FTC Testifies on New Framework for Protecting Consumer Privacy

The Federal Trade Commission testified before Congress on its new privacy framework, which sets out best practices for companies to protect the privacy of American consumers and reemphasizes the agency’s support for implementation of a “Do Not Track” mechanism that would allow consumers to control the tracking of their online activities across websites.

In delivering Commission testimony before the House Committee on Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade, FTC Chairman Jon Leibowitz said it is a “decisive moment” for consumer privacy. The testimony goes on to describe the FTC’s new privacy report, issued on Monday, which recommends that companies adopt best practices for protecting consumer privacy; the continued implementation of a Do Not Track mechanism that would allow consumers to choose whether they want to allow websites to collect information about their Internet activity; and that consumers gain greater access to information about them that is held by data brokers.

“While more work remains to be done on Do Not Track, the Commission believes that the developments to date are significant and provide an effective path forward,” the testimony states.

The report, titled “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers,” advocates three main principles for protecting consumer privacy: First, companies should adopt a “privacy by design” approach by building privacy protections into their everyday business practices. Second, companies should provide simpler and more streamlined choices to consumers about their data practices. Third, companies, particularly those that don’t deal directly with consumers, such as data brokers, should take steps to make their data practices more transparent by, for example, improving their privacy disclosures and giving consumers reasonable access to the data that companies maintain about them.

According to the testimony, the new FTC privacy report also commends initiatives undertaken by a number of companies that have begun to step up to the challenge since the agency first voiced its support for a Do Not Track mechanism in 2010: Microsoft, Mozilla, Apple and Google, as well as initiatives by the online advertising industry through the Digital Advertising Alliance and the World Wide Web Consortium, an international standard-setting body.

The privacy report also recommends that data brokers that compile information for marketing purposes make their operations more transparent by exploring creation of a centralized website to identify themselves, and that they disclose how they collect and use consumer data. The website would detail the choices that these data brokers provide consumers about their own information.

The Commission recommends Congress consider enacting general privacy legislation, and that it enact data security and breach notification legislation and targeted legislation to address data brokers, the testimony states. It also urges individual companies and self-regulatory bodies to accelerate the adoption of the principles contained in the privacy framework, to the extent they have not already done so.

The testimony describes how the FTC, the nation’s chief privacy policy and enforcement agency, has focused on privacy protection for at least 40 years, and has undertaken substantial efforts to promote privacy in the private sector through education, policy initiatives and enforcement. Earlier this week, for example, the FTC announced an enforcement action against RockYou, a social media service that allegedly failed to use reasonable security measures for consumers’ data, and collected information from about 179,000 children without obtaining the required parental consent under the Children’s Online Privacy Protection (COPPA) Rule. Under a settlement with the agency, RockYou must implement a data security program that is subject to independent, third-party audits for 20 years and pay a $250,000 civil penalty.

In addition to the privacy framework report issued on Monday, the FTC also issues reports and holds public workshops examining the implications of new technologies and business practices on consumer privacy, the testimony notes. In February 2012, for example, the FTC released a staff report on mobile applications for children that found that, for the most part, neither app stores nor app developers disclose to parents what data apps collect from children, how apps share it, and with whom. The agency plans to hold a workshop in May 2012 to discuss how such information should be provided to consumers.

The FTC also is in the midst of a comprehensive review of the Children’s Online Privacy Protection Rule, known as the COPPA Rule, in light of rapidly evolving technology and changes in the way children use and access the Internet. The agency hosted a workshop in December 2011 exploring facial recognition technology and the privacy and security implications raised by its increasing use. Also, according to the testimony, the FTC intends to examine the practices of large platforms – such as Internet browser companies, mobile operating system providers, Internet service providers, and social media services – that can collect data from across the Internet to build extensive profiles about consumers. Commission staff will host a workshop in the second half of 2012 to examine questions about the scope of such data collection practices, the potential uses of the collected data, and related issues.

In addition, the Commission supports the recent efforts and approach developed by the Department of Commerce regarding privacy issues, and looks forward to working together with the Department and the Administration as they move forward in their efforts.

The Commission vote approving the testimony and its inclusion in the formal record was 3-1, with Commissioner J. Thomas Rosch dissenting.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

(PrivacyTestimony)

FTC Takes Action Against Bogus Precious Metals Investment Scheme

The Federal Trade Commission took action to halt a telemarketing operation that allegedly took millions of dollars from senior citizens by conning them into buying precious metals on credit without clearly disclosing significant costs and risks, including the likelihood that consumers would subsequently have to pay more money or lose their investment.

According to the FTC’s papers filed with the court, the operation has taken in almost $9 million from consumers in the past two years. The court ordered a stop to the defendants’ allegedly deceptive practices pending a hearing, froze their assets, and appointed a receiver to oversee the business.

