Privacy and Security
The Children’s Online Privacy Protection Act (COPPA) gives parents control over what information websites can collect from their kids. The COPPA Rule — with new provisions in effect on July 1, 2013 — puts additional protections in place and streamlines other procedures that companies covered by the rule need to follow. If you run a website designed for kids or have a website geared to a general audience but collect information from someone you know is under 13, you must comply with COPPA’s requirements. Questions? Send them to CoppaHotLine@ftc.gov.
Does your business use consumer reports or credit reports to evaluate customers’ creditworthiness? Do you consult reports when evaluating applications for jobs, leases, or insurance? Here's information about your responsibilities under the Fair Credit Reporting Act and other laws when using, reporting, and disposing of information in those reports.
Many companies keep sensitive personal information about customers or employees in their files or on their network. Having a sound security plan in place to collect only what you need, keep it safe, and dispose of it securely can help you meet your legal obligations to protect that sensitive data. The FTC has free resources for businesses of any size.
The Gramm-Leach-Bliley Act requires financial institutions – companies that offer consumers financial products or services like loans, financial or investment advice, or insurance – to explain their information-sharing practices to their customers and to safeguard sensitive data.
The Red Flags Rule requires many businesses and organizations to implement a written Identity Theft Prevention Program designed to detect the warning signs – or red flags – of identity theft in their day-to-day operations.
Update on the U.S.-EU Safe Harbor Framework
On October 6, 2015, the European Court of Justice issued a judgment declaring invalid the European Commission’s July 26, 2000 decision on the legal adequacy of Safe Harbor. On February 29, 2016, the Department of Commerce and the European Commission publicly released the EU-U.S. Privacy Shield Framework. This Framework, which replaces the Safe Harbor program, will provide a legal mechanism for companies to transfer personal data from the EU to the United States. It will be enforced by the FTC. The European Commission has issued a draft adequacy decision and will consider the opinion of other European entities on the Framework before issuing a final decision. We continue to expect companies to comply with their ongoing obligations with respect to data previously transferred under the Safe Harbor Framework. We also encourage companies to continue to follow robust privacy principles, such as those underlying the Safe Harbor Framework, and to review their privacy policies to ensure they describe their privacy practices accurately, including with regard to international data transfers. For more information about the new Framework, see the FTC press release dated February 29, 2016 and visit www.commerce.gov/privacyshield.