On April 7, 2015, two U.S. companies agreed to settle Federal Trade Commission (“FTC”) allegations that they falsely claimed to be in compliance with the U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework.
In the concurrently filed complaints against TES Franchising, LLC (“TES”), a franchisee coaching business, and American International Mailing, a mail delivery company, the FTC accused the companies of violating Section 5 of the FTC Act by indicating on their websites that they were currently certified under the U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework even though those certifications had expired years earlier. The U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Frameworks are cross-border data transfer processes which allow U.S. companies to transfer data outside the EU and Switzerland after they self-certify to the Department of Commerce that they will comply with the seven EU privacy principles: notice, choice, onward transfer, security, data integrity, access, and enforcement.
The FTC’s complaint against TES also alleges that the company misled consumers about its dispute resolution procedures. Specifically, on its website, TES misrepresented that U.S-EU Safe Harbor disputes would be settled by an “arbitration administered agency” in Connecticut with the costs of such arbitration to be split evenly between the parties; however, its Safe Harbor certification stated that it would resolve disputes through the European data protection authorities, which are at no cost to consumers and do not require in-person hearings.
The complaint also alleges that TES falsely represented that it was a licensee of the TRUSTe Privacy program even though it was not a current licensee of the program.
In order to resolve the charges, both companies agreed to sign 20-year consent decrees that prohibit them from making misrepresentations about their membership in a privacy or security program endorsed by the government or any other self-regulatory or standard-setting body. Beginning on April 7, 2015, and ending on May 30, 2015, the FTC will be accepting comments on the proposed consent orders. After the latter date, the FTC will decide whether to finalize the proposed consent decrees.
As this case demonstrates, the FTC has made a commitment to enforcing lapsed self-certification representations. In a statement released with the proposed settlement, FTC Chairwoman Edith Ramirez said, “We remain strongly committed to enforcing the U.S.-EU and U.S.-Swiss Safe Harbor Frameworks. These cases send an important message that businesses must not deceive consumers about whether they hold these certifications, and by extension, the ways in which they protect consumers.”
The FTC’s press release regarding these two cases can be found here.
American International Mailing’s consent order can be found here.
TES Franchising, LLC’s consent order can be found here.