As part of the FTC’s ongoing efforts to stop scammers who target the elderly, the FTC charged that Premier Precious Metals Inc., Rushmore Consulting Group Inc., PPM Credit Inc., and the companies’ principal and owner, Anthony J. Columbo, promised consumers they could earn large profits quickly and safely by investing in precious metals. Allegedly using high-pressure sales tactics, telemarketers told consumers they were offering lucrative investments that were certain to earn consumers significant profits, with very little risk of loss. However, the leveraged investments were typically not profitable and carried a high risk of loss.

As alleged in the FTC complaint, the defendants did not clearly disclose the total costs of the investments, including the hefty fees, commissions and interest charges consumers had to pay to buy and maintain the investments. Consumers often were not told their investments were leveraged; that is, that they were agreeing to take out a loan and pay interest for up to 75 percent of the purchase price of the investment.

In addition, the defendants allegedly did not tell consumers that their leveraged investments were subject to equity calls that might require them to pay more money to prevent their investments from being liquidated. When a consumer’s equity decreased to a certain level, an equity call was issued, which required the consumer to either invest more money or allow the investment to be liquidated at a loss. In some investments, the FTC alleged, consumers were not notified that their accounts were liquidated.

Most of the defendants’ customers lost money, according to the FTC. Consumers’ equity in their investments was drained by the fees and commissions at the start of their transactions, and by the constant accumulation of service fees and interest charges on the leveraged portion of their accounts.

The FTC complaint charged the defendants with violating the FTC Act and the FTC’s Telemarketing Sales Rule. Columbo and Premier Precious Metals previously telemarketed precious metals investments for a similar operation, American Precious Metals LLC, which in May 2011 the FTC charged with deceiving consumers.

The Commission vote authorizing the staff to file the complaint was 4-0. The complaint was filed in the U.S. District Court for the Southern District of Florida.

The FTC acknowledges the assistance of the Better Business Bureau of Southeast Florida and the Caribbean, and the federal, state, and local law enforcement organizations that provided valuable investigative assistance in bringing this action: the Commodity Futures Trading Commission, the Florida Department of Agriculture and Consumer Affairs, the State of Florida Office of the Attorney General and Office of Financial Regulation, and the Broward County Sheriff’s Office.

For consumers considering investing in precious metals, the FTC offers advice, including Investing in Gold? What’s the Rush?, Investing in Bullion and Bullion Coins and Investing in Collectible Coins.

NOTE: The Commission files a complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the defendant has actually violated the law. The case will be decided by the court.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

(FTC File No. 1223009)

FTC Action Puts Robocallers Out of the Telemarketing Business

The Federal Trade Commission put a robocall operation out of the telemarketing business under a settlement resolving FTC charges that it bombarded consumers with more than two billion calls pitching a variety of products and services, including worthless extended auto warranties and credit card interest rate-reduction programs.

The final settlement order against SBN Peripherals, based near Los Angeles, which did business as Asia Pacific Telecom Inc., is part of the FTC’s ongoing crackdown on deceptive robocallers. The order bans the defendants from telemarketing and requires them to give up roughly $3 million in assets.

The FTC’s complaint alleged that the defendants delivered illegal prerecorded phone calls falsely claiming the caller had urgent information about the consumer’s auto warranty or credit card interest rate. Consumers who pressed “1” for more information were transferred to telemarketers who used fraudulent practices to sell inferior extended auto service contracts or worthless debt-reduction services. According to court papers filed by the court-appointed receiver, from January 2008 through August 2009, the defendants completed approximately 2.6 billion outbound robocalls that were answered by approximately 1.6 billion consumers, approximately 12.8 million of whom were connected to a sales agent.

As alleged in the complaint, the defendants violated the law by using robocalls to contact consumers without their written permission and called telephones listed on the National Do Not Call Registry. To make it difficult for consumers to identify the seller, the FTC also alleged that the defendants’ robocalls often transmitted caller ID information vaguely identifying the caller as “SALES DEPT” and displaying telephone numbers registered to an offshore company it controlled called Asia Pacific Telecom.

Under the proposed settlement order, Repo B.V.; SBN Peripherals Inc., doing business as SBN Dials; Johan Hendrik Smit Duyzentkunst; and Janneke Bakker-Smit Duyzentkunst are banned from telemarketing. The order also prohibits them from misrepresenting any good or service, and from selling or otherwise benefitting from customers’ personal information, and requires them to properly dispose of customers’ personal information within 30 days. The order imposes a $5.3 million judgment that will be suspended, based on their inability to pay, when they have surrendered assets valued at approximately $3 million, including more than $1 million obtained from a bank account in Hong Kong, a $375,000 lien on a home, a 50 percent interest in an office building in Saipan, the defendants’ interest in seven parcels of undeveloped land, as well as three cars and a recreational vehicle. The full judgment will become due immediately if the defendants are found to have misrepresented their financial condition.

