[Federal Register Volume 87, Number 210 (Tuesday, November 1, 2022)]
[Notices]
[Pages 65767-65771]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-23669]
=======================================================================
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
[File No. 202 3185]
Drizly, LLC; Analysis of Proposed Consent Order To Aid Public
Comment
AGENCY: Federal Trade Commission.
ACTION: Proposed consent agreement; request for comment.
-----------------------------------------------------------------------
SUMMARY: The consent agreement in this matter settles alleged
violations of federal law prohibiting unfair or deceptive acts or
practices. The attached Analysis of Proposed Consent Order to Aid
Public Comment describes both the allegations in the draft complaint
and the terms of the consent order--embodied in the consent agreement--
that would settle these allegations.
DATES: Comments must be received on or before December 1, 2022.
ADDRESSES: Interested parties may file comments online or on paper by
following the instructions in the Request for Comment part of the
SUPPLEMENTARY INFORMATION section below. Please write ``Drizly, LLC;
File No. 202 3185'' on your comment and file your comment online at
https://www.regulations.gov by following the instructions on the web-
based form. If you prefer to file your comment on paper, please mail
your comment to the following address: Federal Trade Commission, Office
of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D),
Washington, DC 20580.
FOR FURTHER INFORMATION CONTACT: Jamie Hine (202-326-2188) or Elizabeth
Averill (202-326-2993), Bureau of Consumer Protection, Federal Trade
Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.
SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec. 2.34, 16 CFR
2.34, notice is hereby given that the above-captioned consent agreement
containing a consent order to cease and desist, having been filed with
and accepted, subject to final approval, by the Commission, has been
placed on the public record for a period of 30 days. The following
Analysis to Aid Public Comment describes the terms of the consent
agreement and the allegations in the complaint. An electronic copy of
the full text of the consent agreement package can be obtained at
https://www.ftc.gov/news-events/commission-actions.
You can file a comment online or on paper. For the Commission to
consider your comment, we must receive it on or before December 1,
2022. Write ``Drizly, LLC; File No. 202 3185'' on your comment. Your
comment--including your name and your state--will be placed on the
public record of this proceeding, including, to the extent practicable,
on the https://www.regulations.gov website.
Because of heightened security screening, postal mail addressed to
the Commission will be subject to delay. We strongly encourage you to
submit your comments online through the https://www.regulations.gov
website.
If you prefer to file your comment on paper, write ``Drizly, LLC;
File No. 202 3185'' on your comment and on the envelope, and mail your
comment to the following address: Federal Trade Commission, Office of
the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D),
Washington, DC 20580.
Because your comment will be placed on the publicly accessible
website at https://www.regulations.gov, you are solely responsible for
making sure your comment does not include any sensitive or confidential
information. In particular, your comment should not include sensitive
personal information, such as your or anyone else's Social Security
number; date of birth; driver's license number or other state
identification number, or foreign country equivalent; passport number;
financial account number; or credit or debit card number. You are also
solely responsible for making sure your comment does not include
sensitive health information, such as medical records or other
individually identifiable health information. In addition, your comment
should not include any ``trade secret or any commercial or financial
information which . . . is privileged or confidential''--as provided by
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive
information such as costs, sales statistics, inventories, formulas,
patterns, devices, manufacturing processes, or customer names.
Comments containing material for which confidential treatment is
requested must be filed in paper form, must be clearly labeled
``Confidential,'' and must comply with FTC Rule Sec. 4.9(c). In
particular, the written request for confidential treatment that
accompanies the comment must include the factual and legal basis for
the request, and must identify the specific portions of the comment to
be withheld from the public record. See FTC Rule Sec. 4.9(c). Your
comment will be kept confidential only if the General Counsel grants
your request in accordance with the law and the public interest. Once
your comment has been posted on the https://www.regulations.gov
website--as legally required by FTC Rule Sec. 4.9(b)--we cannot redact
or remove your comment from that website, unless you submit a
confidentiality request that meets the requirements for such treatment
under FTC Rule Sec. 4.9(c), and the General Counsel grants that
request.
