Reasonable Basis

Sears was watching you

Sears settled a Federal Trade Commission complaint alleging that it failed to adequately disclose the scope of the information it collected through a downloaded software application available to members of its "My SHC Community."  According to the Commission's complaint, Sears paid certain consumers $10 to download "research software" that would track their "online browsing."  The invitation from Sears to participate provided the following:  "This research software will confidentially track your online browsing. This will help us better understand you and your needs, enabling us to create more relevant future offerings for you, other community members, and eventually all shoppers."  This does not sound so bad -- track my "online browsing." However, on screen 4 of the 11 screen "Privacy Statement and User License Agreement," Sears explained that the software is more invasive than the invitation made it seem.  According to the agreement, the software "monitors all of the Internet behavior that occurs on the computer on which you  install the application, including both your normal web browsing and the activity that you undertake during secure sessions, such as filling a shopping basket, completing an application form or checking your online accounts, which may include personal financial or health information."   According the Commission's complaint, these disclosures were inadequate to inform consumers that the software would monitor all of their online secure sessions – including sessions on third parties’ web sites -- and that the software would collect information from these sessions, such as the contents of shopping carts, online bank statements, drug prescription records, and even the sender, recipient, subject, and size for web-based e-mails.

The consent requires Sears to stop collecting this information and to destroy the information it has already collected.

FTC seeks comments on credit freeze statutes

The Federal Trade Commission is seeking comments on the effectiveness of state credit freeze statutes.  In an effort to prevent identity theft thirty-nine states and the District of Columbia have enacted statutes that allow consumers to prevent consumer reporting agencies from releasing consumer reports (credit reports) until the freeze is lifted.  Comments are due by February 25, 2008. 

Life is good, being hacked is not

Apparel retailers Life Is Good, Inc. and Life is Good Retail, Inc. settled Federal Trade Commission (FTC) charges that they misrepresented their security and privacy policies.  According to the FTC, the claims that the retailers were "committed to maintaining" customer privacy and "all information is kept in a secure file" were deceptive because credit card information was stored in unencrypted text files and the Life Is Good web site was vulnerable to SQL injection attacks. This allowed a hacker to access the credit card numbers, expiration dates, and security codes of thousands of consumers.  The FTC has warned retailers about unencrypted data and SQL attacks since at least 2004, when it brought an action against Petco Animal Supplies, Inc. after a hacker used that method to access unencrypted customer credit card data.  In fact, the FTC could have used a "find and replace" on the Petco complaint to draft the Life is Good complaint. 

Companies that collect consumer information should constantly ask themselves the following questions.  Is it necessary to collect the data in the first place? How will the data be secured? How long does the data need to be kept?  How will the data be securely destroyed when no longer needed?  How should the system be monitored for vulnerabilities and breaches? How can the system for collecting, storing, and disposing data be improved?  Failing to think through these issues can lead to an enforcement action and customer anger.

People are tired of privacy/security breaches

Consumers are tired of the having their data exploited or compromised.  And, as this article from BusinessWeek make clear, they are increasingly voicing their displeasure through lawsuits and coordinated complaints. Recently Sears was hit with both after customers learned that it exposed their purchase histories and the CA Security Advisor Blog walked readers through how Sears distributed Spyware to consumers that joined its SHC Community.

Proposed Online Behavioral Advertising Privacy Principles

Federal Trade Commission staff is requesting comments on their just released Proposed Online Behavioral Advertising Privacy Principles. The proposed principles were developed as a result of a recent FTC workshop addressing technology and a town hall addressing behavioral marketing.  The proposed principles reflect positions that the FTC has taken in past enforcement proceedings, (or likely would take in future proceedings), and are intentionally general to encourage discussion and further refinement.  Comments are due by February 22, 2008.

FTC to focus on online advertising

Concerned that kids are being targeted with inappropriate ads and inadequate disclosure regarding information collection, Commissioner Jon Leibowitz said that the FTC plans increased scrutiny of online advertising.  Citing a recent survey showing that few people understand privacy policies, he suggested that the FTC may establish rules governing privacy policies and that more policies should be opt-in.

FTC will host Behavioral Advertising Forum

On November 1-2 the FTC will hold a forum on behavioral online advertising. The forum will bring together consumer advocates, industry representatives, technology experts and academics to address consumer protection issues raised by behavioral advertising.  A copy of the agenda is here.

More dumpster diving

A press release from Texas Attorney General Greg Abbott at the beginning of the month announces a lawsuit against the Minnesota-based company Lifetime Fitness for irresponsibly exposing consumers to identity theft by discarding consumer's personal information in accessible locations, such as garbage cans and dumpsters. Investigators found that Lifetime Fitness had improperly and negligently thrown out valuable personal information including social security numbers, birth dates, names, drivers license numbers, and credit card information that potentially exposes consumers to identity theft and fraud. These acts put Lifetime Fitness in violation of the Texas Deceptive Trade Practices Act and the 2005 Identity Theft Enforcement and Protection Act whereby the Attorney General Abbott is permitted to impose fines of up to $25,000 and $50,000 respectively. Additionally, Lifetime Fitness is being charged with violations of Chapter 25 of the Business and Commerce Code which could result in civil penalties of up to $500 per improperly discarded record.

FTC will host forum on behavioral advertising

The FTC has announced plans to hold a town hall meeting, or forum, to discuss the issue of online behavioral advertising and its implications for privacy rights. The practice of online behavioral advertising involves tracking consumer's online searches and other online activities to gather information that helps advertisers target consumer's tastes.  As a "follow-up" conference to a November 2006 FTC forum discussing "key" business developments over the next few years, the upcoming November 1 - 2, 2007 conference will host a slew of consumer advocates, experts, and representatives who will discuss consumer protection issues as they relate to online behavioral advertising. The commission is accepting requests from interested parties who wish to participate on the panel or provide discussion topics. Those who wish to participate but cannot physically attend are encouraged to view a live webcast of the forum on the FTC's Web site.

Search engine privacy

WSJ.com reports that Microsoft, IAC/InterActiveCorp (Ask.com), and Yahoo are increasing their efforts to protect the privacy of user search data.  Microsoft and Yahoo are implementing plans that will make query data anonymous after 18 and 13 months respectively, while Ask.com plans to install a new feature called AskEraser that keeps search information private from the time of the search.