The Commission vote approving the proposed consent order was 4-0. It is subject to court approval. The FTC filed the proposed consent order in the U.S. District Court for the Northern District of Illinois, Eastern Division.

To learn more about telemarketing scams, read Who’s Calling? Recognize and Report Phone Fraud, You Make the Call: The FTC’s Telemarketing Sales Rule, and the FTC’s new consumer alert, Robocalls are Illegal: Scammers Use False Caller IDs to Hide. The FTC also offers How to Steer Clear of Auto Warranty Scams and Credit Card Interest Rate Reduction Scams. To inform business owners, the FTC offers Reining in Robocalls and Complying with the Telemarketing Sales Rule.

NOTE: This consent order is for settlement purposes only and does not constitute an admission by the defendants that the law has been violated. Consent orders have the force of law when approved and signed by the District Court judge.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

(FTC File No. X100035)

FTC Staff: Proposed Missouri Legislation May Reduce Patient Access to Pain Management Services and Increase Prices

Federal Trade Commission staff, in response to a request from Missouri State Representative Jeanne Kirkton, stated that a bill proposed in the Missouri legislature to regulate providers of pain management services contains restrictions that are likely to raise costs, limit access, and reduce choices for Missouri patients.

Missouri House Bill 1399 would allow only physicians to treat acute and chronic pain with injections around the spine or spinal cord that are guided by imaging technology, such as ultrasound or fluoroscopy. The prohibition would apply to certified registered nurse anesthetists (CRNAs), who are advanced practice nurses with specialized training in anesthesia and pain treatment. The bill would prohibit CRNAs from providing some treatments that they currently provide to patients.

“In some areas of Missouri, no alternative providers, such as anesthesiologists or board-certified physician pain specialists, appear to be available,” the FTC staff comment stated.
“Shortages of physicians in Missouri exist now and are projected to increase. By restricting the provision of services by CRNAs, the Bill could exacerbate problems of access to care, especially for rural and other underserved populations. It may also impede price and non-price competition among providers of pain management services and increase costs to Missouri citizens.”

The FTC staff comment also stated, “Higher out-of-pocket prices, more limited hours, and reduced distribution of services throughout the state all may tend to reduce access to pain treatment,” and expressed concern that restrictions on CRNAs “may limit not only physician-CRNA collaborations, but also the ability of health care providers to develop, test, and implement the most efficient teams of pain management professionals.”

The staff comment recommended that the Missouri House of Representatives “examine whether the broad prohibition in HB 1399 is necessary for patient safety. . . . In particular, we recommend that you investigate whether there is evidence that current CRNA practice is harmful to patients and, if so, whether the Bill is tailored to address those health and safety concerns.”

The Commission vote approving the staff comment was 4-0. It was sent to Missouri State Representative Jeanne Kirkton, on March 27, 2012. A copy of the letter can be found on the FTC’s website and as a link to this press release. (FTC File No. V120002; the staff contact is Daniel J. Gilman, Office of Policy Planning, 202-326-3136.)

The FTC’s Bureau of Competition works with the Bureau of Economics to investigate alleged anticompetitive business practices and, when appropriate, recommends that the Commission take law enforcement action. To inform the Bureau about particular business practices, call 202-326-3300, send an e-mail to [email protected], or write to the Office of Policy and Coordination, Room 394, Bureau of Competition, Federal Trade Commission, 600 Pennsylvania Ave, N.W., Washington, DC 20580. To learn more about the Bureau of Competition, read Competition Counts. Like the FTC on Facebook and follow us on Twitter.

(Missouri Pain Mgt Services)

Citing Likely Anticompetitive Effects, FTC Requires ProMedica Health System to Divest St. Luke’s Hospital in Toledo, Ohio, Area

The Federal Trade Commission ruled that ProMedica Health System’s August 2010 acquisition of rival St. Luke’s Hospital was anticompetitive and likely to substantially lessen competition and increase prices for general acute-care inpatient hospital services and inpatient obstetric services sold to commercial health plans in the Toledo, Ohio area. In a 4-0 decision, the Commission ordered ProMedica to divest St. Luke’s Hospital to an FTC-approved buyer within six months after the Commission order becomes final and effective. The Commission today made public provisionally redacted public versions of its Final Order and the Commission Opinion.