Visit the FTC website at http://www.ftc.gov to read this document
and the news release describing the proposed settlement. The FTC Act
and other laws the Commission administers permit the collection of
public comments to consider and use in this proceeding, as appropriate.
The Commission will consider all timely and responsive public comments
that it receives on or before December 1, 2022. For information on the
Commission's privacy policy, including routine uses permitted by the
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.
Analysis of Proposed Consent Order To Aid Public Comment
The Federal Trade Commission (``Commission'') has accepted, subject
to final approval, an agreement containing a Proposed Consent Order
(``Proposed Order'') from Drizly, LLC (``Drizly'' or ``Corporate
Respondent'') and James Cory Rellas (``Rellas'' or ``Individual
Respondent''), individually and as an officer of Drizly (collectively,
``Respondents'').
[[Page 65768]]
The Proposed Order has been placed on the public record for 30 days
for receipt of comments from interested persons. Comments received
during this period will become part of the public record. After 30
days, the Commission will again review the agreement and the comments
received and will decide whether it should withdraw from the agreement
and take appropriate action or make final the agreement's Proposed
Order.
This matter involves Respondents' data security practices. Drizly
operates an e-commerce platform that enables local retailers to sell
alcohol online to consumers of legal drinking age and stored personal
information for more than 2.5 million consumers. Respondents engaged in
a number of unreasonable data security practices which caused or are
likely to cause substantial consumer injury. In addition, Corporate
Respondent made a number of misrepresentations to consumers in its
privacy policies about the measures it took to protect consumers'
personal information.
The Commission's proposed two-count complaint alleges that
Respondents have violated section 5(a) of the Federal Trade Commission
Act. First, the complaint alleges that Respondents have engaged in a
number of unreasonable security practices that led to a hacker's
unauthorized download of personal information about 2.5 million
consumers.
The complaint alleges that Respondents:
Failed to develop adequate written information security
standards, policies, procedures, or practices; assess or enforce
compliance with the written standards, policies, procedures, and
practices that it did have; and implement training for employees
(including engineers) regarding such standards, policies, procedures,
and practices;
Failed to securely store AWS and database login
credentials, by including them in GitHub repositories, and failed to
use readily available measures to scan these repositories for unsecured
credentials (such as usernames, passwords, API keys, secure access
tokens, and asymmetric private keys);
Failed to impose reasonable data access controls such as:
(1) unique and complex passwords or multifactor authentication to
access source code or databases; (2) enforcing role-based access
controls; (3) monitoring and terminating employee and contractor access
to source code once they no longer needed such access; (4) restricting
inbound connections to known IP addresses; and (5) requiring
appropriate authentications between Drizly applications and the
production environment;
Failed to prevent data loss by monitoring for unauthorized
attempts to transfer or exfiltrate consumers' personal information
outside the company's network boundaries; continually log and monitor
its systems and assets to identify data security events; and perform
regular assessments as to the effectiveness of protection measures;
Failed to test, audit, assess, or review its products' or
applications' security features; and failed to conduct regular risk
assessments, vulnerability scans, and penetration testing of its
networks and databases; and
Failed to have a policy, procedure, or practice for
inventorying and deleting consumers' personal information stored on its
network that was no longer necessary.
The complaint alleges that Respondents could have addressed each of
the failures described through well known, readily available, and
relatively low-cost measures. It also alleges Respondent's failures
caused or are likely to cause substantial injury to consumers that is
not outweighed by countervailing benefits to consumers or competition
and is not reasonably avoidable by consumers themselves. Such practice
constitutes an unfair act or practice under section 5 of the FTC Act.
