How The FTC Identifies, Targets & Tracks Companies Learn How to Keep Off Their List

Transcription

1 How The FTC Identifies, Targets & Tracks Companies Learn How to Keep Off Their List David Zetoony, Partner Bryan Cave LLP Leader Global Data Privacy and Security Team Scott J. Stein Online Trust Alliance VP Public Policy

2 About Us The Online Trust Alliance (OTA) is a 501c3 charitable non-profit with the mission to enhance online trust and empower users, while promoting innovation. Goal is to help educate businesses, policy makers and stakeholders while developing and advancing best practices and tools to enhance the protection of users' security, privacy and identity. Supports collaborative public-private partnerships, benchmark reporting, self-regulation and data stewardship. 2

3 AGENDA 1. The Who, What, Where, Why of the FTC 2. How the FTC Identifies Enforcement Targets 3. Data Analytics and Company Tracking 3

4 1. The Who, What, Where, Why of the FTC The Who & What: Established in 1914 Independent Federal Agency 5 person Commission (2 from minority party, 3 from majority) 1,164 full time employees (654 attorneys) ~$300 million budget The Where: Headquartered in DC Seven regional offices around US 4

5 1. The Who, What, Where, Why of the FTC. The Why: Enforces more than 70 laws* including: Federal Trade Commission Act, Consumer Leasing Act CAN-SPAM Act Credit CARD Act Do-Not-Call Registry Legislation Fair Credit Reporting Act Fair and Accurate Credit Transactions Act Fur Products Labeling Act Gramm-Leach-Bliley Act Identity Theft Act Equal Credit Opportunity Act Data Privacy The FTC s Consumer Protection Mission: Marketing Data Security Advertising * See for a complete list. 5

6 2. How the FTC Identifies Enforcement Targets (A) Independent Monitoring of Companies (B) Competitor / Industry / Interest Group Petitions (C) Media Attention (D) Data Mining 6

7 2. How the FTC Identifies Enforcement Targets (A) Independent Monitoring of Companies Formal programs are set up to monitor FTC Mobile / Internet Lab for reviewing websites Industry / Issue Sweeps. E.g., Children s Apps: Staff searched for Kids in App Store Collected Promotion page for first 960 apps Conducted closer review of 480 (of the 960) chosen at random Don t overlook informal monitoring and remember that FTC staff members, Commissioners, and relatives of staff members are consumers too. 7

8 2. How the FTC Identifies Enforcement Targets (A) Independent Monitoring of Companies (Cont.) FTC v. DERMAdoctor, Case No CV-W-BP (W.D. Mo. 2014) 8 * Bryan Cave LLP represented DERMAdoctor in the referenced action

9 2. How the FTC Identifies Enforcement Targets (B). Competitor / Industry / Interest Group Petitions 9

10 2. How the FTC Identifies Enforcement Targets (B). Competitor / Industry / Interest Group Petitions (Cont.) November 22, 2011: Humane Society Petition to FTC in re DrJays.com, Eminent, Gilt Groupe, Inc., Neiman Marcus, etc. March 19, 2013: Complaint, In the Matter of DrJays.com, Inc. (Docket No. C-4408) Complaint, In the Matter of Eminent, Inc. (Docket No. C-4409) Complaint, In the Matter of the Neiman Marcus Group (Docket No. C-4407) 10 * Bryan Cave LLP represented the Neiman Marcus Group

11 2. How the FTC Identifies Enforcement Targets (C) Media Attention: Example In the Matter of CVS, Docket No. C-4259 Sept. 2007: FTC initiates non-public inquiry of CVS and issues an access letter to CVS. May 20, 2008: FTC issues a Civil Investigative Demand to CVS Feb. 18, 2009: Complaint 11

12 2. How the FTC Identifies Enforcement Targets (C) Media Attention (cont.): Exp. In the Matter of Ceridian Corp., Docket No. C-4325 Feb. 3, 2010 May 3, 2011 FTC Complaint 12 * Bryan Cave LLP represented the Ceridian Corporation

13 2. How the FTC Identifies Enforcement Targets (D). Data Mining The FTC maintains databases of consumer complaints collectively referred to as Consumer Sentinel : Started in 1997 Contains complaints submitted to FTC by phone or online. Contains complaints submitted to partner agencies including: 20 state attorneys general 8+ federal agencies 100+ Better Business Bureaus Over 25 million total complaints* 13 * Information from Consumer Sentinel Network Data Book for Jan. Dec. 2014

14 3. Data Analytics and Company Tracking The majority of FTC actions target a company identified in Consumer Sentinel 14 *

15 3. Data Analytics and Company Tracking 2(D). Data Mining (cont.) How the FTC uses Consumer Sentinel: Each month the FTC s Division of Planning and Information ( DPI ) creates a Top Violators Report that ranks the fifty companies with the greatest volume of consumer complaints that month 15 * O f f