The Commission challenged the acquisition in January 2011 out of concern that it would significantly harm patients, employers, and employees in the Toledo area by eliminating significant, beneficial competition between ProMedica and St. Luke’s through the creation of a combined hospital system with an increased ability to obtain supra-competitive reimbursement rates from commercial health plans, and, ultimately, from their members. The Commission’s Opinion concluded that those anticompetitive effects are likely, resulting in higher health care costs for patients, employers, and employees in the Toledo area.

The FTC issued its Opinion and Final Order on March 22, 2012, meeting a self-imposed deadline designed to expedite the agency’s administrative trial process. Under FTC Rules of Practice which the Commission finalized in 2009, a final Commission decision should be issued within 45 days after the case was argued before the Commission.

The FTC’s decision upholds in large part a December 2011 Initial Decision by Chief Administrative Law Judge D. Michael Chappell, with some variations related to market definition, in particular.

ProMedica is a non-profit healthcare system headquartered in Toledo, Ohio. Excluding St. Luke’s, ProMedica operates three general acute-care hospitals in Lucas County, Ohio: 1) The Toledo Hospital; 2) Flower Hospital; and 3) Bay Park Hospital. It also provides healthcare services throughout northwestern and west-central Ohio and southeastern Michigan.

On August 31, 2010, ProMedica acquired control of St. Luke’s, formerly an independent, not-for-profit general acute-care hospital in Maumee, Ohio, in the southwest Toledo area, pursuant to the terms of a Joinder Agreement that the parties had entered into several months earlier. At the time of the acquisition, St. Luke’s was widely recognized as a high-quality, low-cost hospital. Although ProMedica consummated the acquisition, it did so under a hold separate agreement designed to preserve St. Luke’s as an independent competitor while the FTC investigated the potential anticompetitive effects of the transaction. Under the agreement, ProMedica agreed to refrain from certain actions – for example, terminating St. Luke’s health-plan contracts, and eliminating, transferring, or consolidating St. Luke’s clinical services.

The administrative complaint, which was issued in January 2011, alleged that ProMedica’s acquisition of St. Luke’s threatened to substantially harm competition in two relevant service markets in Lucas County, Ohio: 1) general acute-care inpatient hospital services, and 2) inpatient obstetrical services. In the general acute-care inpatient hospital services market, the complaint alleged that the acquisition reduced the number of competitors in Lucas County from four to three, leaving ProMedica to face only Mercy Health Partners and The University of Toledo Medical Center, and giving it a market share approaching 60 percent.

In the market for inpatient obstetrical services in Lucas County (in which The University of Toledo Medical Center does not compete) the complaint charged that the acquisition reduced the number of competitors from three to two, leaving ProMedica to face only Mercy Health Partners, and giving it a market share of more than 80 percent.

The complaint charged that ProMedica’s acquisition of St. Luke’s eliminated significant competition between the two firms in both the general acute-care inpatient hospital services and the inpatient obstetrical services markets. Finally, the complaint alleged that the acquisition gave ProMedica the ability to demand higher rates for services performed at both St. Luke’s and at ProMedica’s other hospitals, where ProMedica has been widely recognized as having the highest rates in Lucas County.

At the time the administrative complaint was issued, the FTC, along with the Ohio Attorney General, filed a separate complaint in federal district court in Ohio seeking an order requiring ProMedica to preserve St. Luke’s as a separate independent competitor during the FTC’s administrative proceeding and any subsequent appeals. In March 2011, the United States District Court for the Northern District of Ohio granted the FTC’s and the Ohio Attorney General’s request and issued a preliminary injunction pending resolution of the administrative litigation.

In an Initial Decision issued December 5, 2011, the ALJ found that ProMedica’s acquisition of St. Luke’s eliminated competition between the two firms and reduced the number of competing hospitals in the Lucas County market for general acute-care inpatient hospital services from four to three. The ALJ found that the acquisition would increase ProMedica’s bargaining power with commercial health plans, which would lead to higher reimbursement rates. The ALJ also found that those higher rates would likely be passed on to the commercial health plans’ customers, including employers and employees, to the detriment of consumers. Accordingly, the ALJ ordered ProMedica to divest St. Luke’s to an FTC-approved buyer within 180 days.

The FTC’s Opinion and Final Order. In its Opinion, the Commission affirmed the ALJ’s decision on liability, but defined the market for general acute-care (GAC) inpatient hospital services somewhat differently, by excluding sophisticated “tertiary” services from its scope. The Commission also concluded that the combination of the two hospital providers is likely to substantially lessen competition in a separate market consisting of inpatient obstetrical services sold to commercial health plans.

