Inside Privacy - Updates on Developments in Global Privacy & Data Security

On March 27, 2013, the Federal Reserve released a report on consumers’ use of mobile banking and mobile payments.  The report follows a similar report issued by the Federal Reserve last year.  The report found that use of mobile banking has increased significantly in the past year while use of mobile payments has increased as well. 

As of November 2012, 28 percent of all mobile phone users (compared to 21 percent in December 2011) and 48 percent of smartphone users (compared to 42 percent in December 2011) had used mobile banking in the past 12 months.  The recent report found that 15 percent of all smartphone users have made a payment from their phone in the past 12 months, compared to 12 percent of users from the prior report.  In addition, the use of mobile phones to deposit checks has doubled in the past year, rising from approximately 10 percent to 21 percent.      

The most common uses of mobile banking are to check account balances or recent transactions (87 percent of users) and to transfer money between accounts (53 percent of users).  The most common use of mobile payments is to make online bill payments (42 percent of users).  Six percent of all smartphone users have made a point-of-sale payment using their phone in the past 12 months, which represents a sizable increase from the one percent of users in December 2011. 

Continue Reading

Last Friday, the Federal Trade Commission released a report, Paper, Plastic…or Mobile?, on the use of mobile payments.  The report follows a workshop hosted by the FTC in April 2012 that explored innovative mobile payment products and services, the potential benefits offered by mobile payments, and the concerns they raise.  For purposes of the report, mobile payments generally include four types of payment processes:  (1) near field communication (NFC) technologies, (2) mobile applications, (3) online checkout wallets, and (4) mobile carrier billing (charging of payments directly to a mobile phone bill).

The report focuses on the primary areas where the increasing use of mobile payments raises concerns, including dispute resolution, data security, and privacy.  The report also highlights special concerns regarding mobile carrier billing and international mobile payments.

Continue Reading

On February 7, 2013, the Payment Card Industry (PCI) council released a supplement to the payment card industry data security standards (PCI-DSS) on the use of cloud technologies and considerations for maintaining PCI DSS controls in cloud environments.  The supplement is intended for merchants, service providers, assessors, and other entities in evaluating the use of cloud computing in the context of PCI DSS.

The supplement considers “cloud computing” to mean a model for enabling on-demand network access to a shared pool of computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or cloud provider interaction.  Both cloud computing users and cloud service providers (CSPs) have compliance responsibilities under the supplement that depend on a number of variables, including (1) the purpose for which the client is using the cloud service, (2) the scope of PCI DSS requirements that the client is outsourcing to the CSP, (3) the services and system components that the CSP has validated within its own operations, (4) the service option that the client has selected to engage the CSP (Infrastructure as a Service, Platform as a Service, or Security as a Service), and (5) the scope of any additional services the CSP is providing to proactively manage the client’s compliance. 

The supplement provides cloud-related considerations for each of the PCI-DSS standards and allocates responsibility for each consideration between the user and CSP depending on the specific service option.  There are a number of compliance challenges associated with the use of cloud computing, such as the lack of visibility into CSPs’ security infrastructure and oversight of cardholder data storage, and the supplement provides guidance for addressing those challenges within the context of the user-CSP relationship.

In its most recent issue of the Supervisory Insights newsletter, the Federal Deposit Insurance Corporation (FDIC) describes mobile payment technologies, the risks they pose to depository institutions, and the regulatory framework applicable to such technologies.  The FDIC notes the widespread use of smartphones as a payment technology and the increasing availability of point-of-sale terminals equipped to process payments using near-field communications.  Both of these factors require institutions to understand and adopt controls to mitigate risk from mobile payment technologies.

Continue Reading

On Friday, November 30, the Federal Trade Commission (FTC) issued an Interim Final Rule to amend its Red Flags Rule, which requires certain financial institutions and creditors to establish programs to detect, prevent and mitigate identity theft in connection with consumer accounts.  The Interim Final Rule narrows the definition of “creditor” in response to legislation passed by Congress in December 2010 (as covered in previous blog posts), excluding from the definition most doctors, lawyers, and other professionals who do not receive full payment at the time their service is furnished.  The rule is effective on February 11, 2013, and the FTC is seeking comments on the rule until that time.     

The Interim Final Rule narrows the circumstances under which creditors are covered by the Rule in an attempt to be consistent with Congress’s legislation. The amended Rule now provides that a creditor is covered only if, in the ordinary course of business, it regularly: (1) obtains or uses consumer reports in connection with a credit transaction; (2) furnishes information to consumer reporting agencies in connection with a credit transaction; or (3) advances funds to or on behalf of a person (except for a creditor who advances funds on behalf of the person for expenses incidental to a service provided by the creditor to that person).   

Under the Rule, covered entities’ Red Flag programs must: (1) include reasonable policies and procedures to identify signs – or “red flags” – of identity theft in the day-to-day operations of the business; (2) be designed to detect the red flags of identity theft known to the business; (3) set out the actions the business will take upon detecting red flags; and (4) re-evaluate its program periodically to reflect new risks.

Last week, the Consumer Financial Protection Bureau (CFPB) announced that it had established a process for assisting consumers with credit reporting complaints.  The CFPB previously had implemented similar processes for complaints relating to credit cards, mortgages, bank accounts and services, private student loans, vehicle, and other consumer loans.  The complaint process is intended to complement the CFPB’s recent initiatives to supervise the consumer reporting industry, including the CFPB’s final rule establishing its authority to supervise consumer reporting agencies and examination manual for consumer reporting agencies.

