Featured

Data Privacy Plans: When Creating One, Remember to K.I.S.S.

Data privacy sits at the center of business operations today. No matter what industry you’re in, you collect, store, and use it, and the laws now require us to better protect it. The worst thing any organization can do is make that obligation more complicated than it needs to be.

Personally Identifiable Information (PII) helps guide our decision-making processes, from purchasing to marketing to sales to hiring. Data you collect on current customers,  prospective customers, and your website visitors, for example, helps you run highly-targeted and highly-effective marketing campaigns. But data privacy regulations now complicate all of that.

As data proliferation is now a well-known fact, more people are becoming concerned about companies misusing theirs. This fear and concern have sparked new legislation around the world that regulates what businesses can and cannot do with the personal information they collect.

Whether it’s the GDPR in Europe or the CCPA and CRPA in California, new privacy protection laws are forcing businesses worldwide to change their practices to become compliant.

In response, companies have been rushing to create an all-encompassing privacy protection plan hoping to ensure compliance with California’s current laws and preps them for future regulation as well.

Of course, the challenge is these laws are complicated, and building a full data privacy plan can be just as involved. The general approach has been to create a massive program that covers every possible angle.

But is that necessary? In reality, it’s not. And that’s why companies end up scaling back. Like many other things in life, it’s best to follow the principle of K.I.S.S. — Keep It Simple Stupid.

Your Data Privacy Plan Should Fit Your Company

The KISS acronym is a funny way of reminding us not to make things too complicated, as many of us tend to do from time to time. It doesn’t mean we’re stupid, of course — far from it.

This saying is perfectly suited for companies that are building a data privacy plan. Another phrase comes to mind as well: Less is more.

Privacy is a complicated issue, but that doesn’t mean you need to build an incredibly complicated plan. Just because privacy laws are big blanket regulations does not imply a one-size-fits-all approach is right.

In most cases, such an approach is not only inappropriate, it’s onerous, costly, and unnecessarily time-consuming. A better approach is to build a privacy plan that fits your company’s risk profile.

That’s what we do at Compliance and Privacy Partners. We don’t let the regulators lead us. We help companies build a privacy program that is proportionate to your risk.

Doing anything above and beyond doesn’t always provide extra protection. It often complicates the compliance burden. Data privacy shouldn’t be about building levels of bureaucracy that rival that of the government. It should be about building simple, effective, and appropriate solutions focused on data protection.

There are Opportunities Where Gaps Exist

President John F. Kennedy once said:

“The Chinese use two brush strokes to write the word ‘crisis. One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger — but recognize the opportunity.”

That quote summarizes one of our three pillars of digital strategy consulting: Where gaps exist, so, too, do opportunities.

Many companies approach data privacy compliance as an arduous task they have to undertake. They seek to protect themselves from the regulatory authorities to fill the gaps in their current policies to keep them compliant.

That line of thinking is short-sighted, though. Companies that can understand there are opportunities to be had in this process are the ones who are going to separate themselves from the competition.

Instead of merely creating a data privacy plan that will abide by laws, why not use it as a way to connect with your current and prospective customers? Why not use it as a way to be a leader in your industry?

It’s amazing what opportunities you can find when you approach mundane tasks with an open mind. CAPP can help you do just that as you build your data privacy plan.

Relationships are What Matter Most

It’s essential to keep in mind that people are at the heart of your data privacy plan through it all. It’s not just the consumers whose data you are protecting but also your employees and business partners who help you protect it. Your customers have to believe that you are treating their data with care and are being responsible.

Your employees need to help you communicate this message and to execute the plan from the inside out. And business partners will serve an essential role in protecting this data exchanged between the two.

We Do More for Our Clients

We have busy enough lives as it is. There’s no need to make things more complicated than they have to be — even when we’re talking about something as crucial as data privacy compliance.

Privacy is a core value of ours at CAPP, and we can help make it one of yours, too. By working closely with your legal, HR, compliance and IT teams, we help you build a solution that matches your potential risk.

We not only build you a program that works today but anticipates what’s to come in the ever-changing world of data privacy, data security and regulation. Through it all, we help you see that compliance isn’t a burden but rather an opportunity.

Turn Waves Of Regulation Into Oceans Of Opportunity with CAPP.

To learn more about how Compliance & Privacy Partners can help prepare you for the new wave of privacy regulations reach out to us at 323-413-7432 or email us at support@capp-llc.com for a free consultation with a Certified Information Privacy Manager.

Featured

Prop 24: New Privacy Regulations Rock The State of California

A Special Report from Compliance & Privacy Partners

California Privacy Rights Act
The CPRA amends and expands the California Consumer Privacy Act (CCPA)—California’s current privacy law that itself is nearly brand new.

Californians took a step toward more privacy protections when they voted to pass Proposition 24 on November 3. The ballot created what’s known as the California Privacy Rights Act, known as the CPRA, which will expand and amend the previously-existing California Consumer Privacy Act (CCPA). So, what does this mean for Californians and companies that do business in the state? It can be confusing, so let’s take a closer look at some of the law’s major points.

The Background

California has a unique system of ballot propositions. It allows people and groups to go around the state government to get certain initiatives passed into law.

To appear on an official ballot, groups must file a proposal with the attorney general’s office. Then, they must receive a certain number of signatures supporting the measure by a specific date. Once those signatures are confirmed, the proposition can appear on the ballot.

In 2020 alone, there were 12 ballot measures on which Californians could vote. If a ballot measure passes, it becomes law in the state — regardless of how elected officials feel about it.

The group that supported the CPRA, Californians for Consumer Privacy, has also supported other privacy measures in the past. In 2018, they got enough signatures to get the CRPA on the ballot, but they agreed to withdraw that application in exchange for the state legislature passing the CCPA.

In the two years since its passage, the group wasn’t satisfied with how the CCPA turned out. So, it moved forward again with a ballot for the CPRA, which the group saw as a stronger law.

What Does CPRA Do?

This new law is now the baseline for all privacy laws within California. Only a further ballot measure would be able to repeal it. If lawmakers were to pass an amendment to it, the groups that support CPRA could sue to have that blocked.

The only other way that the law could be changed or modified is through a future ballot passage, or if the federal government or court system invalidated it. That could be done only if it were ruled unconstitutional, or if a federal privacy law pre-empted it.

Is CPRA Effective?

There is an adjustment period now that CPRA has passed. Most of the significant provisions won’t take effect for two more years — on January 1 of 2023. This gives businesses that are affected enough time to make necessary changes. The “Right to Know” provision of the law takes effect a year earlier, on the first of 2022.

In the meantime, businesses have to comply with the current CCPA until the CPRA is fully in effect.

What Are the Differences Between CPRA and CCPA?

There are several ways that the new law differs from the original one. It seeks to take consumer privacy one step further in many cases.

There are ten primary areas where the two are different.

1. Business Regulations

A “covered business” is redefined under CPRA. In some instances, the number of businesses covered will decrease from CCPA, while in others, it will increase. That’s because:

  • It will not be applied to as many small and mid-sized businesses as CCPA because the threshold for the number of households/consumers has been increased from 50,000 to 100,000.
  • Businesses that buy, sell, or share personal information are subject to the new CPRA. Companies that get at least half of their yearly revenue in this way are subject to the law.

2. Sensitive Personal Information

The law creates an entirely new dataset known as “sensitive personal information.” It’s now subject to full disclosure and limitation. Consumers also now have the right to limit the use of their personal information by businesses.

