On July 24, 2019, the FTC announced a $5 billion settlement with Facebook to address Facebook’s alleged violations of the FTC Act and its 2012 consent order with the FTC. The settlement comes as no surprise to the privacy community – Facebook has been closely scrutinized by the public and regulators since the Cambridge Analytica data incident in March 2018 and indicated to investors earlier this year that it anticipated a fine from the FTC between $3 and $5 billion.
An Internet advertising agency that specializes in lead generation for law firms failed to properly secure databases that included the records of about 150,000 individuals. The ad agency, X Social Media, utilizes campaigns on Facebook that target potential plaintiffs for personal injury cases, medical malpractice lawsuits, and mass tort claims. Since the Facebook ads that X Social Media uses to generate these leads are designed to collect and store medical information along with contact details, the database records themselves likely trigger many state breach notification statutes that list “medical information” as “personally identifiable information” — including California’s.
Once upon a time, Larry Page said “you can’t have privacy without security.” California clearly agrees and may test the sincerity of Mr. Page and other tech leaders innovating in the field of connected devices with new legislation signed by Governor Brown in September.
With the ink barely dry on the infamous California Consumer Privacy Act (the CCPA)—a first-of-its-kind data privacy bill in the United States—Brown signed a new Internet of Things cybersecurity bill into law, SB 327. Perhaps not so coincidentally, both laws will take effect on January 1, 2020, marking a substantial compliance deadline for technology companies big and small.
On October 25, 2016, the Federal Trade Commission (FTC) issued a guide — Data Breach Response: A Guide for Business — on steps companies should take in responding to a data breach. This latest regulatory guidance at the federal level is only the most recent in a long list of resources with which companies that deal in data (yes, that means every company) are expected to acquaint themselves for purposes of their incident response preparedness efforts. Those resources include, but are not limited to, the 47 state breach notification laws (constantly subject to amendment) and related State Attorney General guidance, the Health Insurance Portability and Accountability Act (HIPAA), and FTC consent decrees entered into with organizations that have been the victims of a data security breach and with respect to which the FTC has brought an enforcement action under its Section 5 authority.