FTC Settlement with MySpace Provides a Reminder on Privacy Basics
The Policy and Violation
In addition, the FTC alleged that MySpace's action violated its obligation under the U.S.-EU Safe Harbor Privacy Principles to give consumers notice of how their information will be used and the choice to opt out. Failing to comply with the commitments one makes when self-certifying Safe Harbor compliance also is a violation of Section 5.
Consent Order Requirements
Rather than litigate, MySpace's new owners chose to settle. As in previous FTC Section 5 enforcement actions against prominent Internet firms such as Google, Facebook and Twitter, MySpace will operate for many years under a consent decree. The settlement will require MySpace to take a number of steps easily recognizable to anyone familiar with those previous settlements.
In particular, the agreement will require MySpace not to make any further misrepresentations of its privacy practices. It also specifies steps intended to prevent future problems. These include the creation of a comprehensive privacy program designed to identify and address privacy risks related to MySpace's services, and to protect the confidentiality of personal information. Among the actions required are the designation of an employee or employees to coordinate and be responsible for the privacy program, to identify reasonably foreseeable risks to privacy, to implement reasonable privacy controls to address those risks, and to undergo privacy audits every two years for the next 20 years.
Even if its luster has dimmed in recent years, MySpace still has some 25 million users, so the FTC's action does serve to protect the privacy interests of a large number of people. More importantly, however, the FTC often uses enforcement actions and settlements to send a message to the larger industry. Here, the message-make sure that you do what you say and say what you do-should remind all businesses that it would be a good idea to review their websites and privacy policies to ensure that they remain accurate.