CCPA is much broader in how it treats sensitive personal information, but not so for CPRA. There are separate restrictions and requirements on this type of information, including:

  • A requirement to offer an opt-out for both disclosure and use of it
  • A required opt-in consent standard for disclosure and use of it
  • A requirement that limits the purpose of use
  • A requirement on full disclosure

See the differences between various privacy laws below.

3. New and Expanded Rights

CPRA not only modifies some of the privacy rights California consumers have under CCPA; it also creates brand new ones.

Some of the modified rights include:

  • Businesses have to notify third parties that they must delete personal information they buy or receive.
  • Data applicable under “Right to Know” is now expanded beyond just the previous 12 months if collected after January 1 of 2022.
  • Opt-outs must also include the sharing of personal information, not just the sale of it to third parties.
  • Businesses have to abide by the same opt-in selling rights to minors. In other words, they now must wait at least 12 months after a minor has declined to sell/share their personal information.
  • Consumers can request their personal information be transmitted in a specific way — as long as it is commonly used and structured.

Some of the new rights include:

  • Consumers can request corrections if any of their personal information is wrong.
  • Consumers can opt-out of technology that makes decision-making regarding personal information automated. In other words, they can’t be profiled based on a consumer’s health, interests, location, economic situation, etc.
  • Consumers can also request information about any automated decision-making technology.
  • Consumers can limit the use of their sensitive personal information. They can ban businesses from sending it to third parties altogether.
  • Cybersecurity audits and risk assessments are now mandatory for any activity that is labeled high-risk. These audits have to be submitted regularly to the California Privacy Protection Agency.

4. Behavioral Advertising

CPRA seeks to regulate all digital advertising. It will now separate digital advertising into two categories — non-personalized and cross-context behavioral.

Personal information that businesses want to share for cross-context behavior must be subject to the Right to Opt-Out, while the other is not. This first-party advertising, as it’s called, is designated for internal business use.

There were already many businesses who were treating the Right to Opt-Out under CCPA this way. So, they won’t be required to make many changes, if any at all, in this regard.

5. New Authority

CPRA will establish a new agency that will be tasked with enforcing the law. It will be called the California Privacy Protection Agency, or CPPA. The new body will have the power to make rules, enforce rules, and investigate instances of non-compliance.

Also, there will no longer be a 30-day “cure period,” as there is under the current CCPA. This means that once a business is notified of a potential violation by the state attorney general’s office, they must act right away.

This new law will also increase maximum penalties up to $7,500 for any violation that concerns a minor. That’s triple the current maximum under the CCPA.

6. GDPR Alignment

Some of the CPRA is structured after the General Data Protection Regulation (GDPR) law that has been in effect in Europe since 2018. The three main areas that are now codified are:

  • Data: Businesses have to limit the collection, retention, sharing, and use of personal information only to what is considered “reasonably necessary and proportionate” to their purpose. It also can’t be processed for undisclosed and/or incompatible uses.
  • Storage: Businesses always have to tell consumers how long they’re retaining their personal information, and they must do this for every category of personal information. They also can’t hold onto the information for longer than “reasonably necessary” for each purpose they disclose.
  • Purpose: If a business wants to change a purpose for why they collect and/or use personal information, they must issue a new consumer notice.

Businesses that don’t comply are now also subject to enforcement through the newly-created CPPA. A violation of any three of these codes is enough for enforcement, even if no other offense is committed.

7. Service Providers

CPRA creates a new category of businesses called “contractors,” which amends the definition of a “service provider.” Contractors must now not only abide by these regulations, but they must state that they understand them and will abide by them.

They must notify businesses if they work with any sub-contractor sub-service provider, and those parties must abide by the same rules in a similar written contract.

These contractors and service providers must help businesses if a consumer makes a request for privacy. Finally, companies have to hold service providers/contractors accountable (via contract) from combining the personal information they receive with other collected data.

8. Exemptions

The CPRA did grant some leeway to the state Legislature to work on regulations about business-to-business and employee exemptions. They now have until the start of 2023 to do so through a new bill. The Legislature could, of course, try to challenge this aspect of the CPRA, but they’d be in for a fight if they indeed tried to do so.

9. Consent Standard

A consent standard existed under CCPA, but it will now more closely align with the definition laid out under GDPR. This makes it much stricter, although some of this already existed under CCPA.

It includes:

  • Research exemptions
  • Financial incentive programs and an opt-in consent
  • Consent to disclosure and use by a secondary firm after already opting out
  • Minors having the power to opt-in to their personal information being shared or sold
  • Consent required to sell or share personal information following an opt-out

10. Data Breaches

The CCPA already has a private right of action in place for data breaches, and CPRA doesn’t alter that in any way.

What’s Next?

CPRA becomes fully effective on the first day of 2021. Starting around the mid-point of next year, the process of officially making the rules will begin. The Legislature has until July 1 of 2022, to adopt the final regulations under CPRA. One year after that, the CPPA will have full authority to enforce the new law.

CPRA is set to alter and expand California consumers’ privacy rights over the next few years. But there’s still a ways to go before everything is entirely in effect.

Turn Waves Of Regulation Into Oceans Of Opportunity with CAPP.

New regulations governing the use of consumer’s personally identifiable information (PII) needn’t be burdensome.  In fact, they can help protect your organization, reduce operating expenses, and identify opportunities for better governance that ensure you avoid fines, litigation exposure, and foster trust that enhances customer experiences. To learn more about how Compliance & Privacy Partners can help prepare you for the new wave of privacy regulations reach out to us at 323-413-7432 or email us at support@capp-llc.com for a free consultation with a Certified Information Privacy Manager.

What is the California Privacy Protection Agency?

One of the main changes brought about by the California Privacy Rights Act is the establishment of the California Privacy Protection Agency as an “independent watchdog” whose mission is both to “vigorously enforce” the CPRA and “ensure that businesses and consumers are well‐informed about their rights and obligations.”

The CPPA will be governed by a five‐member board and, although the CPRA provides for a 90-day window for appointments, it is expected the board members will be announced by the end of January 2021. The board will select a chairman and hire an executive director shortly thereafter.

In terms of the mandate, the CPPA will significantly go beyond the functions currently performed by the California Attorney General’s Office. In addition to enforcement and rulemaking, the CPPA will have an important educational function.

In terms of rulemaking, the CPRA requires rulemaking regarding three times as many issues as the CCPA. During 2021 and 2022, it is expected the new agency will undertake not only the update of the existing CCPA rules, but also the issuance of new ones addressing areas such as:

  • The specifics of opt-out mechanisms from “selling and “sharing” for cross-context behavioral advertising purposes with the goal of promoting clarity and ensuring such mechanisms are consumer-friendly.
  • How often and under what circumstances consumers may request the correction of their personal information, including defining the exceptions to the right to correct and how accuracy concerns may be resolved. As the existing personnel data carve-out will expire at the time the CPRA goes into effect, the rules will likely address the mechanics of correction request in the context of employment-related personal information.
  • The standard governing whether, in response to an access request, businesses will be required to provide information beyond the 12-month look-back window.
  • The standards for annual cybersecurity audits and risk assessments that may have to be conducted by businesses whose processing activities present “significant risks.”
  • Access and opt-out rights with respect to businesses’ use of automated decision-making technology, including profiling.

In addition, the CPPA “is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act.” However, as opposed to the U.S. Federal Trade Commission authority under Section 5 of the Federal Trade Commission Act, the CPPA will be able to impose fines for violations that do not rise to “knowing” violations. The fines that the CPPA may impose are identical to the ones that apply under CCPA, except that violations that relate to the data of minors are tripled (to $7,500 per violation). CPPA enforcement will not start until six months after the CPRA goes into effect July 1, 2023. It is important to note that the California attorney general retains the power to enforce the CPRA through civil penalties and will be required to coordinate its actions with the CPPA.

