Consumer privacy must not be misused by companies

The Federal Trade Commission (FTC) can seek civil penalties against a company if it proves that the company knew conduct was unfair or deceptive and the FTC had already issued a written decision that such conduct is unfair or deceptive.

One way to trigger its authority to seek penalties is sending a company a “Notice of Penalty Offenses.”

This notice is a document listing certain types of conduct that the FTC has determined, in one or more administrative orders (other than a consent order), to be unfair or deceptive.

In September, the FTC sent Notices of Penalty Offenses to five well-known tax preparation companies expressing its concern that they might use or disclose confidential information collected from consumers in preparing their taxes for unrelated purposes, such as advertising, without first obtaining their consent.

The FTC didn’t accuse any company of specific wrongdoing, so I won’t name them here. But the notices said the agency was “aware of information suggesting that you may have engaged in or are engaging in deceptive or unfair conduct.” It asked the companies to review all of their practices to ensure they weren’t doing anything deceptive or unlawful.

Specific practices cited included: h Using information collected in a context where an individual reasonably expects that such information will remain confidential for purposes not explicitly requested by the individual

h Using such information to obtain a financial benefit that is separate from the benefit generated from providing the product or service requested by the individual

h Using such information to advertise, sell, or promote products or services

The FTC referred the companies to a 1973 administrative action against Beneficial Corporation in which it found that Beneficial had engaged in unfair and deceptive practices by using information collected in preparing consumers’ taxes to solicit them for loans.

The FTC noted advances in online marketing since 1973 and warned the five companies against using tracking technologies such as pixels, cookies, APIS, or SDKS to amass, infer, or transfer customers’ personal information without first obtaining their express consent.

Businesses must know meaning of ‘affirmative express consent’

Samuel Levine, the director of the FTC’S Bureau of Consumer Protection, said, “Consumers trust tax preparers with sensitive information about their finances, marital status, children, and health. Companies that violate Americans’ privacy by seeking to monetize personal data without consent can face significant financial consequences.”

The FTC says the lesson from this action as well as recent settlements against other companies, some of which I’ve written about, is that every business should know what constitutes “affirmative express consent.” It defines affirmative express consent as “any freely given, specific, informed, and unambiguous indication of an individual consumer’s wishes demonstrating agreement by the individual, such as by a clear affirmative action.”

It should be in response to clear and conspicuous disclosure of what information will be collected and how it will be used or shared. In a spoiler alert, the FTC says that burying something in a Privacy Policy or Terms of Service doesn’t meet the “clear and conspicuous” standard.

Randy Hutchinson is president & CEO Better Business Bureau of the Midsouth.