The recent Federal Trade Commission decision against now-defunct Cambridge Analytica holds several important lessons for general counsel and their companies. The bottom line: Don't lie to consumers.

Cambridge Analytica was the British-owned data analysis firm that scraped Facebook users' information without users' knowledge. It applied the data to seek microtargets for voter profiling and targeted advertising purposes, primarily for Donald Trump's presidential election campaign.

While privacy lawsuits over the data grab continue against Facebook Inc. and Cambridge Analytica, the commission issued its ruling on Dec. 6. The order said the Federal Trade Commission Act's prohibition on unfair or deceptive practices includes misrepresentations related to how companies handle consumers' personal information.

It said Cambridge Analytica first deceived consumers when it said it would not download names or any other identifiable information, and lied again when it claimed to participate in the European Union-U.S. Privacy Shield Framework and to adhere to privacy shield principles.

The commission did note one legal presumption that general counsel might want to file away for future cases. It said each promise "was an express claim, and as such is presumptively material." Therefore, the commission said, it did not need to "inquire separately into how these claims would be interpreted by reasonable consumers."

The commission summarized its stance in this statement: "If your company makes claims about how you use consumers' information, remember that those promises—like any other objective representation—must be truthful and supported by appropriate substantiation."

The agency found the company liable on three counts of deception. It issued a cease and desist order and also demanded that the company delete any such data it still retains. The company, which filed for bankruptcy last year, did not respond to the complaint nor oppose the order.

Attorney Julie Myers Wood, CEO of Guidepost Solutions, a compliance solutions company in Washington, D.C., said the case shows that "general counsel can't afford to sit in their offices and wait for the business to bring problems or questions to them. The order is a key reminder that general counsel must stay close to the business to ensure that they understand … any risks that the business is taking."

Wood told Corporate Counsel the case also serves as a reminder that compliance certifications, such as for the EU-U.S. Privacy Shield Framework, usually have ongoing monitoring requirements.

Often after earning a certification, she said, a company "does not put the necessary resources and funding towards maintaining that certification. The general counsel must ensure that monitoring and maintenance are appropriately resourced. You can't just set it and forget it."

Another lesson from the case, Wood said, is how closely the commission is watching the privacy shield certifications, and that self-certification or lapses in participation don't eliminate government scrutiny.

"In fact," she explained, "organizations that choose to self-certify may be under heightened review by regulators due to concerns that self-certifications are not as robust as the ones set by regulatory authorities."