Second, the complaint alleges Drizly made false statements on its
corporate website and in its mobile apps about its information security
practices. Specifically, Corporate Respondent misrepresented to
consumers that the information it collects from them is securely stored
and protected by commercially reasonable security practices. The
complaint alleges Corporate Respondent's actions constitute deceptive
acts or practices in violation of section 5(a) of the FTC Act.
The Proposed Order contains injunctive provisions addressing the
alleged unfair and deceptive conduct in connection with Respondent's
sale of dealer management system software and services. Part I of the
Proposed Order prohibits Corporate Respondent from misrepresenting the
privacy and security measures it uses to protect consumers' information
and privacy.
Part II of the Proposed Order requires Corporate Respondent to
delete within 60 days any ``Covered Information'' that is not being
used or retained in connection with providing products or services to
consumers, and to provide written statements to the Commission
describing the specific deletion of any such ``Covered Information.''
In addition, Corporate Respondent must refrain from collecting or
maintaining any future ``Covered Information,'' if the purpose is not
necessary for specific purposes described in a retention schedule.
Part III of the Proposed Order requires Drizly to create and
display on its website and apps a retention schedule for any ``Covered
Information'' it collects, maintains, uses, discloses, or provides
access. The schedule must provide a purpose for the information
collection, the business need for any retention, and a timeframe for
eventual deletion.
Part IV of the Proposed Order requires Corporate Respondent to
implement an Information Security Program, requiring among other
things:
Training in secure software development principles,
including secure engineering and defensive programming concepts;
Measures to prevent the storage of unsecured access keys
or other unsecured credentials;
Implementation of data access controls;
Risk assessment of source code and controls such as
software code review; and
Use of non-SMS based multi-factor authentication for
employees and offering multi-factor authentication as an option for
consumers.
Drizly must also obtain initial and biennial third-party
assessments of its Information Security Program implementation (Part
V), cooperate with the third-party assessor performing such assessments
(Part VI), have a senior corporate manager or corporate officer make
annual certifications regarding Corporate Respondent's compliance with
the Proposed Order's data security requirements (Part VIII), and report
to the Commission any event involving consumers' personal information
that constitutes a reportable event to any U.S. federal, state, or
local government authority (Part IX).
Part VII of the Proposed Order requires Individual Respondent James
Cory Rellas, for a period of ten years, for any business that he is a
majority owner, or is employed or functions as a CEO or other senior
officer with responsibility for information security, to ensure the
business has established and implements, and thereafter maintains, an
information security program.
Parts X-XIII of the Proposed Order are standard scofflaw provisions
requiring acknowledgment of the Order to be delivered for ten years to
corporate officers and employees engaged in the
[[Page 65769]]
conduct related to the order; a compliance report to be submitted
within one year of the order and after corporate changes; recordkeeping
requirements that last twenty years; and the submission, upon request,
of additional reports and records for compliance monitoring.
Part XIV of the Proposed Order provides that the order terminates
20 years after its issuance or 20 years after the latest complaint
filed in federal court alleging a violation of the order.
The purpose of this analysis is to aid public comment on the
Proposed Order. It is not intended to constitute an official
interpretation of the complaint or Proposed Order, or to modify in any
way the Proposed Order's terms.
By direction of the Commission, Commissioner Wilson dissenting
in part.
April J. Tabor,
Secretary.
Statement of Chair Lina M. Khan Joined by Commissioner Alvaro M. Bedoya
Today the Commission announced a settlement with the alcohol
delivery platform Drizly, LLC, and its CEO, James Cory Rellas, over the
company's alleged failure to implement reasonable security policies.
According to the complaint, this failure led to several data breaches
that exposed the personal information of 2.5 million consumers. Drizly,
a wholly owned subsidiary of Uber, collects and stores a vast amount of
user data, including names, physical addresses, geolocation, and
alcohol order history. It also stores information about consumers that
it purchases from third parties.