16 3. Data Analytics and Company Tracking NOTES: Top Violators February 2012 Top Companies Receiving Complaint in Consumer Sentinel Network November 1 to November 30, 2014 Top Violator s Report From Nov Rank Rank # of Complaints Entered During November October Company Product/Service Code(s) Reporting Period 1 1 IRS Imposter Impostor: Government 8, Publishers Clearing House Imposter Impostor: Business 3, Microsoft Corporation Computers: Equipment \ Software; Impostor: Business 1, AT&T Mobile: Other 1, Verizon Wireless Mobile: Other 1, Bank of America Lending: Mortgage; Bank: National \ Commercial Wells Fargo Bank Lending: Mortgage Comcast Cable Television: Satellite & Cable DirecTV, Inc. Television: Satellite & Cable Experian Credit Bureaus Us Treasury Impostor: Government Equifax Credit Bureaus T Mobile Mobile: Other TransUnion Credit Bureaus Federal Government Impostor: Government Credit One Bank Credit Cards Time Warner Cable Television: Satellite & Cable Ocwen Loan Servicing, LLC Lending: Mortgage Capital One Bank Credit Cards Medicare Impostor: Government Federal Grant Department Impostor: Government Dish Network LLC Television: Satellite & Cable Credit Card Services Telemarketing: Other Nationstar Mortgage Lending: Mortgage FTC Imposter Impostor: Government JP Morgan Chase Lending: Mortgage / Bank: National\Commercial Chase Lending: Mortgage Wal-Mart Impostor: Business Green Tree Servicing, Llc Lending: Mortgage Charter Communications Inc Television: Satellite & Cable Cash Net USA Third Party Debt Collection / Lending: Payday Loans Citibank Credit Cards ebay Shop-at-Home \ Catalog Sales Cash Advance Advanced Feel Loans, Credit Arrangers Synchrony Bank Credit Cards Enhanced Recovery Corporation Information Furnishers Government Grants Impostor: Government Amazon.com Shop-at-Home \ Catalog Sales Midland Credit Management Third Party Debt Collection Craigslist Shop-at-Home \ Catalog Sales Sallie Mae Lending: Mortgae Verizon Third Party Debt Collction Wells Fargo Home Mortgage Lending: Mortgage FBI Impostor: Government Mega Millions Prizes \ Sweepstakes Cardholder Services Telemarketing: Other Dell Computer Corporation Impostor: Government US Government Grants Impostor: Government American Express Credit Cards US Bank Bank: National / Commercial 122

17 3. Data Analytics and Company Tracking (D). Data Mining (cont.) How the FTC uses Consumer Sentinel: Each month the FTC s Division of Planning and Information ( DPI ) also creates a Surge Report that identifies companies with the greatest increase, or surge, in complaint volume. 17 * O f f

18 3. Data Analytics and Company Tracking Surge Report from October

19 3. Data Analytics and Company Tracking Although it is impossible to know how often the FTC takes actions based upon the top violators / surge reports (among other things investigations that do not lead to enforcement actions are typically not made public), there does appear to be a high correlation between the report and FTC action. For example, the FTC identified the following companies as the top violators between 1/1/2009 and 12/12/2014: Rank Company FTC Action 1 Publisher s Clearing House Imposters Consumer Information Press Release prize-scams) 2 Bank of America OUTSIDE FTC JURISDICTION 3 T Mobile 12/19/2014 FTC Law Enforcement Action resulting in $90 million consumer redress. 4 DirectTV, Inc FTC Law Enforcement Action resulting in $2.31 million civil penalty. 5 IRS Imposter fraud Consumer Information Press Release 2015: 6 Verizon Wireless 11/12/2014 data security investigation (closed). 19

20 3. Data Analytics and Company Tracking Other ways in which the FTC could use information when analyzing specific companies: Complaints that are received directly by the FTC are coded to reflect a specific area of law that has been allegedly violated. When analyzed the statute codes can give the FTC a profile of potential compliance problems 20

21 Sep Nov Jan Mar May Jul Sep Nov Jan Mar May Jul Sep Nov Jan Mar May Jul Sep Nov Jan Mar May Jul Sep Nov Jan Apr Jun Aug Oct Dec Feb Apr Jul 3. Data Analytics and Company Tracking Other ways in which the FTC could use information when analyzing specific companies: When complaint volume and date are analyzed they can also provide insight concerning trends and patterns within a company. The following shows the complaint volume of MySpace before the FTC issued its complaint (In the Matter of MySpace LLC, Docket No. C-4369 (Sept. 11, 2012)) Case Study 2013 Enforcement Target Date of Submission CIS-Related Complaints (n=534)

22 3. Data Analytics and Company Tracking Other ways in which the FTC could use information when analyzing specific companies: 22

23 3. Data Analytics and Company Tracking Other ways in which the FTC could use information when analyzing specific companies: If viewed geographically, complaint volume may disclose distribution or regional marketing related issues. When lined up against competitors as a benchmark it may disclose practices that appear out of sync within an industry. 23

24 3. Data Analytics and Company Tracking Practical take-aways for in-house counsel: Self-Monitoring. Do you track the quantity of complaints that appear in the FTC s database about your company? If so, how often? Do the complaints filed against your company suggest a legal compliance issue? If so, were a FTC investigation to be initiated can you explain the complaint volume, patterns, and trends? 24

25 3. Data Analytics and Company Tracking Practical take-aways for in-house counsel: Evaluating your Risk Level Is your complaint volume high enough to put you on the Top Violator s Report? Is the variation in complaint volume large enough to place you on the Surge Report? 25

26 3. Data Analytics and Company Tracking Practical take-aways for in-house counsel: Benchmarking Do competitors in your industry have a significantly greater or smaller proportion of complaints? 26

27 3. Data Analytics and Company Tracking Practical take-aways for in-house counsel: Other Companies Are there other companies for which it would be important to know their complaint volume (e.g., clients, service providers, business partners)? 27

28 David A. Zetoony Bryan Cave LLP Phone: Fax: David Zetoony is the leader of the firm's global data privacy and security practice. He has extensive experience advising clients on how to comply with state and federal privacy, security, and advertising laws, representing clients before the Federal Trade Commission, and defending national class actions. He has assisted hundreds of companies in responding to data security incidents and breaches, and has represented human resource management companies, financial institutions, facial recognition companies, and consumer tracking companies before the Federal Trade Commission on issues involving data security and data privacy. 28