The CPPA will appoint a chief privacy auditor to conduct audits of businesses to ensure compliance with the CPRA. In addition, because the CPPA will have the power to cooperate with other privacy enforcement agencies in the state, as well as in “other states, territories, and countries,” it is expected that it will coordinate its investigatory actions with regulators in other jurisdictions, including European data protection authorities.

The CPPA will have an educational function and is charged with promoting “public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale and disclosure of personal information.” This includes providing guidelines not only for consumers, but also for businesses with regards to their duties under the CPRA. The CPPA also has the power to award grants from its budget for educational purposes.

Finally, upon request, the CPPA will provide technical assistance and advice to the California Legislature with respect to privacy‐related legislation, “monitor” the developments in the field of personal information protection, and establish a mechanism for organizations that are not subject to the CPRA to voluntarily self-certify compliance.

In sum, the CPPA is set to become a key privacy regulator not only in California, but across the U.S. and the globe.

It’s Not The Crime, It’s The Cover Up – Former Uber Security Chief Charged Over Covering Up 2016 Data Breach

The federal prosecutors in the United States have charged Uber’s former chief security officer, Joe Sullivan, for covering up a massive data breach that the ride-hailing company suffered in 2016.

According to the press release published by the U.S. Department of Justice, Sullivan “took deliberate steps to conceal, deflect, and mislead the Federal Trade Commission about the breach” that also involved paying hackers $100,000 ransom to keep the incident secret.

“A criminal complaint was filed today in federal court charging Joseph Sullivan with obstruction of justice and misprision of a felony in connection with the attempted cover-up of the 2016 hack of Uber Technologies,” it says.

The 2016 Uber’s data breach exposed names, email addresses, phone numbers of 57 million Uber riders and drivers, and driver license numbers of around 600,000 drivers.

The company revealed this information to the public almost a year later in 2017, immediately after Sullivan left his job at Uber in November.

Later it was reported that two hackers, Brandon Charles Glover of Florida and Vasile Mereacre of Toronto, were behind the incident to whom Sullivan approved paying money in exchange for promises to delete data of customers they had stolen.

All this started when Sullivan, as a representative for Uber, in 2016 was responding to FTC inquiries regarding a previous data breach incident in 2014, and during the same time, Brandon and Vasile contacted him regarding the new data breach.

“On November 14, 2016, approximately 10 days after providing his testimony to the FTC, Sullivan received an email from a hacker informing him that Uber had been breached again.”

“Sullivan’s team was able to confirm the breach within 24 hours of his receipt of the email. Rather than report the 2016 breach, Sullivan allegedly took deliberate steps to prevent knowledge of the breach from reaching the FTC.”

According to court documents, the ransom amount was paid through a bug bounty program in an attempt to document the blackmailing payment as bounty for white-hat hackers who point out security issues but have not compromised data.

“Uber paid the hackers $100,000 in BitCoin in December 2016, despite the fact that the hackers refused to provide their true names (at that time),” federal prosecutors said. “In addition, Sullivan sought to have the hackers sign non-disclosure agreements. The agreements contained a false representation that the hackers did not take or store any data.”

“Moreover, after Uber personnel were able to identify two of the individuals responsible for the breach, Sullivan arranged for the hackers to sign fresh copies of the non-disclosure agreements in their true names. The new agreements retained the false condition that no data had been obtained. Uber’s new management ultimately discovered the truth and disclosed the breach publicly, and to the FTC, in November 2017.”

Just last year, both hackers were pleaded guilty to several counts of charges for hacking and blackmailing Uber, LinkedIn, and other U.S. corporations.

In 2018, British and Dutch data protection regulators also fined Uber with $1.1 million for failing to protect its customers’ personal information during a 2016 cyber attack.

Now, if Sullivan found guilty of cover-up charges, he could face up to eight years in prison, as well as potential fines of up to $500,000.

Approval of Final Regulations Under the California Consumer Privacy Act

California Attorney General Xavier Becerra today announced approval by the Office of Administrative Law (OAL) of final regulations under the California Consumer Privacy Act (CCPA). Proposed final regulations were submitted to the OAL by Attorney General Becerra on June 1, 2020. During OAL’s review process, additional revisions were made to the proposed regulations. The approved regulations go into effect immediately.

“In California, privacy is an inalienable right. Californians should control who possesses their personal data and how it’s used,” said Attorney General Becerra. “With these rules finalized, California breaks ground and leads the nation to protect and advance data privacy. These rules guide consumers and businesses alike on how to implement the California Consumer Privacy Act. As we face a pandemic of historic proportions, it is particularly critical to be mindful of personal data security.”

CCPA was signed into law on June 28, 2018, and was further amended on September 23, 2018 by SB 1121 and on October 11, 2019 by AB 25, AB 874, AB 1146, AB 1355, and AB 1564. The law went into effect on January 1, 2020. CCPA grants California consumers robust data privacy rights and control over their personal information including the right to know, the right to delete, and the right to opt-out of the sale of personal information that businesses collect, and includes additional protections for minors. The regulations establish procedures for compliance and exercise of rights, as well as clarifying important transparency and accountability mechanisms for businesses subject to the law.

The regulations approved by OAL were drafted after a broad and inclusive preliminary rulemaking process, which included seven public forums, during which the office received over 300 letters. During the formal rulemaking process, Attorney General Becerra held four public hearings throughout the state, along with a 45-day comment period and two subsequent 15-day comment periods. These comment periods resulted in the submission of over 1,000 public comments, each of which were taken into consideration when drafting the final regulations.

A copy of the approved final regulations can be found here.

California Privacy Act – What Businesses Need To Do, Now.

After much anticipation, the California Attorney General (AG) announced in early June 2020 that the final California Consumer Protection Act (CCPA) regulations were being submitted to the Office of Administrative Law (OAL) for review. Once approved by the OAL, the final regulation text will be filed with the Secretary of State and become enforceable by law.

Because enforcement of the CCPA began on July 1, 2020, now is the time for covered businesses and service providers to size-up their compliance efforts. Although there are many issues that remain unclear, the regulations may provide a road map to the AG’s enforcement priorities. Among the issues addressed by the final regulations—as well as the AG’s “Final Statement of Reasons” which accompanied those regulations— are the following:

  • Privacy Policy: A business’ privacy policy must inform consumers of their rights under the CCPA and how they can submit requests to know or delete personal information. In addition, the privacy policy should disclose the categories of personal information collected, the categories of personal information disclosed for a business purpose or sold to a third party and provide on a per category basis the categories of third parties to whom the information was disclosed or sold.
  • Required Notices: The final regulations detail the information that should be included in the various notices. They also require business to use “plain, straightforward language” and a format that draws the consumer’s attention to the notice. In addition, the AG clarified that the regulations do “not require a cookie banner, but rather leave it to businesses to determine the formats that will best achieve the result in particular environments. In other words, it appears that the use and nature of tracking technologies can be disclosed in the privacy policy assuming that policy is readily available to the public.
  • Service Providers: The regulations require that service providers use the personal information they receive from businesses “to process or maintain personal information on behalf of the business … and in compliance with the written contract for services required by the CCPA,” except in certain narrowly-defined circumstances, such as building or improving the quality of their services. If an entity qualifies as a service provider, the transfer of information from a business to them is not deemed a sale. Moreover, the Final Statement of Reasons clarifies that service providers do not lose their status as service providers merely because they collect consumers’ personal information directly, if that collection is performed at the business’s direction and on behalf of that business.
  • Subcontractors: The regulations provide that service providers may hire subcontractors, as long as the subcontractors meet all the requirements for a “service provider” set forth in the CCPA and the regulations.
  • User-Enabled Privacy Controls: Businesses must honor privacy controls that clearly communicate or signal that the consumer intends to opt out of the sale of personal information.
  • Training and Recordkeeping: The regulations require training for all individuals responsible for handling consumer inquiries. Businesses must also retain records of consumer requests and how the business responded to such request for 24 months.
  • No Discrimination: A business cannot discriminate against a consumer for exercising his or her rights under the CCPA.