“Ultimately,” wrote Commissioner Julie Brill in the Opinion on behalf of the Commission, “whether we accept Complaint Counsel’s or Respondent’s definition of the relevant markets does not affect our analysis of this transaction’s likely competitive effects. As the ALJ found, regardless of which market definition is used, market shares and concentration levels exceed the thresholds for presumptive illegality provided in the 2010 Horizontal Merger Guidelines and the case law. Respondent does not dispute this.”

The Commission found that: 1) the Joinder between ProMedica and St. Luke’s is presumptively illegal; 2) ProMedica’s claim that St. Luke’s is a weakened competitor did not provide support for allowing the Joinder to proceed; and 3) substantial evidence buttresses the presumption that the Joinder will substantially lessen competition, leading to a significant increase in ProMedica’s bargaining leverage with insurers and an increase in prices — both at St. Luke’s and at ProMedica’s legacy hospitals — for both GAC inpatient hospital services and obstetrical services. “The anticompetitive effects of Joinder will, if anything, be even more severe in the OB services market than in the overall GAC market,” the Commission wrote.

Having found liability, the Commission issued an Order requiring ProMedica to divest St. Luke’s to an approved buyer within 180 days of the date its Order becomes final and effective. Specifically, it ordered ProMedica, among other things, to:

  • Restore to St. Luke’s any assets that were removed from it under the Joinder;
  • Grant the acquirer of St. Luke’s a license to use all of St. Luke’s assets;
  • Take all actions necessary to ensure that the acquirer can conduct the St. Luke’s business in substantially the same manner as it has operated under the Joinder;
  • Place no restrictions on the acquirer’s use of the St. Luke’s assets and contracts;
  • Provide transitional services to the acquirer, if requested, for up to 12 months after it acquires St. Luke’s;
  • Allow the acquirer to recruit and employ any St. Luke’s employee, so it can establish an independent, complete, full-service medical and hospital staff; and
  • Allow the acquirer to recruit, contract with, and otherwise extend medical staff privileges to any St. Luke’s hospital staff member, so the acquirer can establish an independent, complete, full-service medical staff.

Finally, if ProMedica has not divested St. Luke’s within the time required, the FTC may appoint a trustee to sell the assets in a manner that complies with the terms of the Final Order.

The Commission vote approving the Opinion and Final Order was 4-0, with Commissioner J. Thomas Rosch issuing a separate concurring opinion. Commissioner Rosch concurred with the majority as to liability and the remedy but took issue with the majority’s product market definition and its use of econometric evidence. In particular, he would have affirmed the ALJ’s findings that the general acute-care inpatient hospital services product market includes tertiary services and that there is not a separate market for inpatient obstetrical services. In addition, he would not have relied on a “willingness-to-pay” economic model as evidence of likely post-merger unilateral effects.

ProMedica can file a petition for review with a U.S. circuit court of appeals within 60 days of service of the Final Order.

The FTC’s Bureau of Competition works with the Bureau of Economics to investigate alleged anticompetitive business practices and, when appropriate, recommends that the Commission take law enforcement action. To inform the Bureau about particular business practices, call 202-326-3300, send an e-mail to [email protected], or write to the Office of Policy and Coordination, Room 394, Bureau of Competition, Federal Trade Commission, 600 Pennsylvania Ave, N.W., Washington, DC 20580. To learn more about the Bureau of Competition, read Competition Counts. Like the FTC on Facebook and follow us on Twitter.

(FTC Docket No. 9346)
(ProMedica.final)

FTC Charges That Security Flaws in RockYou Game Site Exposed 32 Million Email Addresses and Passwords

The operator of a social game site has agreed to settle charges that, while touting its security features, it failed to protect the privacy of its users, allowing hackers to access the personal information of 32 million users. The Federal Trade Commission also alleged in its complaint against RockYou that RockYou violated the Children’s Online Privacy Protection Act Rule (COPPA Rule) in collecting information from approximately 179,000 children. The proposed FTC settlement order with the company bars future deceptive claims by the company regarding privacy and data security, requires it to implement and maintain a data security program, bars future violations of the COPPA Rule, and requires it to pay a $250,000 civil penalty to settle the COPPA charges.

The case against RockYou is part of the FTC’s ongoing effort to make sure companies live up to the privacy promises they make to consumers, and that kids’ information isn’t collected or shared online without their parents’ consent.

According to the FTC complaint, RockYou operated a website that allowed consumers to play games and use other applications. Many consumers used the site to assemble slide shows from their photos, using a caption capability and music supplied by the site. To save their slide shows, consumers had to enter their email address and email password.

The FTC’s COPPA Rule requires that website operators notify parents and obtain their consent before they collect, use, or disclose personal information from children under 13. The Rule also requires that website operators post a privacy policy that is clear, understandable, and complete.

