Back in December 2010, a computer belonging to Cord Blood Registry (CBR) and a backup tape with customers’ information was stolen from an employee’s unattended vehicle. The breach was disclosed in February 2011, and I covered it on this blog, here.
Today, the FTC announced that it had settled charges against CBR over the breach. Again, a firm’s claims in its privacy policy and TOS were not consistent with their actions:
In its privacy policy, Cbr claimed that “[w]henever CBR handles personal information, regardless of where this occurs, CBR takes steps to ensure that your information is treated securely and in accordance with the relevant Terms of Service and this Privacy Policy. . . . ”
However, according to the FTC, Cbr failed to use reasonable and appropriate procedures for handling customers’ personal information, making its privacy policy claim deceptive under the FTC Act. According to the complaint, Cbr did not have reasonable policies and procedures to protect the security of information it collected and maintained. In addition, Cbr allegedly created unnecessary risks to personal information by, among other things, transporting backup tapes, a thumb drive, and other portable data storage devices containing personal information in a way that made the information vulnerable to theft. According to the FTC, Cbr also failed to take sufficient measures to prevent, detect, and investigate unauthorized access to computer networks.
The FTC charged that Cbr’s failures to provide reasonable and appropriate security for consumers’ personal information contributed to a December 2010 security breach during which unencrypted backup tapes containing consumers’ personal information, a Cbr laptop, a Cbr external hard drive, and a Cbr USB drive were stolen from a Cbr’s employee’s personal vehicle in San Francisco, California. According to the complaint, the unencrypted backup tapes included, in some cases, the names, gender, Social Security numbers, dates and times of birth, drivers’ license numbers, credit and debit card numbers, card expiration dates, checking account numbers, addresses, email addresses, telephone number and adoption type (e.g., open, closed, or surrogate) of approximately 298,000 Cbr customers.
The consent decree places CBR under monitoring and requires them to strengthen their information security program. Because this is CBR’s first action by the FTC, there are no monetary penalties involved.
You mean the web developer who copied the text when CBF management crossed their eyes over a privacy policy didn’t take the fall? Imagine that!
Businesses are going to have actually take those binding agreements seriously. I don’t know how many times in my webdev days I was told just to ‘copy something’ when I asked about a privacy policy or terms and conditions. Its a common joke that no one reads these things ~ but the site owners really should be an exception to this rule.