Read the latest regulations here.

Privacy Shield Update from the Federal Trade Commission

On July 16, 2020, the European Court of Justice issued a judgment declaring invalid the European Commission’s Decision 2016/1250/EC of July 12, 2016 on the adequacy of the EU-U.S. Privacy Shield Framework. We continue to expect companies to comply with their ongoing obligations with respect to transfers made under the Privacy Shield Framework. We also encourage companies to continue to follow robust privacy principles, such as those underlying the Privacy Shield Framework, and to review their privacy policies to ensure they describe their privacy practices accurately, including with regard to international data transfers. Updated on July 21st, 2020.

PrivacyCon 2020 | Federal Trade Commission

The FTC will host its fifth annual PrivacyCon on July 21, 2020. For PrivacyCon 2020, the FTC is seeking research presentations on any topic related to consumer privacy and security. However, we will focus in particular on the privacy of health data collected, stored, and transmitted by mobile applications (“apps”). The call for presentations saught empirical research responding to several questions, including:

What are the risks to consumer data, particularly data held by health apps, and how does the risk vary by product and data type?
Which products are transmitting user data to third parties, who are the recipients, what are the data, and what are the apparent purposes for these transmissions?
Has empirical work assessed consumer perception of the privacy and security of products that handle sensitive information? What factors affect that perception (e.g., endorsement by a credible organization, popularity, representations in the privacy policy, claims in a user interface, paid versus non-paid version)? Are consumer perceptions of the privacy and security of products accurate? How do we know?
What are the tradeoffs between product functionality (including the ability to combine data from various devices) and increased security or increased privacy protections?
Are there unique attributes or characteristics of apps that collect, store, or transmit health data that merit special attention or focus?
The deadline for submissions was April 10, 2020.

PrivacyCon is free and open to the public.

This event will be held online.

via PrivacyCon 2020 | Federal Trade Commission

FTC Releases Agenda for PrivacyCon 2020 | Federal Trade Commission

via FTC Releases Agenda for PrivacyCon 2020 | Federal Trade Commission

The Federal Trade Commission has released the final agenda for its fifth annual PrivacyCon event, which will be held online on July 21, 2020.

PrivacyCon 2020 will bring together a diverse group of stakeholders to discuss the latest research and trends related to consumer privacy and data security.

Andrew Smith, Director of the FTC’s Bureau of Consumer Protection, will give opening remarks to kick off the event and will be followed by six panel discussions. The three morning sessions will focus on research related to health apps, artificial intelligence, and Internet of Things devices. The three afternoon sessions will feature discussions on research related to the privacy and security of specific technologies such as digital cameras and virtual assistants, international privacy, and miscellaneous privacy and security issues.

Links to the research that will be presented at PrivacyCon 2020 are available on the event page. PrivacyCon will take place online from 9 a.m. ET to 5 p.m ET. A link to view PrivacyCon 2020 will be posted on the event page prior to the start of the event. Registration is not required.

CCPA Proposed Regulations Submitted to the Office of Administrative Law

California Attorney General Xavier Becerra submitted final proposed regulations under the California Consumer Privacy Act (CCPA) to the California Office of Administrative Law (OAL). The regulations will provide guidance to businesses on how to comply with the CCPA and will enable consumers to exercise new rights over their personal information. Under Executive Order N-40-20 related to the COVID-19 pandemic, OAL has 30 working days and an additional 60 calendar days to determine whether the regulations satisfy the procedural requirements of the Administrative Procedure Act. Once approved by the OAL, the final regulation text will be filed with the Secretary of State and become enforceable by law.

A copy of the complete rulemaking package submitted to OAL, including a text of the regulations, can be found at www.oag.ca.gov/ccpa.

The final proposed regulations were drafted after a broad and inclusive preliminary rulemaking process, which included seven public forums, during which the office received over 300 letters. During the formal rulemaking process, Attorney General Becerra held four public hearings throughout the state, along with a 45-day comment period and two subsequent 15-day comment periods. These comment periods resulted in the submission of over 1,000 public comments, each of which were taken into consideration when drafting the final regulations.

So, how much is this damn CCPA thing gonna #$@&%* cost me?! – Rafael Moscatel

The short answer? A lot, but not as much as you might have been told…

via So, how much is this damn CCPA thing gonna #$@&%* cost me?! – Rafael Moscatel

ILTA Blackberry and CAPP Presentation

As I’ve traveled around California doing my “Blessings of the CCPA” presentation, I’ve been asked repeatedly about the “average” cost of a CCPA solution from CFO’s, GC’s and IT folks alike. It’s a loaded question as there are many requirements to the law, from policy and website disclosures to consumer data request obligations. One size does not fit all and your organization needs to spend time methodically planning its approach before setting aside budget and other resources.

While some unprepared organizations may need to beef up spending in the near-term, others may end up refining their programs over the coming years as they realize their initial investment wasn’t as strategic as it probably needs to be.

Decision makers, consider the following:

  • What’s our true risk exposure based on the personal data we already collect, sell, barter, manage, etc. on behalf of our business partners?
  • Can we do this all in-house or should we outsource some of it?
  • Do we have any existing talent and software that might help streamline some of the CCPA’s major workstreams like data mapping?
  • What kind of fundamental changes are we willing to make to our IT infrastructure?
  • Do we fully automate self-service requests through API’s and is that even the right idea, long-term, given our risk, the evolving nature of IT and emerging legislation?
  • How can taking a principle based approach to privacy using concepts like data minimization to insulate us going forward?

Click here for a free CCPA Roadmap from Compliance and Privacy Partners.

Clearly, all of us subject to the law need to protect our business and expect some activity, whether it be through consumer requests or even the limited right of private action afforded by the CCPA. That doesn’t mean you turn your entire organization upside down and fork over hundreds of thousands of dollars in licensing ransom! Change management on this scale first requires proper risk analysis, roadmapping and getting stakeholders to buy-in and be accountable.

Then what’s my next step?

Before you embark on this journey to become a privacy-centric company, the real question you should be asking yourself is….

Are there consultants and affordable software solutions out there that will leverage our resources and best minds to help us implement a proportional strategy that protects us? 

The answer to that last question is YES!

Slide4
CAPP’s California Consumer Privacy Act Roadmap

Long-term solutions need to be fact-based and reasonable, recognizing the unique facets of your culture and business model. Big, complex and expensive isn’t always better.

It’s true there are some amazingly fancy privacy software products out there. But do you really want to spend a quarter to half-a-million dollars a year to fend off what might ultimately be a handful of consumer requests and opt-outs, when you can do the exact same thing with a far less expensive and better tool?

The bottom line…

There are so many vendors playing in the privacy space today and way too many folks are impulsively investing either too heavily or disproportionately in them just to “check the box.” Yes, of course you need to “check the box,” but running headfirst into this regulatory challenge could leave you with a budget nightmare and organizational headache you’ll soon regret.

