In a May 2023 complaint, the FTC alleges that data broker Outlogic (formerly known as ) was engaged in activities that violated the law. , prohibits “unfair or deceptive acts or practices in or affecting commerce.” On January 9, 2023, the FTC prohibited Outlogic from sharing or selling “sensitive location data,” including but not limited to data related to the location of medical facilities, religious organizations, correctional facilities, and parole facilities. A draft order has been issued. . In a press release issued with the proposed order, FTC Chair Lina M. Khan said:[t]FTC actions […] The proposed order marks the first time the FTC has reached a settlement with a data broker over the collection and sale of sensitive information, and the CFPB recently released proposals to address data brokers under the Fair Credit Reporting Act. What was done was followed by what was done. Considered in this context, it is clear that the FTC’s focus on issues related to the use of consumer data is likely to increase regulatory oversight of data brokers.
FTC complaint
The FTC says in its complaint that the location data Outlogic collects in conjunction with personally identifiable information may be used at medical facilities, places of worship, locations used to infer LGBTQ+ identity, domestic violence shelters, and homeless shelters. facility. Additionally, the FTC alleges that Outlogic failed to respect consumers’ privacy choices, failed to inform consumers of the purposes for which their location data was used, provided application publishers with false disclosures to consumers, and allowed third parties to properly He claimed that he had not verified that he had notified and obtained his consent. Consumers and Target Consumers Based on Characteristics Related to Confidential Health Information. The complaint determined that the sale of sensitive location data and these other activities violate the FTC Act’s prohibitions against unfair and deceptive acts and practices.
FTC Proposed Order
In addition to prohibiting the use or sale of sensitive location data, the proposed order would require Outlogic to create and maintain a “sensitive location data program” and develop a comprehensive list of “sensitive locations.” I am. In addition, the proposed order outlines the following additional requirements that Outlogic must comply with:
- Delete or destroy previously collected location data and derivative products unless Outlogic obtains consumer consent or verifies that the data has been anonymized or declassified.
- Develop a supplier evaluation program to certify that vendors providing location data have consumers’ informed consent to collect, use, and sell the data (if the supplier is unable to verify such consent) , Outlogic must immediately cease using data from these suppliers);
- Steps to ensure that users of Outlogic’s location data do not connect their location data to venues serving the LGBTQ+ community or locations of public protest, and to prevent their location data from being used to identify specific individuals. Implement.
- Provide an easy way for consumers to withdraw consent and request deletion of collected location data.
- We provide transparent options for consumers to see which third parties have received their personal data and to enable them to delete their data from these third parties’ databases.and
- Develop a comprehensive privacy program and establish specific data retention policies to protect consumer data privacy.
Ultimately, the commission voted 3-0 to accept the proposed consent agreement. The Consent Agreement Description will be published in the Federal Register on January 18, 2024 and will be subject to a 30-day public comment period. The committee will then decide whether to make the proposed consent order final.
what does this mean to you
This Consent Order, along with other statements issued by Commissioner Lina M. Khan, Commissioners Rebecca Kelly Slaughter and Commissioner Alvaro Bedoya, demonstrates the FTC’s continued commitment to protecting consumer privacy. It is. In a separate statement, the FTC rejected the premise that by issuing the proposed consent order, data brokers could provide vague disclosures to consumers regarding the licensing, sale, or use of sensitive location data. It makes that clear. Therefore, it can be assumed that the FTC will likely increase its oversight of the use of sensitive consumer location data and the disclosures made to consumers regarding that use. Data brokers and users of consumer location data must comply with agreements, disclosures, and policies related to consumer location data to ensure consistency with FTC expectations and avoid unfair or deceptive acts and practices. Procedures, and actual practices should be reviewed.
[View source.]