The FTC alleged that RockYou knowingly collected approximately 179,000 children’s email addresses and associated passwords during registration – without their parents’ consent – and enabled children to create personal profiles and post personal information on slide shows that could be shared online. The company asked for kids’ date of birth, and so accepted registrations from kids under 13. In addition, the company’s security failures put users’ including children’s personal information at risk, according to the FTC. The FTC charged that RockYou violated the COPPA Rule by:

  • not spelling out its collection, use and disclosure policy for children’s information;
  • not obtaining verifiable parental consent before collecting children’s personal information; and
  • not maintaining reasonable procedures, such as encryption to protect the confidentiality, security, and integrity of personal information collected from children.

The proposed settlement order bars deceptive claims regarding privacy and data security and requires RockYou to implement a data security program and submit to security audits by independent third-party auditors every other year for 20 years. It also requires RockYou to delete information collected from children under age 13 and bars violations of COPPA. Finally, RockYou will pay a $250,000 civil penalty for its alleged COPPA violations.

The FTC has a new publication, Living Life Online, to help tweens and teens navigate the internet safely.

The Commission vote to authorize the staff to refer the complaint to the Department of Justice and to approve the proposed consent decree was 4-0. The DOJ filed the complaint and proposed consent decree on behalf of the Commission in U.S. District Court for the Northern District of California on March 26, 2012. The proposed consent decree is subject to court approval.

NOTE: The Commission authorizes the filing of a complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the defendants have actually violated the law. This consent decree is for settlement purposes only and does not constitute an admission by the defendants of a law violation. Consent decrees have the force of law when signed by the District Court judge.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call
1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

FTC Orders Graco Inc. to Hold Separate Worldwide Liquid Finishing Equipment Businesses it is Acquiring from its Rival, ITW

The Federal Trade Commission issued an order requiring Graco Inc. to hold separate the worldwide liquid finishing equipment businesses of Illinois Tool Works Inc. and ITW Finishing LLC, while allowing Graco to complete its proposed $650 million acquisition of all of ITW’s finishing equipment businesses. The FTC challenged the deal on competition grounds in December 2011.

The order ensures that Graco will not integrate certain assets into its operations, pending the FTC’s consideration of a proposed settlement that has been entered into by Graco and the FTC’s staff, but not yet accepted by the Commission. Under the order, the ITW liquid finishing equipment businesses will be run independently of – and in competition with – Graco until the FTC determines the divestitures necessary to prevent competitive harm from the acquisition. Graco can complete its acquisition, but must hold separate the entirety of the worldwide ITW liquid finishing equipment businesses, which operate under the Binks, DeVilbiss, Ransburg, and BGK brand names.

During this hold separate period, FTC staff will more fully analyze the appropriate scope of divestiture and other relief needed to remedy the anticompetitive effects of the acquisition, as alleged in the FTC’s complaint, and make its recommendation to the Commission. The Hold Separate Order allows Graco to integrate the non-liquid finishing equipment business it acquires from ITW, but will ensure that the liquid finishing assets held separate remain viable and marketable until the necessary assets can be divested. After staff completes its review, the Commission will take the action it deems appropriate.

Graco seeks to acquire the finishing equipment businesses of ITW, its rival in the manufacture and sale of equipment used to apply paints and other liquid finishes to a variety of manufactured goods, such as cars, wood cabinets, and major appliances. ITW also manufactures and sells powder coating equipment, which differs from liquid finishing equipment. A consistent high-quality finish is critical to the manufacturing process. Manufacturers need reliable, proven finishing equipment and access to local service when problems arise.

The FTC’s Complaint. In December 2011, the FTC challenged Graco’s proposed acquisition, alleging it would harm competition in North American markets for industrial equipment used to spray paint and liquid finishes on a wide variety of finished manufactured goods. The case is part of the FTC’s ongoing efforts to promote competition and benefit consumers by keeping prices low and the quality and choice of goods high.

The FTC charged that the combined Graco/ITW would control a dominant share of North American sales of industrial liquid finishing equipment and also have a monopoly specifically in the market for circulation pumps used in paint systems in automobile manufacturing plants. The FTC also alleged that the proposed transaction would end the close competition between Graco and ITW, its largest competitor, reduce or eliminate the substantial one-time price breaks and other discounts Graco and ITW offer to their distributors, and lessen Graco’s incentives to develop new products after the merger.

The FTC further alleged that the competition lost by the acquisition could not be easily replaced, as smaller liquid finishing equipment manufacturers lack the distribution and brand acceptance to compete with a combined Graco/ITW.

On March 13, 2012, the FTC issued an order withdrawing the matter from administrative adjudication for the purpose of considering a proposed settlement.

