FTC, AMERICAN APPAREL SETTLE CHARGE OF FALSELY CLAIMING TO COMPLY WITH SAFE HARBOR PRIVACY FRAMEWORK

FROM:  FEDERAL TRADE COMMISSION

American Apparel Settles FTC Charge It Falsely Claimed to Comply with International Safe Harbor Privacy Framework

Clothing manufacturer American Apparel has agreed to settle Federal Trade Commission charges that it falsely claimed it was abiding by an international privacy framework known as the U.S.-EU Safe Harbor that enables U.S. companies to transfer consumer data from the European Union to the United States in compliance with EU law.

“The FTC is committed to making sure that when companies claim they’re participating in the U.S.-EU Safe Harbor Framework, they’re abiding by the terms of the program,” said Jessica Rich, Director of the FTC’s Bureau of Consumer Protection.

According to a complaint filed by the FTC, the Los Angeles-based company deceptively claimed it held current certifications under the U.S.-EU and U.S.-Swiss Safe Harbor frameworks. The Safe Harbor frameworks are voluntary programs administered by the U.S. Department of Commerce in consultation with the European Commission and Switzerland.

To participate, a company must self-certify annually to the Department of Commerce that it complies with the seven privacy principles required to meet the EU’s adequacy standard: notice, choice, onward transfer, security, data integrity, access, and enforcement.

The FTC complaint charges American Apparel with representing, through statements in its privacy policy that the company held current Safe Harbor certifications, even though it had allowed its certifications to lapse. The Commission alleged that this conduct violated Section 5 of the FTC Act. However, this does not necessarily mean that the company committed any substantive violations of the privacy principles of the Safe Harbor frameworks.

Under the proposed settlement agreement, American Apparel is prohibited from misrepresenting the extent to which it participates in any privacy or data security program sponsored by the government or any other self-regulatory or standard-setting organization.

This case was brought with the valuable assistance of the U.S. Department of Commerce.

The Commission vote to accept the consent order for public comment was 4-0-1, with Commissioner McSweeny not participating. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through June 9, 2014, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit written comments electronically or in paper form by following the instructions in the “Invitation To Comment” part of the “Supplementary Information” section. Comments in electronic form should be submitted online.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.