Sensitive personal information

Under the FTC's Rules of Practice, “sensitive personal information” shall include, but shall not be limited to, an individual's Social Security number, taxpayer identification number, financial account number, credit card or debit card number, driver's license number, state-issued identification number, passport number, date of birth (other than year), and any sensitive health information identifiable by individual, such as an individual's medical records.1 Source: 16 C.F.R. § 3.45(b) The CFPB's rules for its own adjudications define the term with the same list.2 Source: 12 C.F.R. § 1081.112(e)

The category exists because this is the information that lets someone act in another person's name or reach into their accounts. The FTC has said that such information, particularly Social Security numbers, which do not expire, can be used to facilitate identity theft, including existing and new account fraud.9 Source: In the Matter of Ceridian Corporation, File No. 1023160, Analysis of Proposed Consent Order to Aid Public Comment (FTC) Payment card details carry a similar risk, because they can be used to facilitate payment card fraud and other consumer harm.10 Source: In the Matter of Genica Corporation and Compgeeks.com, File No. 082-3113, Analysis of Proposed Consent Order to Aid Public Comment (FTC) Health information sits at the top of the range: the FTC describes medical information as among the most sensitive types of personal data, and says its disclosure can lead to embarrassment, stigma, and discrimination.11 Source: Brief of the Federal Trade Commission, LabMD, Inc. v. FTC (11th Cir.) The Commission has gone further for health data, concluding in the LabMD matter that the privacy harm from unauthorized disclosure of sensitive health or medical information is in and of itself a substantial injury under Section 5(n).12 Source: In re LabMD, Inc., Opinion of the Commission

The duties fall on whoever holds the data because the consumer cannot protect it once it has been handed over. In the FTC's account of the LabMD case, patients are powerless to protect their personal information once it is in the testing laboratory's hands and must rely on the company to keep it secure and confidential.13 Source: Brief of the Federal Trade Commission, LabMD, Inc. v. FTC (11th Cir.) A fixed expiration date also makes little sense for identifiers that never change. The FTC's complaint against Equifax alleged that, because information such as SSNs and dates of birth is immutable, identity thieves could wait years before using stolen information.14 Source: Equifax, Inc.: Complaint for Permanent Injunction and Other Relief (July 22, 2019)

A business that mishandles sensitive personal information can face injunctions, large money judgments, and long compliance obligations. In FTC v. Johnson, a stipulated order entered a monetary judgment of $280,911,870.36 against the IWorks settling defendants, representing the Commission's estimate of total alleged unreimbursed consumer injury, with full payment suspended on conditions.61 Source: FTC v. Johnson, No. 2:10-cv-02203-MMD-GWF (D. Nev. Aug. 24, 2016), §§ IV–V In the same litigation, after a bench trial, the court found Terrason Spinks and Jet Processing, Inc. liable and determined consumer injury of $280,911,870, for which they were jointly and severally liable.62 Source: FTC v. Johnson (D. Nev.), Order for Permanent Injunction and Monetary Judgment as to Defendants Terrason Spinks and Jet Processing, Inc.

Selling or sharing the data itself can be enjoined. One stipulated order permanently restrained defendants from selling, transferring, or otherwise disclosing a consumer's Sensitive Personal Information to any person unless the consumer has requested a financial product or service, and the other conditions in the order are met, including the consumer's express, informed consent.63 Source: Stipulated Order for Permanent Injunction and Judgment, §§ II, V, VI That order also entered a $1,500,000 judgment. 64 Source: Stipulated Order for Permanent Injunction and Judgment, §§ II, V, VI The defendants agreed that judgment represents a civil penalty owed to the government.65 Source: Stipulated Order for Permanent Injunction and Judgment, §§ II, V, VI

Collecting sensitive information under a false promise carries its own exposure. In FTC v. On Point, the district court continued an asset freeze and receivership at the preliminary-injunction stage to preserve monetary restitution for consumers.66 Source: Brief of the Federal Trade Commission, Nos. 20-10790 & 20-10859 (11th Cir.) The receiver reported that the challenged websites had generated over $80 million in revenue in the last two years alone.67 Source: Brief of the Federal Trade Commission, Nos. 20-10790 & 20-10859 (11th Cir.) In a separate appeal, the FTC's brief reported that the district court compensated victims who had given sensitive personal information to the benefit-eligibility sites, reasoning that the sites used false pretenses to deprive victims of their “ability to exclusively control and use their personal information.”68 Source: FTC v. Burton Katz et al., Opening Brief of the FTC, No. 23-11197 (11th Cir.) The brief added that because the defendants sold that information to third parties for $17.29 million, the court treated the sale as having “established on the open market the value of consumers’ loss.”69 Source: FTC v. Burton Katz et al., Opening Brief of the FTC, No. 23-11197 (11th Cir.)

Data-security cases tend to end in orders that last for years. The FTC's proposed order for Vitagene (1Health.io Inc.), which sold DNA health test kits, would require third-party data security assessments for twenty years. 70 Source: In the Matter of 1Health.io Inc., File No. 1923170, Analysis of Proposed Consent Order to Aid Public Comment (FTC) It would also require $75,000 in monetary relief.71 Source: In the Matter of 1Health.io Inc., File No. 1923170, Analysis of Proposed Consent Order to Aid Public Comment (FTC) Violating a final order carries per-violation penalties: in the BLU Products matter, the FTC told a commenter that it can seek civil penalties of $41,484 per violation while the order is in effect.72 Source: BLU Products and Samuel Ohev-Zion, In the Matter of: Letters to Commenters (FTC Sept. 10, 2018)

A business does not have to be breached to be charged. In LabMD the Commission reasoned that Section 5 has a “prophylactic purpose” and authorizes the Commission to take “preemptive action.”73 Source: In re LabMD, Inc., Opinion of the Commission Liability for security failures is still contested, which cuts both ways: in that case the administrative law judge dismissed the complaint after trial, holding that Complaint Counsel had not shown that the practices caused or were likely to cause substantial injury, before the Commission reversed.74 Source: In re LabMD, Inc., Opinion of the Commission