The announcement makes clear that consumers should not file complaints with the CFPB in lieu of or before disputing inaccurate credit reporting information with the applicable consumer reporting agency.  Disputing inaccurate information with the applicable reporting agency preserves certain rights under the Fair Credit Reporting Act and serves as the most immediate way of resolving inaccurate information.  However, if the consumer is dissatisfied with the reporting agency’s resolution of the dispute, the announcement encourages the consumer to contact the CFPB.  The Federal Trade Commission has a similar process for assisting consumers with credit reporting complaints.

Last week, the Consumer Financial Protection Bureau (CFPB) released a study comparing credit scores sold to creditors and those sold to consumers.  The study found that approximately 1 in 5 consumers would, upon purchasing their credit score from a consumer reporting agency, receive a different credit score than the score provided to creditors for use in determining eligibility for products or services.  The study was required by section 1078 of the Dodd-Frank Wall Street Reform and Consumer Protection Act.

The study also found that differences in the scores provided to consumers versus creditors could harm consumers and that most consumers would never find out that the credit score given to them may not be the score in fact used by creditors.  To address these findings, the CFPB recommended that consumers shop around for credit and carefully review their credit reports. 

The CFPB commenced supervision of consumer reporting agencies on September 30, 2012.  The differences highlighted in the study will be one of the CFPB’s focal points during supervisory examinations.

An employment background screening company will pay a $2.6 million civil penalty to settle Federal Trade Commission charges under the Fair Credit Reporting Act.   The FTC alleged that HireRight Solutions, Inc., which compiles background reports to assist employers in making hiring and other employment-related decisions, is a consumer reporting agency since its reports “bear on . . . consumers’ general reputation and personal characteristics; and are used as a factor in determining eligibility for employment.”  The FTC charged that, as a consumer reporting agency, HireRight had an obligation to follow reasonable procedures to assure the maximum possible accuracy of the information in its consumer reports -- an obligation that the FTC says HireRight violated.

In addition to a $2.6 million civil penalty, the consent decree enjoins HireRight from failing to follow reasonable procedures to:

• Ensure that its consumer reports reflect the current status of criminal records that have been expunged;
• Prevent the inclusion of multiple entries for a single criminal offense; and
• Prevent the inclusion of information about individuals other than the person about whom a consumer report pertains. 

The consent decree also enjoins HireRight from failing to provide consumers full access to records maintained about them or failing to investigate or respond promptly to consumer disputes about the accuracy of HireRights’ consumer reports.   

According to press reports, this is the second largest civil penalty that the FTC has obtained under the FCRA.  In 2006, ChoicePoint, Inc. agreed to pay $10 million to settle claims under the FCRA. 

On July 10, the Federal Financial Institutions Examination Council (FFIEC) issued risk management guidance for depository institutions’ use of cloud computing.  The guidance defines cloud computing generally as “a migration from owned resources to shared resources in which client users receive information technology services, on demand, from third-party service providers via the Internet ‘cloud.’”  The guidance also considers cloud computing to be a form of outsourcing subject to the risk management requirements set forth in the FFIEC Information Technology Examination Handbook for Outsourcing Technology Services.

Continue Reading

Yesterday, the Federal Trade Commission entered into a consent decree with Spokeo, Inc., for violations of the Fair Credit Reporting Act.  As reflected in the FTC staff blog post, the FTC’s action against Spokeo is the first FCRA case to address the sale of data collected from online sources, including social media, in the context of employee screening.  

Based on the FTC’s complaint, it appears that Spokeo assembled consumer information from online and offline sources, such as social networking sites and data brokers, to create consumer profiles for sale to third parties.  These consumer profiles typically included name, physical address, email address, phone number, hobbies, ethnicity, religion, and photographs.  Spokeo marketed these consumer profiles to human resources professionals, promoted them as a useful factor in deciding whether to interview a candidate, dedicated a portion of its website to recruiters, and offered special subscription plans to those recruiters.  In 2010, Spokeo amended the Terms of Service on its website to state that it is not a consumer reporting agency and that Spokeo could not be used for FCRA-covered purposes.  However, according to the complaint, Spokeo failed to take any action to ensure that third parties did not use its website and the information available on it for FCRA-covered purposes.

The FTC concluded in its complaint that Spokeo is a “consumer reporting agency” and that the consumer profiles sold by Spokeo are “consumer reports.”  The complaint alleged that Spokeo violated the FCRA by failing to have the requisite procedures in place to limit the furnishing of consumer reports only for permissible purposes and to ensure the accuracy of information in consumer profiles.  The complaint also alleged that Spokeo violated the FCRA because it failed to provide the standard “user” notice to third parties accessing consumer profiles, and because it furnished consumer profiles to third parties for whom Spokeo had no reason to believe had a permissible purpose.  The complaint also alleged that Spokeo violated Section 5 of the FTC Act by directing its employees to post comments endorsing Spokeo to news and technology websites under account names that were developed by the company to give the impression that they were independent, ordinary consumers.

To settle these charges, Spokeo agreed to enter into a consent order with the FTC, which requires Spokeo to pay a civil penalty equal to $800,000 and prohibits the company from violating the FCRA and Section 5 of the FTC Act.  If Spokeo subsequently violates the FCRA, FTC Act, or provisions in the consent order, the FTC will be able to fine Spokeo at levels substantially higher than what the FCRA alone permits.  The consent order also imposes rigorous reporting and recordkeeping requirements on Spokeo and requires various forms of ongoing monitoring by the FTC.

Spokeo’s founder, Harrison Tang, responded to the action in a blog post stating that the company never intended to operate as a consumer reporting agency and has since implemented changes to its website to align with the FCRA.  The FTC’s action against Spokeo is significant because it signifies the FTC’s intent to extend FCRA enforcement to companies that collect and sell consumer data that can be used in certain impermissible ways under the FCRA.