The Commission's complaint alleges that in 2018, Rellas and Drizly
were alerted to security weaknesses that put its stockpile of consumer
data at risk, yet they did not address the problem. According to the
complaint, the company neglected to implement basic best practices,
such as developing a written data security policy or hiring a qualified
employee responsible for data security. Then, in 2020, a hacker was
able to access a massive trove of customer data by using login
credentials reused by an executive across personal accounts. During
this period, Drizly also allegedly made multiple misrepresentations
about its data security practices in the privacy policy on its
corporate website.
The Commission's proposed order imposes several important
conditions to prevent similar failures in the future. It prohibits
Drizly from collecting or storing consumer data that is not necessary
for pre-specified business purposes. Drizly must also implement a
comprehensive security program that features the latest multifactor
authentication requirements outlined in recent orders and prevents
storage of unsecured credentials on its network or in any cloud-based
service. In addition, Drizly must create a public retention schedule
for such data, including timeframes for eventual deletion of stored
data.
Notably, the order applies personally to Rellas, who presided over
Drizly's lax data security practices as CEO. In the modern economy,
corporate executives sometimes bounce from company to company,
notwithstanding blemishes on their track record.\1\ Recognizing that
reality, the Commission's proposed order will follow Rellas even if he
leaves Drizly. Specifically, Rellas will be required to implement an
information security program at future companies if he moves to a
business collecting consumer information from more than 25,000
individuals, and where he is a majority owner, CEO, or senior officer
with information security responsibilities. Our colleague Commissioner
Wilson dissents from the portion of the settlement that personally
applies to Rellas. She argues that CEOs of large companies must be
allowed to decide for themselves whether or not to pay attention to
data security. Respectfully, we disagree. Overseeing a big company is
not an excuse to subordinate legal duties in favor of other priorities.
The FTC has a role to play in making sure a company's legal obligations
are weighed in the boardroom. Today's settlement sends a very clear
message: protecting Americans' data is not discretionary. It must be a
priority for any chief executive. If anything, it only grows more
important as a firm grows.
---------------------------------------------------------------------------
\1\ See, e.g., Rani Molla, Why Does the WeWork Guy Get to Fail
Up?, Recode (Aug 17, 2022), https://www.vox.com/recode/2022/8/17/23309756/wework-adam-neumann-flow-andreessen-venture-capital.
---------------------------------------------------------------------------
Today's action will not only correct Drizly's lax data security
practices but should also put other market participants on notice.
Limiting the baseline collection and retention of data, as we do here,
is a critical tool for protecting Americans from the risks of data
breaches, and we will continue to explore remedies centered on limiting
the data that is collected or retained in the first place.\2\ Finally,
holding individual executives accountable, as we also do here, can
further ensure firms and the officers that run them are better
incentivized to meet their legal obligations.\3\
---------------------------------------------------------------------------
\2\ See Press Release, Fed. Trade Comm'n, FTC Takes Action
Against CafePress for Data Breach Cover Up (Mar. 15, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-cafepress-data-breach-cover; Press Release, Fed.
Trade Comm'n, Press Release, Fed. Trade Comm'n, FTC Takes Action
Against Company Formerly Known as Weight Watchers for Illegally
Collecting Kids' Sensitive Health Data (Mar. 4, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive; see also Statement of Chair Lina M. Khan
Regarding the Report to Congress on Privacy and Security (Oct. 1,
2021), https://www.ftc.gov/system/files/documents/public_statements/1597024/statement_of_chair_lina_m_khan_regarding_the_report_to_congress_on_privacy_and_security_-_final.pdf; Remarks of Chair Lina M. Khan As
Prepared for Delivery, IAPP Global Privacy Summit 2022 (Apr. 11,
2022), https://www.ftc.gov/system/files/ftc_gov/pdf/Remarks%20of%20Chair%20Lina%20M.%20Khan%20at%20IAPP%20Global%20Privacy%20Summit%202022%20-%20Final%20Version.pdf; see generally Trade
Regulation Rule on Commercial Surveillance and Data Security, 87 FR
51273 (Aug. 22, 2022).
