FTC Files Complaint Against Data Analytics Firm and Two Employees

The FTC recently filed an administrative complaint against a British consulting and data analytics firm, and filed settlements for public comment with the firm’s former chief executive officer and an app developer (collectively “respondents”) who worked with the firm, alleging they used deceptive tactics to harvest personal information from millions of users of the world’s largest social media company.  On the same day that the FTC issued these settlements, the agency announced that the same social media company will pay a $5 billion penalty to settle allegations that it mishandled its users’ personal information.

The FTC alleged that the firm collected user IDs and data related to gender, birthdate, current city, “friends” list, and “likes” of public social media pages from approximately 260,000 social media users, and then collected data from those users’ “friends,” so that the firm was able to build profiles and predict users’ personality traits for approximately 30 million US residents (and approximately 60 million people worldwide) using an algorithm it had developed.  The complaint against the firm alleged three violations of the FTC Act, including:  (i) misrepresenting its activities regarding the collection of personal information from the social media company’s users; (ii) making deceptive claims regarding its participation in the US-EU Privacy Shield; and (iii) making deceptive claims regarding its ongoing obligations pursuant to the US-EU Privacy Shield. 

The complaint seeks to prohibit the firm from misrepresenting its data collection practices, including the extent to or the purposes for which it collects, uses, shares, or sells identifiable information.  The complaint also seeks to require the firm to provide to the FTC a list of all persons with whom the firm shared its information, as well as requiring the firm to delete this information from its own systems.  The complaint prohibits the firm from making any misrepresentations about its participation in any privacy or security programs, to meet its obligations under the US-EU Privacy Shield, and seeks to enjoin the firm from “disclosing, using, selling, or receiving any benefit” from information collected as a part of its operation.  As part of a proposed settlement with the FTC, the former chief executive officer and an app developer have agreed to the administrative orders which closely track the relief sought in the complaint against the firm.  The firm has filed for bankruptcy and has not settled the FTC’s allegations.