Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

Unlike prior settlements in response to data security breaches where the FTC required the implementation of a comprehensive information security program as a remedial measure, the Buzz settlement requires Google to enact a comprehensive privacy program, consistent with the Commission’s “privacy by design” approach that we have previously blogged about.  Specifically, the FTC’s proposed settlement requires Google to establish and maintain “a comprehensive privacy program” to “address privacy risks related to the development and management of new and existing products and services for consumers” and “protect the privacy and confidentiality of covered information.” 

The settlement also requires Google to “clearly and prominently disclose” if a user’s information will be disclosed to third parties, the identity or specific categories of such third parties, and the purposes for sharing; and to obtain affirmative consent from the user regarding the sharing.  In addition, the settlement requires Google to provide a report on the effectiveness of the company’s privacy program biennially to the FTC for the next twenty years.

The FTC’s Complaint that underlies the settlement alleges that Google launched the Buzz social networking service in February 2009 within its Gmail product.  Upon logging into their Gmail accounts, users were presented with the option to “Check out Buzz” or proceed to their Gmail inbox.  The FTC alleged that even if a user opted to go to his or her inbox, that user’s information was still shared with others in the Buzz network.  The FTC claimed that Google therefore did not use the information that users provided to Google only for the purpose of providing them the company’s web-based email service (Gmail) – rather, Google also used this information in connection with the Buzz social networking service.  Moreover, Google did not request users’ consent before using the information collected from Gmail users in connection with Buzz. 

The FTC further alleged that if a user clicked a link to “Turn off Buzz” certain information about that user was still shared with others.  Moreover, the FTC alleged that Buzz did not adequately communicate that certain previously-private information would be shared by default and certain personal information was shared without users’ permission.  The FTC also claimed that the “Turn off Buzz” and options to go to the user’s inbox without signing into Buzz were false or misleading because they represented that a user either would not be enrolled in, or would be removed from, Buzz, when in fact a user was enrolled and not removed from the service consistent with these representations.

The FTC also alleged that Google failed to disclose how a user’s information would be shared.  These allegations also amounted to a substantive violation of the US-EU Safe Harbor Framework, according to the FTC—particularly, the Notice and Choice and limited purpose principles.

These practices also violated Google’s own privacy policy in effect at the time Google Buzz was launched, according to the FTC.  In pertinent part, the policy stated that “Gmail stores, processes and maintains your messages, contact lists and other data related to your account in order to provide the service to you” and “[w]hen you sign up for a particular service that requires registration, we ask you to provide personal information. If we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use.” (Emphasis added.)

In settling the FTC’s charges, Google did not admit the truth of any of the FTC’s substantive allegations.

This settlement demonstrates the importance of having a comprehensive privacy program in place that ensures that privacy protections are incorporated into web applications from the ground up.  The settlement’s requirement that Google enact a comprehensive privacy program demonstrates that the FTC is serious about privacy and foreshadows potential future settlement terms.  The settlement also reaffirms the importance of compliance with the US-EU Safe Harbor framework for companies that have opted into this program.

HHS news release, part of the penalty stems from Cignet’s denying 41 patients their right to access their medical records when requested between September 2008 and October 2009. Under HIPAA, a covered entity must provide access to a patient who requests such access to his or her medical record within 30 days of the request, subject to various exceptions and limited rights to extend such time period. (Numerous state laws include similar obligations that health care providers provide a patient with access to his or her own records, often within shorter time frames than is required by HIPAA.) Thirty-eight separate complaints of such denial of access had been filed with OCR, pursuant to which OCR began its investigation of Cignet. HHS has indicated that $1.3 million of the $4.3 million penalty is attributable to this denial of access to a patient’s records.  

Notably, out of the over 50,000 complaints of alleged HIPAA Privacy Rule violations that OCR has resolved, the denial of a patient’s access to his or her own records has been the third most cited reason for such a complaint every year since 2003, when compliance with the Privacy Rule was first legally required. But every other such complaint of denial of access was informally resolved with OCR. According to various news reports, Cignet never attempted to informally resolve the complaints with OCR.

In Cignet’s case, $3 million of the penalty is attributable to OCR finding that Cignet repeatedly failed to respond to various requests from OCR for more than a year (March 17, 2009 to April 4, 2010), resulting in per-day penalties, up to the maximum permissible penalties per year pursuant to applicable enforcement rules. Under HIPAA, covered entities are required to cooperate with HHS investigations. Even after Cignet finally produced the applicable patient records to HHS (in response to a federal court order), Cignet’s cooperation was limited in that it produced records relating to thousands of patients in addition to the 41 at issue. In various communications from OCR during the course of the investigation and the initial proposal of penalties, Cignet was notified of its rights to offer defenses and mitigating factors, and subsequently, of its rights of appeal. Cignet never exercised any of its rights.

The lesson to be learned from Cignet is that if you violate the HIPAA Privacy Rule, be prepared to pay, but if you fail to cooperate with OCR investigations into such violations, be prepared to pay even more (potentially 200% more). The question remains as to whether or not the extent of this fine is a true example of a new approach to enforcement of HIPAA, or whether Cignet’s ignoring official inquiries, failing to pursue informal resolution and not exercising its rights under HIPAA warranted unusual measures.

The FTC acknowledged that many entities, particularly small businesses and other companies with a low risk of identity theft, remain uncertain about whether they are covered under the Rule, and, if so, what steps they must take to comply. As part of its education campaign, the FTC stated that it plans to create a link on its Red Flags Rule website to provide additional guidance regarding the Rule to small and low-risk entities.  To date, the FTC has provided, among other things, a how-to guide for businesses, FAQs, and an online do-it-yourself Identity Theft Prevention Program for low-risk entities. 

The delay underscores the difficulty the Commission staff has had in anticipating and explaining the precise scope of the Rule – namely what entities are covered the Rule. As a practical matter, the Rules, and the FTC’s interpretation of them, have cast a net so wide so as to ensnare businesses that have not encountered identity theft in their operations and that are not normally subject to the Commission’s jurisdiction.  Indeed, as we have discussed before on this blog, there has been confusion among companies regarding the scope of the Rule. And despite previous delays and additional FTC guidance, many businesses, as well as entire industries, have still been caught off-guard by the Rule.  Nevertheless, the FTC believes that this extension and the new guidance the Commission will provide “should enable businesses to gain a better understanding of the Rule and any obligations that they may have under it.”