The bottom line is your investment needs to be proportional to your risk profile and the complexity of your infrastructure and organization. Even then, you may not need a solution that costs you hundreds of thousands of dollars when you could be compliant and sleep comfortably for under $50,000 a year.

Call us today at 323-413-7432, schedule a free consultation or visit us at www.capp-llc.com to learn more about our tailored privacy compliance solutions.

CCPA Regulations Update

NOTICE OF MODIFICATIONS TO TEXT OF PROPOSED REGULATIONS AND ADDITION OF DOCUMENTS AND INFORMATION TO RULEMAKING FILE

Update to Proposed Text

Pursuant to the requirements of Government Code section 11346.8, subdivision (c), and section 44 of Title 1 of the California Code of Regulations, the California Department of Justice (Department) is providing notice of changes made to the proposed regulations regarding the California Consumer Privacy Act, which were published and noticed for public comment on October 11, 2019.  These changes are in response to comments received regarding the proposed regulations and/or to clarify and conform the proposed regulations to existing law.  The originally proposed regulations, this Notice, the text of the proposed regulations as modified, and a comparison of the text as originally proposed with the modifications, are available at www.oag.ca.gov/privacy/ccpa.

Update to Documents and Other Information Relied Upon

Pursuant to the requirements of Government Code sections 11346.8, subdivision (d), 11346.9, subdivision (a)(1), and 11347.1, the Department is also providing notice that documents and other information which the Department has relied upon in adopting the proposed regulations have been added to the rulemaking file and are available for public inspection and comment.

The documents and information added to the rulemaking file are as follows:

Accenture Interactive, See people, not patterns. (2019). Available at https://www.accenture.com/_acnmedia/PDF-110/Accenture-See-People-Not-Patterns.pdf.

Cranor, et al., Design and Evaluation of a Usable Icon and Tagline to Signal an Opt-Out of the Sale of Personal Information as Required by CCPA (February 4, 2020).

Douglis, et al., How the CCPA impacts civil litigation (January 28, 2020).  Available at https://iapp.org/news/a/how-the-ccpa-impacts-civil-litigation/#.

Duffy, et al., Retail Loyalty Programs Will Survive Calif. Privacy Law (September 26, 2019), Law360.  Available at https://www.law360.com/articles/1202393/print?section=california.

Paternoster, Leon, Getting round GDPR with dark patters. A case study: Techradar (August 12, 2018).  Available at https://www.leonpaternoster.com/posts/techradar-gdpr/.

Simon, et al., Summary of Key Findings from California Privacy Survey (October 16, 2019), Goodwin Simon Strategic Research.  Available at https://www.caprivacy.org/post/icymi-summary-of-key-findings-from-california-privacy-survey.

World Wide Web Consortium, Web Content Accessibility Guidelines, version 2.1 (June 5, 2018).  Available at https://www.w3.org/TR/2018/REC-WCAG21-20180605/.

The Department is also providing notice that it will not be including the following study in the rulemaking file.

Javelin Strategy & Research, 2019 Identity Fraud Study: Fraudsters Seek New Targets and Victims Bear the Brunt (March 6, 2019).

The entire rulemaking file, which includes the documents referenced above, is available for inspection and copying throughout the rulemaking process during business hours at the location listed below.  In addition, some of the documents are available at www.oag.ca.gov/privacy/ccpa.

The Department will accept written comments regarding the proposed changes or materials added to the rulemaking file between Friday, February 7, 2020 and Monday, February 24, 2020. All written comments must be submitted to the Department no later than 5:00 p.m. on February 24, 2020 by email to PrivacyRegulations@doj.ca.gov, or by mail at the address listed below.

Lisa B. Kim, Privacy Regulations Coordinator
California Office of the Attorney General
300 South Spring Street, First Floor
Los Angeles, CA 90013
Email: PrivacyRegulations@doj.ca.gov

All timely comments received that pertain to the changes to the proposed regulations or the new materials added will be reviewed and responded to by the Department’s staff as part of the compilation of the rulemaking file.  Please limit written comments to those items.

FTC Finalizes Settlement with California Tech Company Related to Privacy Shield

The Federal Trade Commission has finalized a settlement with a California technology company over allegations that it falsely claimed participation in the EU-U.S. Privacy Shield framework, which enables companies to transfer consumer data legally from European Union countries to the United States.

The FTC alleged that Medable, Inc., falsely claimed in its privacy policy that it was a certified participant in the EU-U.S. Privacy Shield framework and adhered to the program’s principles. As part of the settlement with the FTC, Medable is prohibited from misrepresenting its participation in the EU-U.S. Privacy Shield framework, any other privacy or data security program sponsored by the government, or any self-regulatory or standard-setting organization.

After receiving no comments on the proposed settlement, the Commission voted 5-0 to give final approval to the settlement.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Finalizes Settlement with Utah Company and its former CEO over Allegations they Failed to Safeguard Consumer Data

The Federal Trade Commission has granted final approval to a settlement with a Utah-based technology company related to allegations that the firm failed to put in place reasonable security safeguards, allowing a hacker to access the personal information of more than a million consumers.

The FTC alleged that InfoTrax Systems, L.C. and its former CEO Mark Rawlins failed to use reasonable, low-cost, and readily available security protections to safeguard the personal information they maintained on behalf of InfoTrax’s business clients. As a result of the company’s alleged security failures, a hacker infiltrated InfoTrax’s server, along with websites maintained by the company on behalf of clients, more than 20 times from May 2014 until March 2016. The hacker accessed consumers’ sensitive personal information, including Social Security numbers, according to the FTC’s complaint.

As part of the settlement with the FTC, InfoTrax and Rawlins are prohibited from collecting, selling, sharing, or storing personal information unless they implement an information security program that would address the security failures identified in the complaint. In addition, the settlement requires the company and Rawlins to obtain third-party assessments of their companies’ information security programs every two years.

After receiving no comments on the settlement, the Commission voted 5-0 to finalize the settlement order with InfoTrax and Rawlins.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Grants Final Approval to Settlement with Former Cambridge Analytica CEO, App Developer over Allegations they Deceived Consumers over Collection of Facebook Data

FTC Grants Final Approval to Settlement with Former Cambridge Analytica CEO, App Developer over Allegations they Deceived Consumers over Collection of Facebook Data

The Federal Trade Commission has granted final approval to a settlement with the former CEO of Cambridge Analytica, LLC and an app developer who worked with the company to resolve allegations they used deceptive tactics to collect personal information from tens of millions of Facebook users for voter profiling and targeting.

In its complaint, the FTC alleged that app developer Aleksandr Kogan worked with Cambridge Analytica and its former CEO Alexander Nix to enable Kogan’s GSRApp to collect Facebook data from app users and their Facebook friends. The FTC alleged that app users were falsely told the app would not collect users’ names or other identifiable information. The GSRApp, however, collected users’ Facebook User ID, which connects individuals to their Facebook profiles.

The Commission recently announced an Opinion that found that Cambridge Analytica, which filed for bankruptcy in 2018, engaged in similar conduct in violation of the FTC Act.

As part of the settlement, Kogan and Nix are prohibited from making false or deceptive statements regarding the extent to which they collect, use, share, or sell personal information, as well as the purposes for which they collect, use, share, or sell such information. In addition, they are required to delete or destroy any personal information collected from consumers via the GSRApp and any related work product that originated from the data.

The Commission received one comment on the proposed settlement. The Commission voted 5-0 to finalize the order and to send a response to the commenter.