\3\ See Press Release, Fed. Trade Comm'n, FTC Bans SpyFone and
CEO from Surveillance Business and Orders Company to Delete All
Secretly Stolen Data (Sept. 1, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/09/ftc-bans-spyfone-ceo-surveillance-business-orders-company-delete-all-secretly-stolen-data.
---------------------------------------------------------------------------
Statement of Commissioner Rebecca Kelly Slaughter
The kinds of lax and unreasonable data security practices the
Commission has alleged in this settlement with Drizly \1\ have caused
immense and often incalculable harm to consumers. As the complaint
recounts, Drizly's carelessness with customer information led to an
intruder gaining access to its systems and downloading the personal
information of 2.5 million people.
---------------------------------------------------------------------------
\1\ Drizly is now a wholly owned subsidiary of Uber which
reached a settlement with the FTC over its allegedly lax data
security practices in 2018. I worry greatly about this matryoshka
doll of companies with a spotty track record of protecting consumer
data.
---------------------------------------------------------------------------
This order is commendable and marks a meaningful step forward in
our data security enforcement. Naming Drizly's CEO, James Corey Rellas,
who oversaw these practices, helps ensure that corporate leadership
must take seriously their obligation to safeguard customer information.
Mechanisms like the proposed data retention schedule are also an
excellent approach to provide accountability for data use and misuse.
Ensuring that Drizly only collects information necessary to effectuate
its published business needs should exert a disciplining influence on
its collection of consumer information. The retention schedule also
provides a clear hook for future FTC enforcement actions should Drizly
not follow its strict requirements under this proposed order.
Going forward, I believe the law would support us doing more to
safeguard Americans' data, including requiring substantive limits on
[[Page 65770]]
appropriate collection and use. While the disclosure requirements in
this order have value, disclosure alone is not enough. We know that
endless terms-of-service and other disclosures have not improved
customer understanding, facilitated meaningful choice, or protected
data from security breaches. But hackers cannot steal data that
companies did not collect in the first place; requirements that limit
what data can be collected, used, and retained could meaningfully foil
and deter data security breaches.
There are many ways to approach data collection guardrails. As the
FTC further develops a minimization framework, one framework I hope we
consider is centering a consumer's reasonable expectation that there
should be limits on the collection and use of their information based
on the service they've actually requested. I believe the agency is in a
better position to effectuate this expectation than it is to
anticipate, understand, and police every claim of reasonable business
necessity. A consumer centered data minimization standard could work
hand-in-hand with the kinds of disclosures and effective data security
practices in this proposed order to protect Americans from the ongoing
epidemic of data breaches, which are greatly exacerbated by
overcollection of consumer information.
I am grateful to the staff for their hard work on this strong
order. I look forward to seeing how our work continues to evolve in the
pursuit of protecting Americans' data and ensuring our confidence in
the practices of the businesses with which we all transact.
Concurring and Dissenting Statement of Commissioner Christine S. Wilson
Today the Commission announces a complaint and settlement resolving
allegations that Drizly, LLC and its CEO, James Cory Rellas, violated
Section 5 of the FTC Act. The complaint asserts that Drizly made false
statements on its website and in its mobile apps about its information
security practices. The Commission also alleges that Drizly engaged in
several unreasonable data security practices that led to multiple
security breaches, including a hacker's unauthorized download of
personal information about 2.5 million consumers.
