The Federal Trade Commission (FTC) announced settlements with four companies last month—IDmission LLC, mResource LLC (doing business as Loop Works LLC), SmartStart Employment Screening, Inc. and VenPath, Inc.—of the FTC’s claims that the companies engaged in deceptive trade practices by falsely claiming to be certified under the EU-U.S. Privacy Shield. The EU-U.S. Privacy Shield is the framework agreement between the EU and the U.S. that provides, for participating companies, a lawful mechanism to transmit personal data regarding EU data subjects to recipients in the United States.

Specifically, the FTC alleged that VenPath, SmartStart and mResource continued to state on their websites that they complied with the Privacy Shield after allowing their certifications to lapse. The FTC alleged that IDmission claimed it complied with the Privacy Shield even though it never completed the steps necessary to be certified. The FTC also alleged that SmartStart and VenPath violated the Privacy Shield by failing to affirm to the U.S. Department of Commerce, when they stopped participating in the Privacy Shield, that they would continue to protect personal information collected while they were participating.

The announcement serves as an important reminder to Privacy Shield participants that they must recertify annually or formally withdraw from participation. These companies are not the first to settle with the FTC over allegations of failure to maintain current certification and accurate statements regarding participation in an EU-U.S. data protection framework agreement. For instance, in July 2018, the FTC settled similar claims against ReadyTech. In 2017, it settled claims against Decusoft, LLC, Tru Communication, Inc. and Md7, LLC. And in 2014, the FTC settled claims against twelve companies that had allegedly made similarly false statements regarding their compliance with the EU-U.S. Safe Harbor Framework, the Privacy Shield’s predecessor.

© 2018 Perkins Coie LLP