Rafael Moscatel is Managing Director of Compliance and Privacy Partners, a consulting firm specializing in data governance and privacy solutions. He is an award-winning Information Governance Professional (IGP), Certified Records Manager (CRM), Certified Information Privacy Manager (CIPM). Rafael has spent the last twenty years developing large-scale Information Management Programs for the Fortune 500 including Paramount Pictures and Farmers InsuranceReach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Extends Deadline for Comments on COPPA Rule until December 11

The Federal Trade Commission is extending the deadline to submit comments on the agency’s review of the Children’s Online Privacy Protection Act Rule (COPPA Rule) until December 11, 2019.

The federal government’s Regulations.gov portal is temporarily inaccessible. The FTC is giving commenters additional time to submit comments, as well as an alternative mechanism to file them. Those unable to submit comments via Regulations.gov can submit them via email with the subject line “COPPA comment” to secretary@ftc.gov. All comments, whether filed through Regulations.gov or sent by email, must be submitted by11:59 p.m. ET on December 11, 2019.

The Commission voted 5-0 to extend the comment deadline until December 11, 2019.

Rafael Moscatel, CRM, IGP, is the Managing Director of Compliance and Privacy Partners, LLC. Reach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Issues Opinion and Order Against Cambridge Analytica For Deceiving Consumers About the Collection of Facebook Data, Compliance with EU-U.S. Privacy Shield

The Federal Trade Commission issued an Opinion finding that the data analytics and consulting company Cambridge Analytica, LLC engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting. The Opinion also found that Cambridge Analytica engaged in deceptive practices relating to its participation in the EU-U.S. Privacy Shield framework.

In an administrative complaint filed in July, FTC staff alleged that Cambridge Analytica and its then-CEO Alexander Nix and app developer Aleksandr Kogan deceived consumers. Nix and Kogan agreed to settle the FTC’s allegations. Cambridge Analytica, which filed for bankruptcy in 2018, did not respond to the complaint filed by FTC staff, or a motion submitted for summary judgment of the allegations.

The FTC staff’s administrative complaint alleged that Kogan worked with Nix and Cambridge Analytica to enable Kogan’s GSRApp to collect Facebook data from app users and their Facebook friends. The complaint alleged that app users were falsely told the app would not collect users’ names or other identifiable information. The GSRApp, however, collected users’ Facebook User ID, which connects individuals to their Facebook profiles.

The complaint also alleged that Cambridge Analytica claimed it participated in the EU-U.S. Privacy Shield—which allows companies to transfer consumer data legally from European Union countries to the United States—after allowing its certification to lapse. In addition, the complaint alleged the company failed to adhere to the Privacy Shield requirement that companies that cease participation in the Privacy Shield affirm to the Department of Commerce, which maintains the list of Privacy Shield participants, that they will continue to apply the Privacy Shield protections to personal information collected while participating in the program.

In its Opinion, the Commission found that Cambridge Analytica violated the FTC Act through the deceptive conduct alleged in the complaint. The Final Order prohibits Cambridge Analytica from making misrepresentations about the extent to which it protects the privacy and confidentiality of personal information, as well as its participation in the EU-U.S. Privacy Shield framework and other similar regulatory or standard-setting organizations. In addition, the company is required to continue to apply Privacy Shield protections to personal information it collected while participating in the program (or to provide other protections authorized by law), or return or delete the information. It also must delete the personal information that it collected through the GSRApp.

The Commission voted 5-0 to issue the Opinion and Final Order.

Rafael Moscatel, CRM, IGP, is the Managing Director of Compliance and Privacy Partners, LLC. Reach him at 323-413-7432, follow him on Twitter at @rafael_moscatel or visit http://www.capp-llc.com to learn more.

FTC Announces Settlements with Four Companies Related to Allegations they Deceived Consumers over Participation in the EU-U.S. Privacy Shield

The Federal Trade Commission has reached settlements with four companies that allegedly misrepresented their participation in the EU-U.S. Privacy Shield framework, which enables companies to transfer consumer data legally from European Union countries to the United States. The FTC also alleged that two of the companies failed to comply with Privacy Shield requirements.

In separate actions, the FTC settled Privacy Shield cases against:

In addition to allegations that each company falsely claimed to participate in the EU-U.S. Privacy Shield framework, the FTC also alleged that Click Labs and Incentive Services falsely claimed to participate in the Swiss-U.S. Privacy Shield framework, which establishes a process for companies to transfer consumer data in compliance with Swiss law.

In its cases against Global Data and TDARX, the FTC further alleged that the companies continued to claim participation in EU-U.S. Privacy Shield after allowing their certifications to lapse, and that those companies failed to comply with the framework. The companies allegedly failed to verify annually that statements about their Privacy Shield practices were accurate, and failed to affirm that they would continue to apply Privacy Shield protections to personal information collected while participating in the program.

“The Privacy Shield Framework is critical to facilitating transatlantic commerce and assuring our European partners of our commitment to data protection,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “Enforcement of the Privacy Shield framework is a priority of the FTC, and we will hold companies accountable where, as here, they fail to keep their Privacy Shield promises.”

The Department of Commerce administers both the EU-U.S. and Swiss-U.S. Privacy Shield frameworks, while the FTC enforces the promises companies make when joining the programs. With today’s announcement, the FTC has now brought a total of 21 enforcement actions related to the EU-U.S. Privacy Shield framework since it was established in 2016.

Under the settlements, all four companies are prohibited from misrepresenting their participation in the EU-U.S. Privacy Shield framework, as well as any other privacy or data security program sponsored by any government, or any self-regulatory or standard-setting organization. As part of their settlements, Global Data Vault and TDARX also are required to continue to apply the Privacy Shield protections to personal information they collected while participating in the program, or return or delete the information.

The Commission voted 5-0 to issue the proposed administrative complaints and to accept the consent agreements with the four companies. The FTC will publish a description of the consent agreement packages in the Federal Register soon. The agreements will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent orders final. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $42,530.

Call us today at 323-413-7432, schedule a free consultation or visit us at www.capp-llc.com to learn more about our tailored privacy compliance solutions.

CCPA Rulemaking Activities – Upcoming Hearings

CPA Rulemaking Activities – Upcoming Hearings

On October 10, 2018, the Attorney General released proposed regulations for the California Consumer Privacy Act of 2018 (CCPA).  The California Department of Justice (DOJ) will hold four public hearings to provide all interested persons the opportunity to present statements or comments on the proposed regulations, as detailed below.  The hearings will begin promptly at 10:00 a.m. and will conclude when the last speaker has finished their presentation.  Please note that attendees may be required to go through building security before entering each venue.  For more information about the public hearings, and to RSVP, please visit: https://www.oag.ca.gov/privacy/ccpa/rsvp.

The deadline to submit written comments is December 6, 2019 at 5:00 p.m. (PST).  Comments may be submitted via email (PrivacyRegulations@doj.ca.gov), mail (Privacy Regulations Coordinator, California Office of the Attorney General, 300 South Spring Street, First Floor, Los Angeles, CA 90013), or at the public hearings.

Please visit www.oag.ca.gov/privacy/ccpa for information about the DOJ’s CCPA rulemaking process, including the following newly added pdfs:  Tips on Submitting Effective Comments and Information about the Rulemaking Process.

