The Federal Trade Commission (FTC) finalized settlements with five companies for claiming EU-U.S. Privacy Shield or Swiss-U.S. Privacy Shield certification. Those companies included organizations focused on providing workforce solutions, collaboration platforms, artificial intelligence analytics, clinical trial management, and other IT providers.
The actions
In each case, the FTC alleged that each company wrongfully claimed current certification under either the EU-U.S. Privacy Shield or Swiss-U.S. Privacy Shield. Both frameworks establish a mechanism for companies to legally transfer personal consumer data between countries while complying with data protection requirements.
While four of the companies falsely claimed certification under either the EU-U.S. Privacy Shield or Swiss-U.S. Privacy Shield, one had previously been a participant in the Privacy Shield, but allowed its certification to lapse while continuing to claim participation.
Under the terms of the settlement with the FTC, the companies are prohibited from misrepresenting their participation in any privacy of data security program sponsored by the government or any another self-regulatory or standard-setting organization. Further, one of the violators must continue to apply the Privacy Shield protections to personal data about EU data subjects, or delete or return that personal data.
Recommended action
Without a doubt, US authorities remain vigilant against companies falsely claiming Privacy Shield certification. For companies currently Privacy Shield certified, be sure to stay current, re-certify on a timely basis, and ensure your practices comply with the Privacy Shield Framework requirements.
Further information
- DCR Workforce, Inc. – Complaint
- DCR Workforce, Inc. – Decision and Order
- Thru, Inc. – Complaint
- Thru, Inc. – Decision and Order
- LotaData, Inc. – Complaint
- LotaData, Inc. – Decision and Order
- EmpiriStat, Inc – Complaint
- EmpiriStat, Inc. – Decision and Order
- 214 Technologies, Inc. – Complaint
- 214 Technologies, Inc. – Decision and Order
If you have any questions about this enforcement action or any other privacy law, please do not hesitate to reach out to partners Brian Hengesbaugh and Harry Valetk.
