In its ongoing efforts to safeguard consumers’ private information, the FTC has charged two businesses [complaint 1 | complaint 2] with illegally exposing the sensitive personal information of thousands of consumers by allowing peer to peer file-sharing software to be installed on their corporate computer systems. Settlements with the debt collection business and auto dealer will bar misrepresentations about their privacy, security, confidentiality, and integrity of any personal information. Both companies must establish and maintain comprehensive information security programs.
P2P technology can be used in many ways, such as to play games, make online telephone calls, and, through P2P file-sharing software, share music, video, and documents. But the FTC has found that P2P software can pose significant data security risks. A 2010 FTC examination of P2P-related breaches uncovered a wide range of sensitive consumer data available on P2P networks, including health-related information, financial records, and driver's license and social security numbers. Files shared to a P2P network are available for viewing or downloading by any computer user with access to the network. Generally, a file that has been shared cannot be permanently removed from the P2P network. In addition, files can be shared among computers long after they have been deleted from the original source computer.
The FTC alleged that EPN, Inc., a debt collector based in Provo, Utah whose clients have included healthcare providers, commercial credit organizations and retailers, failed to implement reasonable security measures for personal information on its computers and networks. As a result of these failures, EPN's chief operating officer was able to install P2P file-sharing software on the EPN computer system, causing sensitive information including Social Security numbers, health insurance numbers and medical diagnosis codes of 3,800 hospital patients to be made available to any computer connected to the P2P network.
In a separate case, the FTC charged that auto dealer Franklin's Budget Car Sales, Inc., also known as Franklin Toyota/Scion, of Statesboro, Georgia, compromised consumers' personal information by allowing P2P software to be installed on its network, which resulted in sensitive financial information being uploaded to a P2P network.
The FTC alleges that Franklin failed to implement reasonable security measures to protect consumers' personal information, and, as a result, information for 95,000 consumers was made available on the P2P network. The information included names, addresses, Social Security Numbers, dates of birth, and driver's license numbers.
disclosure of information. It also allegedly failed to prevent, detect and investigate unauthorized access to personal information on its networks, failed to adequately train employees and failed to employ reasonable measures to respond to unauthorized access to personal information. Because Franklin is a financial institution, the alleged security failures violated the Gramm-Leach-Bliley (GLB) Safeguards Rule as well as Section 5 of the FTC Act. Franklin also allegedly failed to provide annual privacy notices and provide a mechanism by which consumers could opt out of information sharing with third parties, in violation of the GLB Privacy Rule. This is the FTC first action against an auto dealer charging GLB violations.
The Commission vote to accept the consent agreement packages containing the proposed consent orders for public comment was 5-0. The FTC will publish a description of the consent agreement packages in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through July 9, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit written comments electronically or in paper form by following the instructions in the "Invitation To Comment" part of the "Supplementary Information" section.
NOTE: The Commission issues an administrative complaint when it has "reason to believe" that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the respondent has actually violated the law. A consent order is for settlement purposes only and does not constitute an admission by the respondent that the law has been violated. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.