PUBLIC HEARING DATES

Sacramento
December 2, 2019; 10:00 a.m.
CalEPA Building
Coastal Room, 2nd Floor
1001 I Street
Sacramento, CA 95814

Los Angeles
December 3, 2019; 10:00 a.m.
Ronald Reagan Building
Auditorium, 1st Floor
300 S. Spring Street
Los Angeles, CA 90013

San Francisco
December 4, 2019; 10:00 a.m.
Milton Marks Conference Center
Lower Level
455 Golden Gate Ave.
San Francisco, CA 94102

Fresno
December 5, 2019; 10:00 a.m.
Fresno Hugh Burns Building
Assembly Room #1036
2550 Mariposa Mall
Fresno, CA 93721

California Company Settles FTC Allegations that it Falsely Claimed Participation in EU-U.S. Privacy Shield

California Company Settles FTC Allegations that it Falsely Claimed Participation in EU-U.S. Privacy Shield

A California company has agreed to settle Federal Trade Commission allegations that it falsely claimed participation in the EU-U.S. Privacy Shield framework, which enables companies to transfer consumer data legally from European Union countries to the United States.

In its complaint, the FTC alleged that Medable, Inc.—which provides technology solutions to business customers operating in pharmaceutical, biotechnology, and research industries—falsely claimed in its privacy policy that it was a certified participant in the EU-U.S. Privacy Shield framework and adhered to the program’s principles. While the company initiated an application with the Department of Commerce in December 2017, it did not complete the steps necessary to participate in the framework.

The Department of Commerce administers the framework, while the FTC enforces the promises companies make when joining the program. With today’s announcement, the FTC has now brought a total of 17 enforcement actions related to the Privacy Shield framework since it was established in 2016.

As part of the settlement with the FTC, Medable is prohibited from misrepresenting its participation in the EU-U.S. Privacy Shield framework, any other privacy or data security program sponsored by the government, or any self-regulatory or standard-setting organization.

The Commission vote to issue the proposed administrative complaint and to accept the consent agreement with Medable was 5-0. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register, after which the Commission will decide whether to make the proposed consent order final. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $42,530.

Call us today at 323-413-7432, schedule a free consultation or visit us at www.capp-llc.com to learn more about our tailored privacy compliance solutions.

Google pushes out important updates about the California Consumer Privacy Act (CCPA)

On Monday, November 18th, Google AdSense pushed out the following updates regarding the California Consumer Privacy Act:

from Google:

The California Consumer Privacy Act (CCPA) is a new data privacy law that applies to certain businesses which collect personal information from California residents. The new law goes into effect on January 1, 2020.
Google already offers data protection terms pursuant to the General Data Protection Regulation (GDPR) in Europe. We are now also offering service provider terms under the CCPA, which will supplement those existing data protection terms (revised to reflect the CCPA), effective January 1, 2020. For customers on our online contracts and updated platform contracts, the service provider terms will be incorporated into our existing contracts via the data protection terms. For such customers, there is no action required on your part to add the service provider terms into your contract.
These service provider terms will be made available alongside new tools for partners to enable restricted data processing. Restricted data processing is intended to help partners prepare for CCPA. Some partners may decide to send a restricted data processing signal for users who click a CCPA opt-out link. Other partners may decide to enable restricted data processing for all users in California via a control in our products. Subject to the service provider terms, we will act as your CCPA service provider with respect to data processed while restricted data processing is enabled. You can refer to this article for more information on restricted data processing and to determine whether restricted data processing meets your CCPA compliance needs. Please also refer to our Help Center articles for Ad ManagerAdMobAdSense for more information on enabling restricted data processing.
Please see privacy.google.com/businesses for more information about Google’s data privacy policies.

Compliance & Privacy Partners provides smart and affordable privacy compliance, data governance and risk-management solutions designed to help organizations build privacy programs, assess, manage and remediate risks and demonstrate defensible compliance. We offer and support a variety of data privacy management platforms which include data subject fulfillment workflows, records and PI inventory management, vendor assessment and policy adherence tools, privacy impact assessments, file analysis projects and records retention enforcement.

Call us today at 323-413-7432, schedule a free consultation or visit us at www.capp-llc.com to learn more about our tailored privacy compliance solutions.

FTC Slaps InfoTrax and its CEO with Severe Cybersecurity Order

Utah Company Settles FTC Allegations it Failed to Safeguard Consumer Data

As a result, hacker gained access to personal information of a million consumers, agency says

via FTC Press Release

A Utah-based technology company has agreed to implement a comprehensive data security program to settle Federal Trade Commission allegations that the company failed to put in place reasonable security safeguards, which allowed a hacker to access the personal information of a million consumers.

InfoTrax Systems, L.C., provides back-end operation services to multi-level marketers. This includes such services as compensation, inventory, orders, accounting, training, and data security, as well as operating its clients’ website portals.

In its complaint, the FTC alleges that InfoTrax and its former CEO Mark Rawlins failed to use reasonable, low-cost, and readily available security protections to safeguard the personal information it maintained on behalf of its clients. This includes failing to:

  • inventory and delete personal information it no longer needed;
  • conduct code review of its software and testing of its network;
  • detect malicious file uploads;
  • adequately segment its network; and
  • implement cybersecurity safeguards to detect unusual activity on its network.

In addition, the FTC alleged that InfoTrax stored consumers’ personal information—such as Social Security numbers, payment card information, bank account information, and user names and passwords—in clear, readable text on its network.

“Service providers like InfoTrax don’t get a pass on protecting sensitive data they handle just because their clients are other businesses rather than individual consumers,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “As this case shows, it’s every company’s responsibility to protect customers’ personal information, especially sensitive data like Social Security numbers.”

As a result of the company’s security failures, a hacker infiltrated InfoTrax’s server, along with websites maintained by the company on behalf of clients, more than 20 times from May 2014 until March 2016. In March 2016, the intruder accessed about one million consumers’ sensitive personal information, according to the complaint.

InfoTrax did not detect these intrusions until March 2016, when it was alerted that its servers had reached maximum capacity. This alert was due to a data archive file created by the hacker who had infiltrated its network. InfoTrax’s security failures not only affected its network but also the websites of its clients, the FTC alleges.

The personal information that the intruder obtained can be used to commit identity theft and fraud. The FTC alleges that InfoTrax’s failure to provide reasonable security for personal data in its care violated the FTC’s prohibition against unfair practices.

As part of the proposed settlement with the FTC, InfoTrax and Rawlins are prohibited from collecting, selling, sharing, or storing personal information unless they implement an information security program that would address the security failures identified in the complaint. This includes assessing and documenting internal and external security risks; implementing safeguards to protect personal information from cybersecurity risks; and testing and monitoring the effectiveness of those safeguards.

In addition, the proposed settlement requires the company to obtain third-party assessments of its information security program every two years. Under the order, the assessor must specify the evidence that supports its conclusions and conduct independent sampling, employee interviews, and document review. Finally, the order grants the Commission the authority to approve the assessor for each two-year assessment period.

The Commission vote to issue the administrative complaint and to accept the proposed consent agreement with InfoTrax and Rawlins was 5-0. Commissioner Christine S. Wilson released a concurring statement.

The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $42,530.

Compliance & Privacy Partners provides smart and affordable privacy compliance, data governance and risk-management solutions designed to help organizations build privacy programs, assess, manage and remediate risks and demonstrate defensible compliance. We offer and support a variety of data privacy management platforms which include data subject fulfillment workflows, records and PI inventory management, vendor assessment and policy adherence tools, privacy impact assessments, file analysis projects and records retention enforcement.

Call us today at 323-413-7432, schedule a free consultation or visit us at www.capp-llc.com to learn more about our tailored privacy compliance solutions.

