Federal Trade Commission Putting Mega Bite Into Data Breach Consent Orders
The order released Wednesday against DealerBuilt contains several new provisions that general counsel will want to consider in any risk assessment, including one requiring executives to take more responsibility for compliance.
June 13, 2019 at 05:55 PM
4 minute read
Responding to critics and at least one federal appeals court that have called its orders too weak and vague, the Federal Trade Commission has put more teeth into its latest proposed consent order in a data breach case.
The order released Wednesday contains several new provisions that general counsel will want to consider in any risk assessment, including one requiring executives to take more responsibility for compliance.
“The requirements are much more detailed and specific about what the company has to do to achieve compliance and maintain adequate security practices,” explained David Shonka, a former acting general counsel at the commission and now a partner at the Redgrave law firm in Washington, D.C. “It really does answer a lot of the criticisms that commission orders have been facing.”
The changes comes after the U.S. Court of Appeals for the Eleventh Circuit last summer tossed out the commission's cease and desist order against LabMD Inc., saying it was unenforceable because “it mandate[d] a complete overhaul of LabMD's data-security program and [said] precious little about how this is to be accomplished.”
Wednesday's order involves DealerBuilt, an Iowa-based company that sells software and data services to 130 of the country's largest auto dealerships. The software handles billions of dollars' worth of transactions, and the breach exposed the consumer data of 12.5 million customers.
In a complaint, the FTC alleged that DealerBuilt failed to implement readily available and low-cost measures to protect personal information it obtained from its auto dealer clients. DealerBuilt did not immediately return messages seeking comment Thursday.
The commission alleged that DealerBuilt didn't encrypt information, have a written data security policy, provide data security training to employees or contractors, do periodic risk assessments, monitor attempts to breach information, or have reasonable data access controls in place.
An employee allegedly bought a backup storage device and plugged it in without taking steps to secure it. A hacker was able to breach it multiple times and access the customers' Social Security numbers, driver's license numbers and dates of birth, along with payroll information about dealership employees.
The commission alleged that DealerBuilt violated the FTC Act's prohibition against unfair practices and the Gramm-Leach-Bliley Act's Safeguards Rule, which requires financial institutions to develop, implement, and maintain a comprehensive information security program.
Of special note to general counsel and chief compliance officers, the consent order requires the company to obtain third-party assessments of its information security program every two years. Under the order, the assessor must specify the evidence that supports its conclusions and conduct independent sampling, employee interviews, and document review.
Significantly it also requires a senior DealerBuilt manager to provide the commission with annual certifications of compliance.
The agreement requires DealerBuilt to conduct yearly employee training, monitor its systems for security incidents, implement access controls, and inventory devices on its network.
Earlier orders from the commission lacked such detailed requirements. “Earlier the commission's approach was sort of 'go forth and sin no more' while developing a suitable program for your organization,” Shonka said. The agency was reluctant to “take away the discretion and decision-making of businesspeople,” he added.
“My reading is the commission has done what its critics have been saying for a long time it needs to do: Be precise and make the boundaries clear,” Shonka said.
The deal will be subject to public comment for 30 days after publication in the Federal Register, after which the commission will decide whether to make the proposed consent order final.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllNLRB Bans 'Captive Audience' Meetings, Yanking Away Platform Employers Used to Combat Unionizing
EBay Hires Chief Legal Officer With Proven Business Chops
'Plausible' Monopoly Allegations?: DC Appeals Court Revives Amazon Antitrust Complaint
3 minute readE-Commerce Company Alleges Albertsons Stole Trade Secrets to Develop Own Platform
4 minute readTrending Stories
- 1'It Refreshes Me': King & Spalding Privacy Leader Doubles as Equestrian Champ
- 2Class Action Filed Against Houston Health Savings Account Firm for Allegedly Confiscating Client Funds
- 3These 2 Lawyers Just Became Florida Judges
- 4'Disease-Causing Bacteria': Colgate and Tom’s of Maine Face Toothpaste Class Action
- 5Trump's SEC Overhaul: What It Means for Big Law Capital Markets, Crypto Work
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250