On July 24, the United States Federal Trade Commission (“FTC”) announced a settlement agreement with Facebook concerning Facebook\u2019s alleged violations of a prior consent order it had entered into with the FTC. The settlement will require court approval, but its proposed terms are notable for many reasons, including the issuance of the largest FTC penalty ever for privacy violations: $5 billion. For any company that handles personal data, the settlement\u2019s oversight provisions provide some insight into the FTC\u2019s priorities and can inform privacy practices and governance.<\/p>\n
Both the original consent order and the immediate settlement arose from Facebook\u2019s disclosures of users\u2019 personal data and alleged shortfalls in Facebook\u2019s privacy notices.\u00a0 The FTC alleged that Facebook generally failed to supervise developers of apps on its platform and did not adequately vet them before giving them access to large amounts of users\u2019 data.\u00a0 In addition, the FTC alleged that Facebook\u2019s disclosures concerning its facial recognition program were deceptive because they suggested that users needed to opt-in to the feature, even though it was turned on for all users by default.\u00a0 The FTC also alleged that although Facebook introduced privacy-related features such as \u201cPrivacy Shortcuts\u201d and \u201cPrivacy Checkup,\u201d it failed to disclose that even under the most restrictive sharing settings, Facebook could still share users\u2019 information with the apps of the user\u2019s Facebook friends unless the user changed separate settings in an entirely different interface.<\/p>\n
In a statement, the FTC Commissioners who approved the settlement said that \u201cthe relief we have secured today is substantially greater than what we realistically might have obtained by litigating, likely for years, in court.\u201d\u00a0 Indeed, the settlement agreement imposes a number of controls over Facebook\u2019s privacy practices and by its terms, these measures will be in place for twenty years. Among these terms are a requirement that Facebook conduct a privacy review of every new or modified product, service, or practice before it is implemented, and document its decisions about user privacy.\u00a0 It also must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users.<\/p>\n
The settlement also includes a number of governance measures, including the establishment of an independent privacy committee of Facebook\u2019s board of directors, to be appointed by an independent nominating committee and removable only by a supermajority of the board.\u00a0 Facebook will also be required to designate privacy compliance officers who will be subject to the approval of the new board privacy committee, and can be removed only by that committee, not by Facebook executives or employees.<\/p>\n
The settlement also strengthens oversight by an independent third-party assessor of Facebook\u2019s privacy practices and requires the assessor to make quarterly reports to the privacy committee of the board.\u00a0 Finally, the settlement requires that Facebook CEO Mark Zuckerberg and Facebook compliance personnel submit regular certifications that the company is complying with the order, which creates potential liability at the individual level for any violations.<\/p>\n
To be sure, the imposition of these measures is a reflection of Facebook\u2019s particular practices and the fact that it was already subject to an FTC consent decree.\u00a0 And virtually no company would voluntarily adopt measures as stringent as the settlement establishes.\u00a0 But for companies not in Facebook\u2019s shoes, these terms still serve as examples of measures that the FTC will view favorably in the event of privacy investigations or enforcement proceedings.\u00a0 If a company eventually suffers a breach or uncovers an inadvertent disclosure or misuse of users\u2019 personal data, a track record of proactive privacy protection will serve it well in any investigation into that incident.<\/p>\n
Accordingly, it may benefit companies with no track record of privacy violations to take steps that echo, to some extent, the terms of the Facebook settlement. For instance, they can consider creating an independent line of reporting for privacy personnel, ensuring that a single executive cannot unilaterally dictate privacy practices.\u00a0 They can also establish a structure of privacy reviews for each new and modified form of personal data processing, and they can document the decisions they reach concerning user privacy at these junctures. And they can provide separate and conspicuous notices to users concerning the processing of particularly sensitive categories of personal data such as location information, facial recognition data, or biometric information.\u00a0 These steps are not required under current U.S. federal law (although they do echo some provisions of the European Union General Data Protection Regulation, such as the requirement to appoint a data protection officer and to conduct data privacy impact assessments).\u00a0 Nevertheless, proactively adopting them can position a company well if it needs to defend its practices in light of a breach or unauthorized disclosure of personal data.<\/p>\n
Facebook\u2019s agreement to the terms of this settlement with the FTC was an effect of its own practices and prior enforcement proceedings by the FTC.\u00a0 But companies that have never been on the FTC\u2019s radar can still use the settlement as a guide to help develop their privacy programs and position themselves well to address any future incidents.<\/p>\n
Patrick M. Hromisin (LAW \u201909) is an associate at Saul Ewing Arnstein & Lehr LLP, in Philadelphia. Patrick assists clients with white collar, compliance, and complex commercial litigation matters, including representations through trial, arbitration, mediation and negotiations with prosecutors and regulators. Institutions of higher education, insurance, health care and energy companies, as well as individual clients, are among the broad array of clients he has represented.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Temple Law Alumni Patrick Hromisin discusses the record-breaking Facebook-FTC settlement and what this settlement means for other companies with data privacy concerns.<\/p>\n","protected":false},"author":5,"featured_media":2070,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,52,38],"tags":[558,1398,682,185,294,211,110,1399,746,1400,1401],"coauthors":[2,1026],"class_list":["post-2069","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alumni-authored","category-compliance","category-regulated-industries","tag-consent","tag-consent-order","tag-disclosure","tag-facebook","tag-federal-trade-commission","tag-ftc","tag-litigation","tag-personal-data","tag-privacy","tag-privacy-notices","tag-settlment","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-33"],"yoast_head":"\n