Great Scott! A True Story Illustrating the Importance of Ethics in Privacy and Records Management

Truth is stranger than fiction…

There’s a memorable scene in Back to the Future 3 where Marty receives a Western Union telegraph from Doc almost a century after it was originally mailed, warning him of events to come. Seems an unlikely possibility that any organization would honor such a request to preserve, protect and deliver documents for so long. However, that’s exactly what happens every day, all over the world, and it happened to me only a few years ago when I found out I was adopted at the age of 33! The experience was so life changing that I made a film about it which is finally available this month on Amazon and Itunes.

The Little Girl with the Big Voice, A Documentary on iTunes

The State of California, to whom I wrote a letter verifying my identification, swiftly wrote me back with a manila envelope containing a treasure trove of documents gathered from multiple state agencies. In the package were details from social workers, hospitals, doctors and even notes from my biological parents! They were all free of charge and kept under seal for over three decades! We take these systems for granted nowadays but can you imagine how effective a system must be to protect my information for this long, over so many administrations and to do it largely without computers? What really makes these processes work is not technology of course, it’s people. But what motivates these people to do such a thing?

Adoption details from the State of California

An honorable discipline based on ethics.

I’ll tell you what my own epiphany was, as somebody who works in the fields of Information Governance and Privacy… and that was that record keeping, and those who perform it, are part of the ethical backbone that so much of our society relies on. This often thankless discipline codifies and exemplifies the altruistic commitment we have, and must continue to have to one other. It’s a commitment to value the records and history that tell us who we are and a pledge to protect those records as a matter of ethics ethics and common values. It’s one of the reasons Archives and Records Management has been a passion of mine for so many years.

What can we, as information managers, learn from all of this?

With Joe Franklin

The new era of Privacy is a boon for Records Management because it underscores the truth that the most important data and records are not just necessary for business continuity, death and taxes but are personal. The return of the discussion of privacy as a fundamental right is not new of course. It’s written into the Constitution in the 4th Amendment. It has been defined historically through almost all cultures and even has biblical roots. Privacy a gift that we’re just beginning to learn how to appreciate again and a silver lining in a world struggling so hard to protect it.

So, how much is this damn CCPA thing gonna #$@&%* cost me?!

The short answer? A lot, but not as much as you might have been told…

As I’ve traveled around California doing my “Blessings of the CCPA” presentation, I’ve been asked repeatedly about the “average” cost of a CCPA solution from CFO’s, GC’s and IT folks alike. It’s a loaded question as there are many requirements to the law, from policy and website disclosures to consumer data request obligations. One size does not fit all and your organization needs to spend time methodically planning its approach before setting aside budget and other resources.

While some unprepared organizations may need to beef up spending in the near-term, others may end up refining their programs over the coming years as they realize their initial investment wasn’t as strategic as it probably needs to be.

ILTA Blackberry and CAPP Presentation
At the San Diego ILTA Presentation of “Preparing for the California Consumer Privacy Act”

Decision makers, consider the following:

  • What’s our true risk exposure based on the personal data we already collect, sell, barter, manage, etc. on behalf of our business partners?
  • Can we do this all in-house or should we outsource some of it?
  • Do we have any existing talent and software that might help streamline some of the CCPA’s major workstreams like data mapping?
  • What kind of fundamental changes are we willing to make to our IT infrastructure?
  • Do we fully automate self-service requests through API’s and is that even the right idea, long-term, given our risk, the evolving nature of IT and emerging legislation?
  • How can taking a principle based approach to privacy using concepts like data minimization to insulate us going forward?

Click here for a free CCPA Roadmap from Compliance and Privacy Partners.

Clearly, all of us subject to the law need to protect our business and expect some activity, whether it be through consumer requests or even the limited right of private action afforded by the CCPA. That doesn’t mean you turn your entire organization upside down and fork over hundreds of thousands of dollars in licensing ransom! Change management on this scale first requires proper risk analysis, roadmapping and getting stakeholders to buy-in and be accountable.

Then what’s my next step?

Before you embark on this journey to become a privacy-centric company, the real question you should be asking yourself is….

Are there consultants and affordable software solutions out there that will leverage our resources and best minds to help us implement a proportional strategy that protects us? 

The answer to that last question is YES!

Slide4
CAPP’s California Consumer Privacy Act Roadmap

Long-term solutions need to be fact-based and reasonable, recognizing the unique facets of your culture and business model. Big, complex and expensive isn’t always better.

It’s true there are some amazingly fancy privacy software products out there. But do you really want to spend a quarter to half-a-million dollars a year to fend off what might ultimately be a handful of consumer requests and opt-outs, when you can do the exact same thing with a far less expensive and better tool?

The bottom line…

There are so many vendors playing in the privacy space today and way too many folks are impulsively investing either too heavily or disproportionately in them just to “check the box.” Yes, of course you need to “check the box,” but running headfirst into this regulatory challenge could leave you with a budget nightmare and organizational headache you’ll soon regret.

The bottom line is your investment needs to be proportional to your risk profile and the complexity of your infrastructure and organization. Even then, you may not need a solution that costs you hundreds of thousands of dollars when you could be compliant and sleep comfortably for under $50,000 a year.

Call us today at 323-413-7432, schedule a free consultation or visit us at www.capp-llc.com to learn more about our tailored privacy compliance solutions.

California Dreamin’ – A Free Roadmap For your CCPA Journey

What is the CCPA and why should you care?

In response to recent stateside efforts to enshrine data protection including the California Consumer Privacy Act (CCPA), organizations are revisiting the efficacy of their Data and Information Governance (IG) programs. Laws and regulations vary by industry and company size. Yet each intend to protect consumer’s personal data by prescribing technical and governance standards backed by stiff penalties for non-compliance.


What you need to know and do to ensure compliance with California’s new Consumer Privacy Act

New regulations governing use of customer and personal data needn’t be burdensome.  Rather, they help reduce expenses and monetize the information lifecycle, identify opportunities for better governance to avoid fines and litigation exposure and foster trust to enhance customer experiences. Download this FREE detailed CCPA roadmap to see how you can get your company on the path to compliance.


This slideshow requires JavaScript.

Our CCPA and GDPR engagements include:

  • Data and resource mapping
  • Conducting gap and risk assessments
  • Controls evaluation to standards
  • Establishing governance with clearly defined roles and responsibilities
  • Policies and procedures review
  • Domestic and International legal review of privacy and security policies to fit the organization’s risk profile and culture
  • Consumer data request and delivery mechanism (including website notices)
  • Providing education and training
  • Design of role-based access control (RBAC) rights
  • Privacy impact assessment (PIA/DPIA) during product design

Third Party Due Diligence Support

  • Pre-contract due diligence and consulting
  • Cloud services guidance
  • Managed security services (build or buy guidance)
  • Third-party management program/policy

Our consulting and software solutions enable clients to comply with CCPA provisions 1798.110(a)(4), 1798.100, 1798.105, 1798.110, 1798.120, 1798.145, 1798.140, 1798.150


Call us today to see how we can help you with:

  • California Consumer Privacy Act of 2018, Amendments and Rulemaking
  • HIPAA/HITECH Security, Privacy and Breach Notification Rules
  • Generally Accepted Privacy Principles (GAPP)
  • EU’s General Data Protection Regulation (GDPR)
  • ISO/IEC 27001-2:2013
  • CIS Top 20 Critical Security Controls (CA AG requires)
  • SEC OCIE Cybersecurity Initiative
  • NIST Cybersecurity Framework
  • U.S. Sentencing/DOJ/OIG Guidelines for Effective Compliance (program foundation)
  • Applying Risk Management Program Management and Principles