The Commission vote approving the Order to Hold Separate and Maintain Assets was 4-0. The Commission also issued a statement accompanying today’s order, explaining that the FTC is able to accept the Hold Separate Order and allow the parties to complete their planned acquisition because both the Commission staff and Graco appear to be moving toward a solution that will benefit consumers.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call
1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

(FTC File No. 111-0169; Docket No. 9350)
(Graco-ITW.final)

FTC Staff: Proposed Kentucky Legislation Could Benefit Consumers; Would Expand Patient Care by Advance Practice Registered Nurses

Federal Trade Commission staff, in response to a request from Kentucky State Senator Paul Hornback, stated that a bill proposed in the Kentucky legislature could benefit consumers by making it simpler for Advanced Practice Registered Nurses (APRNs) to prescribe certain drugs.

Kentucky Senate Bill 187 would remove a requirement that APRNs must have a signed agreement with a physician in order to prescribe nonscheduled drugs, which include antibiotics, diabetes medications, and blood pressure medications.

“It is our understanding that neither the law, nor general practice in Kentucky, involves collaboration agreements that require chart review, onsite presence by a physician, or any other form of physician supervision or monitoring,” the FTC staff comment stated. “According to the Kentucky Board of Nursing, for the more than fifteen years APRNs have had prescriptive authority, not a single APRN in Kentucky has ever been reported to the Board of Nursing for poor or inappropriate prescribing of nonscheduled drugs.”

The comment is part of the FTC’s ongoing efforts to promote competition in the health care sector, which benefits consumers through lower costs, better care and more innovation.

“Removing this requirement [of a physician agreement] has the potential to benefit consumers by expanding choices for patients, containing costs, and improving access,” the FTC staff comment stated, noting that current shortages of primary care providers in Kentucky are expected to worsen as more Kentuckians gain health insurance and seek access to primary health care services. “The Bill’s elimination of this requirement may improve access and consumer choice for primary care services, especially for rural and other underserved populations, and may also encourage beneficial price competition that can help contain health care costs.” Thus, the FTC staff recommended that, given the potential benefits, “the Kentucky legislature seek to ensure that statutory limits on APRNs are no stricter than patient protection requires.”

The Commission vote approving the staff comment was 4-0. It was sent to Kentucky State Senator Paul Hornback on March 26, 2012. A copy of the letter can be found on the FTC’s website and as a link to this press release. (FTC File No.V120004; the staff contact is Patricia Schultheiss, Office of Policy Planning, 202-326-2877)

The FTC’s Bureau of Competition works with the Bureau of Economics to investigate alleged anticompetitive business practices and, when appropriate, recommends that the Commission take law enforcement action. To inform the Bureau about particular business practices, call 202-326-3300, send an e-mail to [email protected], or write to the Office of Policy and Coordination, Room 394, Bureau of Competition, Federal Trade Commission, 600 Pennsylvania Ave, N.W., Washington, DC 20580. To learn more about the Bureau of Competition, read Competition Counts. Like the FTC on Facebook and follow us on Twitter.

(Kentucky APRNs)

FTC Issues Final Commission Report on Protecting Consumer Privacy

#

The Federal Trade Commission, the nation’s chief privacy policy and enforcement agency, issued a final report setting forth best practices for businesses to protect the privacy of American consumers and give them greater control over the collection and use of their personal data. In the report, “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations For Businesses and Policymakers,” the FTC also recommends that Congress consider enacting general privacy legislation, data security and breach notification legislation, and data broker legislation.

“If companies adopt our final recommendations for best practices – and many of them already have – they will be able to innovate and deliver creative new services that consumers can enjoy without sacrificing their privacy,” said Jon Leibowitz, Chairman of the FTC. “We are confident that consumers will have an easy to use and effective Do Not Track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don’t.”

The final privacy report expands on a preliminary staff report the FTC issued in December 2010. The final report calls on companies handling consumer data to implement recommendations for protecting privacy, including:

  • Privacy by Design – companies should build in consumers’ privacy protections at every stage in developing their products. These include reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy;
  • Simplified Choice for Businesses and Consumers – companies should give consumers the option to decide what information is shared about them, and with whom. This should include a Do-Not-Track mechanism that would provide a simple, easy way for consumers to control the tracking of their online activities.
  • Greater Transparency – companies should disclose details about their collection and use of consumers’ information, and provide consumers access to the data collected about them.

The final report notes that the FTC received over 450 comments on the staff’s preliminary recommendations. Based on technological advances and industry developments since the December 2010 staff report and in response to the comments, the agency is revising recommendations in three areas:

A person sitting at a computer using the Internet, viewing a shopping advertisement. Information shared about the user may include such things as prescription history, news and shoe preferences, shopping habits, and location information.