The FTC has long provided clear guidance to the business community
about the fundamentals of sound data security.\1\ But, as the complaint
details, Drizly failed to develop any written information security
standards, policies, or procedures; failed to require unique and
complex passwords or multifactor authentication to access source code
or databases; failed to terminate employee or contractor access to data
once they no longer needed such access; failed to monitor for
unauthorized attempts to transfer or exfiltrate consumers' personal
information outside company networks; and engaged in other security
shortcomings. Notably, simple, readily available, low-cost measures
could have addressed Drizly's security shortcomings. I support the
complaint against the company and the order provisions that require
Drizly to implement numerous data security practices to address the
company's missing security safeguards.\2\ In particular, my Democratic
colleagues and I agree that data minimization plays an important role
in a healthy data security program. As Commissioner Slaughter notes in
her concurring statement, ``hackers cannot steal data that companies
did not collect in the first place.''
---------------------------------------------------------------------------
\1\ Fed. Trade Comm'n, Start with Security: A Guide for Business
(Jun. 2015), https://www.ftc.gov/tips-advice/business-center/guidance/start-security-guide-business; Press Release, Fed. Trade
Comm'n, Stick with Security: FTC to Provide Additional Insights on
Reasonable Data Security Practices (July 21, 2017), https://www.ftc.gov/news-events/press-releases/2017/07/sticksecurity-ftc-provide-additional-insights-reasonable-data.
\2\ While I support the settlement against Drizly, I continue to
question whether data security orders should remain in effect for 20
years. It is not realistic for the Commission to expect that
injunctive relief with respect to this dynamic and rapidly evolving
issue will remain relevant and beneficial to consumers for 20 years.
See Concurring Statement of Commissioner Christine S. Wilson, In the
Matter of InfoTrax Systems, L.C. and Mark Rawlins, File No. 1623130
(Nov. 19, 2020), https://www.ftc.gov/system/files/documents/public_statements/1553676/162_3130_infotrax_concurring_statement_cw_11-12-2019.pdf.
---------------------------------------------------------------------------
While I support the complaint against the corporate defendant, I do
not support holding the individual defendant, Rellas, liable. To seek
injunctive relief with respect to a CEO or other principal, the
Commission must show only that the individual ``participated directly
in the deceptive practices or had authority to control those
practices.'' \3\ Authority to control does not require the FTC to show
a ``specific link from [the individual] to the particular deceptive
[acts] and instead looks at whether [the individual] had authority to
control the corporate entity's practices.'' \4\ This broad standard
effectively could enable the Commission to hold individually liable the
CEOs of most companies against which we initiate enforcement action.
---------------------------------------------------------------------------
\3\ FTC v. Ross, 743 F.3d 886, 892-93 (4th Cir. 2014) (adopting
the test for individual liability used by other federal appellate
courts, including the First, Seventh, Ninth, Tenth, and Eleventh
Circuits). The Commission also can establish liability for monetary
relief by showing the defendant ``had actual knowledge of the
deceptive conduct, was recklessly indifferent to its deceptiveness,
or had an awareness of a high probability of deceptiveness and
intentionally avoided learning the truth.'' Id.
\4\ Id. at 893.
---------------------------------------------------------------------------
The Commission traditionally has exercised its prosecutorial
discretion and assessed a variety of factors when deciding whether to
name a CEO or principal, including consideration of whether individual
liability is necessary to obtain effective relief, and the level of the
individual's knowledge and participation in the alleged illegal
conduct.\5\
---------------------------------------------------------------------------
\5\ Many FTC cases involve fraudulent or deceptive conduct by
small, closely held companies that essentially serve as the alter
egos of their principal or CEO. I support naming the CEO in such a
case because the individual defendant is necessary to obtain
effective relief and/or to prevent the fraudster from opening and
shuttering companies to stay one step ahead of law enforcement. See
Concurring Statement of Commissioner Christine S. Wilson Regarding
FTC v. Progressive Leasing, LLC, File No. 1823127 (April 20, 2020),
https://www.ftc.gov/system/files/documents/public_statements/1571921/182_3127_prog_leasing_-_statement_of_commissioner_christine_s_wilson_0.pdf.
