A Legal Guide to PRIVACY AND DATA SECURITY 2024

In re Google (2012) . Google paid a $22.5 million fine to the FTC following a charge that it had placed tracking cookies on computers of Safari users. This was in violation of an earlier settlement with the FTC regarding the extent of control users were given over the use of their data. United States v. Google, Inc. , No. CV 12-04177 SI (N.D. Cal. Nov. 16, 2012). In re Facebook (2011) . The FTC charged Facebook with making changes to its privacy policy that resulted in users having data exposed to the public without warning or obtaining consent from the users. The FTC alleged both deception (failure to properly notify users) and unfairness (making material retroactive changes to privacy policies without consent). Facebook was required to develop and implement a “comprehensive privacy program” and be open to privacy audits for the next 20 years. (FTC File No. 092-3184). In re Toysmart.com (2000) . An Internet toy seller went bankrupt and planned to sell its customer database to pay back creditors. The FTC found this to be a deceptive practice in that its privacy policy stated that customer data “is never shared with a third party.” Toysmart.com settled and allowed the bankruptcy court to approve of the buyer and required the buyer to limit how it could use the customer data. FTC v. Toysmart. com LLC No. 00- 11341-RGS (D. Mass. July 21, 2000). In re CVS Caremark (2009) . The operator of the largest pharmacy chain in the United States agreed to pay $2.25 million to settle charges brought by the FTC and HHS for violating consumer and medical privacy laws. CVS had allegedly been disposing of patient information via unsecured trash containers. (FTC File No. 072 3119). In re TJX, Inc. (2008) . The parent company of several major retailers, in settling charges of failing to adequately protect customers’ credit card numbers, agreed to allow comprehensive audits of its data securitysystemfor20years.TJXwasaccusedofstoringunencryptedsensitive information, failing to limit unauthorized wireless access to networks, and not employing appropriate security safeguards. (FTC File No. 072-3055).

28

Made with FlippingBook - Online Brochure Maker