The final report changes the guidance’s scope. The preliminary report recommended that the proposed framework apply to all commercial entities that collect or use consumer data that can be linked to a specific consumer, computer, or other device. Recognizing the potential burden on small businesses, the report concludes that the framework should not apply to companies that collect and do not transfer only non-sensitive data from fewer than 5,000 consumers a year. The report also responds to comments filed by organizations and individuals that, with technological advances, more and more data could be “reasonably linked” to consumers, computers, or devices. The final report concludes that data is not “reasonably linked” if a company takes reasonable measures to de-identify the data, commits not to re-identify it, and prohibits downstream recipients from re-identifying it.

The report refines the guidance for when companies should provide consumers with choice about how their data is used. It states that whether a practice should include choice turns on the extent to which the practice is consistent with the context of the transaction or the consumer’s existing relationship with the business or is required or specifically authorized by law. These practices include product fulfillment and fraud prevention.

The report also contains important recommendations regarding data brokers. It notes that data brokers often buy, compile, and sell highly personal information about consumers. Consumers are often unaware of their existence and the purposes to which they use the data. The report makes two recommendations to increase the transparency of such practices. First, it reiterates the Commission’s prior support for legislation that would provide consumers with access to information held by data brokers. Second, it calls on data brokers who compile consumer data for marketing purposes to explore creation of a centralized website where consumers could get information about their practices and their options for controlling data use.

While Congress considers privacy legislation, the Commission urges individual companies and self-regulatory bodies to accelerate the adoption of the principles contained in the privacy framework, to the extent they have not already done so. Over the course of the next year, Commission staff will work to encourage consumer privacy protections by focusing on five main action items:

Do-Not-Track – The Commission commends the progress made in this area: browser vendors have developed tools to allow consumers to limit data collection about them, the Digital Advertising Alliance has developed its own icon-based system and also committed to honor the browser tools, and the World Wide Web Consortium standards-setting body is developing standards. “The Commission will work with these groups to complete implementation of an easy-to-use, persistent, and effective Do Not Track system,” the report says.

Mobile – The FTC urges companies offering mobile services to work toward improved privacy protections, including disclosures. To that end, it will host a workshop on May 30, 2012 to address how mobile privacy disclosures can be short, effective, and accessible to consumers on small screens.

Data Brokers – The Commission calls on data brokers to make their operations more transparent by creating a centralized website to identify themselves, and to disclose how they collect and use consumer data. In addition, the website should detail the choices that data brokers provide consumers about their own information.

Large Platform Providers – The report cited heightened privacy concerns about the extent to which platforms, such as Internet Service Providers, operating systems, browsers and social media companies, seek to comprehensively track consumers’ online activities. The FTC will host a public workshop in the second half of 2012 to explore issues related to comprehensive tracking.

Promoting Enforceable Self-Regulatory Codes – The FTC will work with the Department of Commerce and stakeholders to develop industry-specific codes of conduct. To the extent that strong privacy codes are developed, when companies adhere to these codes, the FTC will take that into account in its law enforcement efforts. If companies do not honor the codes they sign up for, they could be subject to FTC enforcement actions.

The vote approving the report was 3-1. Commissioner J. Thomas Rosch dissents from the issuance of the Final Privacy Report. He agrees that consumers ought to be given a broader range of choices and applauds the Report’s call for targeted legislation regarding data brokers and data security. However, Commissioner Rosch has four major concerns about the privacy framework because he believes: 1) in contravention of our promises to Congress, it is based on “unfairness” rather than deception; 2) the current state of “Do Not Track” still leaves unanswered many important questions; 3) “opt-in” will necessarily be selected as the de facto method of consumer choice for a wide swath of entities; and 4) although characterized as only “best practices,” the Report’s recommendations may be construed as federal requirements. See Dissenting Statement of Commissioner J. Thomas Rosch, Final Privacy Report at Appendix C.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

FTC To Host Press Conference on Release of Final Privacy Framework Report

WHAT: Press Conference to Discuss the FTC’s Final Privacy Framework WHO: Jon Leibowitz, Chairman WHEN: Monday, March 26, 2012
11:00 am (EDT) WHERE: Federal Trade Commission
600 Pennsylvania Avenue, N.W., Room 432
Washington, DC 20580 CALL-IN INFORMATION:  1-800-553-0327
1-888-423-3275 (international)
Confirmation number: 242349
Host: Bruce Jennings

The press conference will be webcast. Click here to view live webcast.

SOCIAL CHATS: Twitter Chat with FTC Staff
12 pm, EDT
www.twitter.com/FTC
Hashtag: #FTCpriv

Facebook Chat with FTC Staff
12 pm, EDT
www.facebook.com/federaltradecommission

MEDIA CONTACT: Office of Public Affairs
202-326-2180