financial transactions, falsely claimed that its data security practices “exceeded” or
“surpassed” industry security standards as well as falsely claimed that its information
was securely encrypted and stored.
249 Under the terms of the consent decree, Dwolla
must (1) pay a $100,000 civil penalty to CFPB’s Civil Penalty Fund, (2) stop
misrepresenting its data security practices, and (3) train its’ employees properly
and fix any security weaknesses found in its web and mobile applications.
250
In the realm of criminal actions, individuals who violate the GLBA by fraudulently obtaining financial information belonging to another person may face up to a
5 year term of imprisonment.
251 If the individual is convicted of this offense while
violating another U.S. law or as a pattern of illegal activity involving more than
$100,000 per year, may also face criminal penalties of up to 10 years in prison and
fines of up to $500,000 (individual) or $1,000,000 (company).
252
6.2 Federal Trade Commission Act & Enforcement Authority
In addition to actions brought under the Gramm-Leach-Bliley Act, the FTC may
bring a broad range of actions under Section 5(a) of the FTC Act to protect
consumers’ privacy and personal information. The Federal Trade Commission has
the authority to bring claims under the Federal Trade Commission Act (FTC),
15 U.S.C.A. § 45(a), in the data-breach context.
253 At first glance, it may seem
like a stretch to fit claims related to data breaches and safety under the FTC’s broad
mandate to protect consumers against unfair trade practices. However, in F.T.C.
v. Wyndham Worldwide Corp.,
254 Third Circuit Court of Appeals upheld a lower
court decision which held that the FTC possessed power to regulate data security
practices under the unfairness prong of 15 U.S.C. § 45(a).
255 Notably, the Third
Circuit rejected Wyndham’s argument that subsequent Congressional legislation,
including legislation such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting
Act, and the Children’s Online Privacy Protection Act could be read to exclude cyber
security from the FTC’s authority.
256 The FTC may also obtain civil monetary
249 “CFPB Takes Action Against Dwolla for Misrepresenting Data Security Practices”, Consumer
Financial Protection Bureau, 2 March 2016. Available online at: https://www.consumerfinance.
gov/about-us/newsroom/cfpb-takes-action-against-dwolla-for-misrepresenting-data-security-prac
tices/.
250 In the Matter of Dwolla, Inc. Consent Order, United States of America Consumer Financial
Protection Bureau, Administrative Proceeding File No. 2016-CFPB-0007, 03/02/2016. Available
online at: http://files.consumerfinance.gov/f/201603_cfpb_consent-order-dwolla-inc.pdf.
251 15 USC §6823(A).
252 15 USC §6823(B).
253 Surette n.d..
254 799 F.3d 236, 2015 U.S. App. LEXIS 14839 (3rd Cir. 2015).
255 799 F.3d At 245–46.
256 799 F.3d At 247.
Data Protection in the United States: U.S. National Report
443
“surpassed” industry security standards as well as falsely claimed that its information
was securely encrypted and stored.
249 Under the terms of the consent decree, Dwolla
must (1) pay a $100,000 civil penalty to CFPB’s Civil Penalty Fund, (2) stop
misrepresenting its data security practices, and (3) train its’ employees properly
and fix any security weaknesses found in its web and mobile applications.
250
In the realm of criminal actions, individuals who violate the GLBA by fraudulently obtaining financial information belonging to another person may face up to a
5 year term of imprisonment.
251 If the individual is convicted of this offense while
violating another U.S. law or as a pattern of illegal activity involving more than
$100,000 per year, may also face criminal penalties of up to 10 years in prison and
fines of up to $500,000 (individual) or $1,000,000 (company).
252
6.2 Federal Trade Commission Act & Enforcement Authority
In addition to actions brought under the Gramm-Leach-Bliley Act, the FTC may
bring a broad range of actions under Section 5(a) of the FTC Act to protect
consumers’ privacy and personal information. The Federal Trade Commission has
the authority to bring claims under the Federal Trade Commission Act (FTC),
15 U.S.C.A. § 45(a), in the data-breach context.
253 At first glance, it may seem
like a stretch to fit claims related to data breaches and safety under the FTC’s broad
mandate to protect consumers against unfair trade practices. However, in F.T.C.
v. Wyndham Worldwide Corp.,
254 Third Circuit Court of Appeals upheld a lower
court decision which held that the FTC possessed power to regulate data security
practices under the unfairness prong of 15 U.S.C. § 45(a).
255 Notably, the Third
Circuit rejected Wyndham’s argument that subsequent Congressional legislation,
including legislation such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting
Act, and the Children’s Online Privacy Protection Act could be read to exclude cyber
security from the FTC’s authority.
256 The FTC may also obtain civil monetary
249 “CFPB Takes Action Against Dwolla for Misrepresenting Data Security Practices”, Consumer
Financial Protection Bureau, 2 March 2016. Available online at: https://www.consumerfinance.
gov/about-us/newsroom/cfpb-takes-action-against-dwolla-for-misrepresenting-data-security-prac
tices/.
250 In the Matter of Dwolla, Inc. Consent Order, United States of America Consumer Financial
Protection Bureau, Administrative Proceeding File No. 2016-CFPB-0007, 03/02/2016. Available
online at: http://files.consumerfinance.gov/f/201603_cfpb_consent-order-dwolla-inc.pdf.
251 15 USC §6823(A).
252 15 USC §6823(B).
253 Surette n.d..
254 799 F.3d 236, 2015 U.S. App. LEXIS 14839 (3rd Cir. 2015).
255 799 F.3d At 245–46.
256 799 F.3d At 247.
Data Protection in the United States: U.S. National Report
443