t do it, don’t say it.” The FTC’s action on Safe Harbor enforcement is a good lesson – companies should review their privacy policies to make sure they are up-to-date, accurate, and reflect current practices, including ensuring any certifications are up-to-date. While the U.S.-EU Safe Harbor certification is voluntary, companies must complete their annual reaffirmations on time or risk enforcement.
Things look a bit bleak for the for-profit education industry: it seems like every other day a new federal or state agency is launching an investigation or proposing new regulations. The latest news is that a coalition of 32 state attorneys general, along with the Consumer Financial Protection Bureau, is expanding a probe into lending practices at for-profit colleges. This news follows pronouncements by the Securities and Exchange Commission, the Justice Department, the Federal Trade Commission and the Federal Communications Commission of stepped-up initiatives to combat alleged predatory practices by for-profit colleges. In the midst of this full frontal assault, the industry is facing a major new regulatory scheme under the Department of Education’s impending Gainful Employment rule. What the new regulatory scheme will cover and require remains to be determined, but the released drafts of the rule portend extensive record keeping and reporting requirements. With mounting investigations and regulatory scrutiny, no wonder shares in for-profit education have been on the decline: how can these companies turn a profit in the midst of all this costly government intervention?
But the CFPB and the 32-state coalition could (unwittingly) be the industry’s knights in shining armor. The enforcement agencies’ expanded probe – along with action by the SEC, DOJ, FTC and the FCC – could provide a good argument for why the Education Department’s impending Gainful Employment rule may be redundant. Since there is so much disagreement over the Gainful Employment rule, not only over the prospective text,but also over the rule’s utility in the first place,it may be time to follow the cues of some in Congress who advocate abandoning the rule when the Higher Education Act is next up for re-authorization (this year).And if Congress could be persuaded to nix the rule, educators could allocate more resources to growth that would otherwise need to be focused on compliance with complex new regulations.
This argument initially may sound like a stretch, but consider some of the following points: (1) congressional infighting about the possible effects of the rule, (2) rule making failures as interested parties cannot come together on regulatory language, and (3) current law and enforcement actions that already address the goals of the prospective rule. There are only so many ways to skin a cat, and you can only have so many cat-skinners (poor analogical cat!).
(1) Congressional Democrats are split on whether the Gainful Employment rule would protect students or negatively impact students. Thirty Democratic members of Congress recently wrote a letter to Education Secretary Arne Duncan voicing concerns over the adverse effects a Gainful Employment rule could have on students. At the same time, 31 Democratic members wrote a letter in support of the prospective rule. During the back and forth on the Democratic side, many Republicans are advocating abandoning the rule, concerned that it would ultimately hurt students.With so much uncertainty, why press forward with a rule that has been lingering in limbo for years?
(2) While Congress members deliberate the rule’s ultimate utility, the Education Department and its panel of negotiators have slogged through several sessions of a statutorily mandated negotiated rule making. They have been unable to reach any consensus on what types of metrics to incorporate into the rule, let alone what metric ranges to use. After several months, three rounds of negotiations, and three very different drafts of the prospective rule, the Education Department is no closer to final language. The third and final round of negotiations, which occurred mid-December, highlighted the extent to which opposing sides remained polarized.
(3) The Education Department has stated that its goals for the Gainful Employment rule are to:
- Define what it means for a program to prepare a student for gainful employment in a recognized occupation and construct an accountability system that distinguishes between programs that prepare students and those that do not;
- Develop measures to evaluate whether programs meet the requirement and provide the opportunity to improve program performance;
- Protect students and taxpayers by identifying GE programs with poor student outcomes and end taxpayer support of programs that do not prepare students as required; and
- Support students in deciding where to pursue education and training by increasing transparency about the costs and outcomes of GE programs.
These goals are already being addressed in current regulations and current enforcement actions. For instance, in November the FTC released marketing guidelines directed toward for-profit colleges, advising colleges against misrepresenting, for instance, their job placement and graduation rates, graduate salaries, credit transferring, etc. The announcement was accompanied by guidelines for prospective students on choosing a school. The FTC’s guidelines send a message to the for-profit education industry: ensure integrity in your marketing and advertising or face the consequences of regulatory action. A new FCC rule, which took effect last October, restricts how for-profit educators can make recruiting calls to past, current, and prospective students.The SEC and CFPB are investigating student recruitment and private lending at various for-profit colleges for possible violations of, for instance, the Dodd-Frank Act (which prohibits violations of federal consumer financial laws and unfair, deceptive or abusive acts or practices), TILA and Regulation Z. And numerous states attorneys general have been actively investigating the industry under state laws.
The expanded probe that the CFPB and state attorneys general coalition is but a continuation of the panoply of government actions and initiatives directed at the for-profit education sector. But the probe provides an excellent basis for reconsidering the necessity of the Gainful Employment rule. The for-profit industry is not shy of regulatory oversight. All the new regulation would achieve is more cost to industry and taxpayers in compliance and compliance reviews.