---------------------------------------------------------------------------
The order against Drizly requires the company to implement
extensive data security safeguards regardless of whether Rellas is at
the helm of the organization. Naming Rellas does not change the
injunctive obligations placed on the company to ensure that customers'
personal information is protected going forward. Moreover, the case
against Drizly makes clear that the FTC expects technology start-ups to
start with security and establish reasonable data security practices
that grow with the company.
As for knowledge and participation, the number of issues crossing a
CEO's desk on any given day is substantial. In most large companies, I
would expect CEOs to have little to no involvement with, and no direct
knowledge of, practices that are the subject of an FTC investigation.
Here, we do not allege that Rellas oversaw day-to-day operations of the
company's data security practices, had any data security expertise, or
was responsible for decisions about data security policies, procedures,
or programs.\6\ Instead, we allege that Rellas did not appropriately
[[Page 65771]]
prioritize hiring a senior executive responsible for privacy and data
security. Our complaint notes that he hired other members of the c-
suite but not a Chief Technology Officer or Chief Information Security
Officer. And for Rellas' failure to prioritize information security
over other business obligations, the order imposes on Rellas
significant compliance obligations even if he leaves Drizly.\7\
---------------------------------------------------------------------------
\6\ Cf Complaint, In re InfoTrax Systems, L.C., a limited
liability company, and Mark Rawlins, Docket No. C-4696 (Dec. 30,
2019) (alleging Rawlins spent eighteen years at a software company,
studied computer science in college, ``reviewed and approved
InfoTrax's information technology security policies, was involved in
discussions with clients about data security regularly, and was
involved in the company's long-term data security strategy.''),
https://www.ftc.gov/system/files/documents/cases/c-4696_162_3130_infotrax_complaint_clean.pdf.
\7\ The Order binds Rellas to implement an information security
program at any future company in which he is a majority owner, CEO,
or senior officer with information security responsibilities, where
that company collects personal information from at least 25,000
individuals. The Order does not address scenarios in which Boards of
Directors, other owners, or higher-ranking executives make it
impossible for Rellas to fulfill his obligations.
---------------------------------------------------------------------------
By naming Rellas, the Commission has not put the market on notice
that the FTC will use its resources to target lax data security
practices. Instead, it has signaled that the agency will substitute its
own judgement about corporate priorities and governance decisions for
those of companies.\8\ There is no doubt that robust data security is
important. Having a federal data security law would signal to
companies, executives, and boards of directors the importance of
implementing and maintaining data security programs that address
potential risks, taking into account the size of the business and the
nature of the data at issue. But CEOs have hundreds of issues and
numerous regulatory obligations to navigate. Companies, not federal
regulators, are better positioned to evaluate what risks require the
regular attention of a CEO. And when companies err in making those
assessments, the government will hold them accountable.
---------------------------------------------------------------------------
\8\ Then-Commissioner Phillips and I raised similar concerns in
our dissents to the FTC's regulatory reviews of the Safeguards Rule.
See Joint Statement of Commissioners Noah Joshua Phillips and
Christine S. Wilson, In the Matter of the Final Rule amending the
Gramm-Leach-Bliley Act's Safeguards Rule, File No. P145407 (Oct. 27,
2021), https://www.ftc.gov/system/files/documents/public_statements/1597994/joint_statement_of_commissioners_phillips_and_wilson_in_the_matter_of_regulatory_review_of_the_1.pdf; Dissenting Statement of
Commissioner Noah Joshua Phillips and Commissioner Christine S.
Wilson, Regulatory Review of Safeguards Rule, File No. P145407 (Mar.
5, 2019), https://www.ftc.gov/system/files/documents/public_statements/1466705/reg_review_of_safeguards_rule_cmr_phillips_wilson_dissent.pdf.
---------------------------------------------------------------------------
Accordingly, I dissent from the inclusion of the individual
defendant in the complaint and settlement in this matter.
[FR Doc. 2022-23669 Filed 10-31-22; 8:45 am]
BILLING CODE 6750-01-P