FTC V. Toysmart Case

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

Protecting American citizens from unreasonable searches and seizures is the central idea of the Fourth Amendment; however, the Fourth Amendment may also apply to electronics. Classified organizations, such as, the NSA secretly collect information that includes, details of phone calls, e-mails, and personal Internet activity, although, in 2013 the NSA’s secret was revealed to the public, since it was not publicly known that the NSA had been collecting bulk phone data. The NSA later tried to defend itself and state that it doesn’t mean that they collect all personal records, such as, medical records and library records. In order for the NSA to legally store phone data the agency must first receive a warrant from the FISA Court each time it wants

One of the key components was that now, civil penalties could be assessed for failure to follow FTC’s orders, such as cease and desist orders, should the respondent ignore the order. Previously, they would just be sanctioned. In addition, the amendment to Section 5 was to include unfair and deceptive acts or practices. Prior to this passage of the Wheeler-Lea Act, it was the burden of the FTC to prove unfair methods of competition. The Wheeler-Lea Act expanded on the food and drug advertising, as well. (Brown, 1947)

Company "privacy statements" and "End User License Agreements"(EULAs) also change the expectation of privacy in ways that may not be clear without extended reading [12]. In the case of a merger between DoubleClick and Abacus Direct, in which DoubleClick was acquiring Abacus Direct, what was considered a legal use of data for each company individually constituted a breach of privacy if combined [13]. As the expectation of privacy is based on public perception and understanding, continuing technological advancement and the precedents set by court rulings on cases involving privacy will alter these expectations in the

The issue was whether there was disparate treatment based on race in the recruitment and hiring process at Target. The court also considered the issue of whether the employer’s failure to retain resumes and interview forms violated Title VII’s record retention requirements. The district court granted summary judgment to Target on both issues. Target entered into a consent decree that ended the litigation. Target agreed to pay $510,000 to the plaintiffs, revise its document-retention policies, train supervisors in legal compliance, and report on hiring decisions.

Companies have an obligation to protect their customer’s information, which goes beyond that of complying with state and federal regulations. If the company loses the trust of their customers, they risk the chance of damaging

In 2006 AOL, inadvertently, made public personal information, of some 650,000 of its members. “The members filed suit with California federal district court, on behalf of themselves and a putative nationwide class of AOL members, alleging violations of federal electronic privacy law, 18 U.S.C. § 2702(a). A subclass of AOL members who are California residents also alleged various violations of California law, including the California Consumers Legal Remedies Act, California Civil Code § 1770.” (Doe 1 v AOL LLC, 2009)

In 2008, Sony BMG Music Entertainment agreed to pay money after collecting information from at least 30,000 children. An article on the case states that, “it had collected personal information from at least 30,000 children on nearly 200 entertainment sites” (Banks 1), clearly showing a violation of COPPA by collecting the information. COPPA protects the privacy of children, ensuring a peace of mind for parents and keeps information secure for the nation's children as they grow

robust privacy protections already in place at DHS without risking exposure of personal data by: Enhancing DHS’s already robust Privacy Office to ensure the NCCIC complies with all civilian laws that protect Americans’ privacy and civil liberties. Requiring private companies to ‘scrub’ and remove personal information

FTC first became involved with consumer privacy issues in 1995, when it promoted industry self-regulation. After determining that self-regulation was not effective, FTC began taking legal action under Section 5 of the FTC Act. Section 5 limits practices considered to be unfair to instances where, among other things, 1) the practice causes or is likely to cause substantial injury to consumers; (2) the substantial injury is not reasonably avoidable by consumers; and (3) the substantial injury is not outweighed by countervailing benefits to consumers or to competition. Since 2002, the FTC has brought over 50 cases against companies that have engaged in unfair or deceptive practices that put consumers’ personal data at unreasonable risk. Most of these cases resulted in settlements and did not provide judicial decisions addressing the FTC’s authority to regulate the data security practices of companies which have suffered a data breach.

One of the largest examples of a technological privacy violation in history was the Target data breach of 2013. The Target Corporation is one of the leading innovators of the retail industry. They introduced the concept of designer partnerships, making them one of the leading clothing stores in the country (Corporate Target 1). Unfortunately, the company was targeted by Russian hackers shortly before the Christmas of 2013. In this hack, personal information, including customer names, mailing addresses, phone numbers, email addresses and credit card information, of seventy million people was stolen and used for fraud (Forbes 1). This has raised concerns over how well the company can ensure that their consumer’s privacy is protected.

Both parties consulted their attorneys whose guidance instructed them that they did not have to disclose the information. The motivating factor in both decisions was to protect the livelihood of their companies. The facts of the information that had been revealed to each company had not been proven.

A good example of this is the attack that recently hit Metropolitan Urology Group in Milwaukee, Urology Austin and ABCD Children's Pediatrics in San Antonio. This attack led to the need for the three providers to notify 352,744 patients that their personal data might have been exposed. In addition, the providers are now paying for identity theft resolution services and/or credit monitoring for 12 months.

The tension between national security and individual privacy has long existed even before the development of digitized information. Recently, two main forces have advanced the debate over this balance to the forefront of the public eye: 1) the proliferation of data by private sector companies and 2) the heightened need for homeland security and public defense. With the rapid evolution of technology, companies have aggregated pools of consumer data to improve upon internal decision making. In some cases, however, this data can be leveraged to ensure national security and public safety. This juxtaposition of enterprise and security results in a blurring of the line dividing public and private sector responsibilities. The question becomes an issue of moral obligation versus legal responsibility. What are we as consumers and citizens willing to sacrifice in exchange for safety? And does the private sector inevitably succumb to obligations originating from the public sector?

Individuals and corporations that are the victims of an organizations data theft may elect to sue the business for damages. As well as the legal costs involved, if the court rules in favor of the prosecution, then the business will be liable for the damages incurred. This has the potential to put the company out of business. Organizations will need to meet the compliance requirements of one or more Acts, depending upon their vertical industry. The requirement, which is broad-based, is to ensure customer privacy. This is essential to prevent personal details such as social security information, addresses, credit card information, and more, being divulged through data