Drizly, LLC; Analysis of Proposed Consent Order To Aid Public Comment, 65767-65771 [2022-23669]

Download as PDF Federal Register / Vol. 87, No. 210 / Tuesday, November 1, 2022 / Notices Comments regarding each of these applications must be received at the Reserve Bank indicated or the offices of the Board of Governors, Ann E. Misback, Secretary of the Board, 20th Street and Constitution Avenue NW, Washington, DC 20551–0001, not later than December 1, 2022. A. Federal Reserve Bank of Atlanta (Erien O. Terry, Assistant Vice President) 1000 Peachtree Street NE, Atlanta, Georgia 30309 or electronically to Applications.Comments@atl.frb.org: 1. Commercial Bancgroup, Inc., and its parent companies, Unified Shares, LLC, and Robertson Holding Company, L.P., all of Harrogate, Tennessee; to acquire AB&T Financial Corporation and thereby indirectly acquire Alliance Bank & Trust Company, both of Gastonia, North Carolina. Board of Governors of the Federal Reserve System. Michele Taylor Fennell, Deputy Associate Secretary of the Board. [FR Doc. 2022–23767 Filed 10–31–22; 8:45 am] BILLING CODE P FEDERAL TRADE COMMISSION [File No. 202 3185] Drizly, LLC; Analysis of Proposed Consent Order To Aid Public Comment Federal Trade Commission. Proposed consent agreement; request for comment. AGENCY: ACTION: The consent agreement in this matter settles alleged violations of federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the draft complaint and the terms of the consent order— embodied in the consent agreement— that would settle these allegations. DATES: Comments must be received on or before December 1, 2022. ADDRESSES: Interested parties may file comments online or on paper by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Please write ‘‘Drizly, LLC; File No. 202 3185’’ on your comment and file your comment online at https:// www.regulations.gov by following the instructions on the web-based form. If you prefer to file your comment on paper, please mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex D), Washington, DC 20580. lotter on DSK11XQN23PROD with NOTICES1 SUMMARY: VerDate Sep<11>2014 17:11 Oct 31, 2022 Jkt 259001 FOR FURTHER INFORMATION CONTACT: Jamie Hine (202–326–2188) or Elizabeth Averill (202–326–2993), Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule § 2.34, 16 CFR 2.34, notice is hereby given that the above-captioned consent agreement containing a consent order to cease and desist, having been filed with and accepted, subject to final approval, by the Commission, has been placed on the public record for a period of 30 days. The following Analysis to Aid Public Comment describes the terms of the consent agreement and the allegations in the complaint. An electronic copy of the full text of the consent agreement package can be obtained at https://www.ftc.gov/newsevents/commission-actions. You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before December 1, 2022. Write ‘‘Drizly, LLC; File No. 202 3185’’ on your comment. Your comment—including your name and your state—will be placed on the public record of this proceeding, including, to the extent practicable, on the https:// www.regulations.gov website. Because of heightened security screening, postal mail addressed to the Commission will be subject to delay. We strongly encourage you to submit your comments online through the https:// www.regulations.gov website. If you prefer to file your comment on paper, write ‘‘Drizly, LLC; File No. 202 3185’’ on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex D), Washington, DC 20580. Because your comment will be placed on the publicly accessible website at https://www.regulations.gov, you are solely responsible for making sure your comment does not include any sensitive or confidential information. In particular, your comment should not include sensitive personal information, such as your or anyone else’s Social Security number; date of birth; driver’s license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure your comment does not include sensitive health information, such as medical PO 00000 Frm 00036 Fmt 4703 Sfmt 4703 65767 records or other individually identifiable health information. In addition, your comment should not include any ‘‘trade secret or any commercial or financial information which . . . is privileged or confidential’’—as provided by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule § 4.10(a)(2), 16 CFR 4.10(a)(2)—including competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names. Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled ‘‘Confidential,’’ and must comply with FTC Rule § 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule § 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted on the https://www.regulations.gov website—as legally required by FTC Rule § 4.9(b)— we cannot redact or remove your comment from that website, unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule § 4.9(c), and the General Counsel grants that request. Visit the FTC website at https:// www.ftc.gov to read this document and the news release describing the proposed settlement. The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding, as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before December 1, 2022. For information on the Commission’s privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/ privacy-policy. Analysis of Proposed Consent Order To Aid Public Comment The Federal Trade Commission (‘‘Commission’’) has accepted, subject to final approval, an agreement containing a Proposed Consent Order (‘‘Proposed Order’’) from Drizly, LLC (‘‘Drizly’’ or ‘‘Corporate Respondent’’) and James Cory Rellas (‘‘Rellas’’ or ‘‘Individual Respondent’’), individually and as an officer of Drizly (collectively, ‘‘Respondents’’). E:\FR\FM\01NON1.SGM 01NON1 lotter on DSK11XQN23PROD with NOTICES1 65768 Federal Register / Vol. 87, No. 210 / Tuesday, November 1, 2022 / Notices The Proposed Order has been placed on the public record for 30 days for receipt of comments from interested persons. Comments received during this period will become part of the public record. After 30 days, the Commission will again review the agreement and the comments received and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s Proposed Order. This matter involves Respondents’ data security practices. Drizly operates an e-commerce platform that enables local retailers to sell alcohol online to consumers of legal drinking age and stored personal information for more than 2.5 million consumers. Respondents engaged in a number of unreasonable data security practices which caused or are likely to cause substantial consumer injury. In addition, Corporate Respondent made a number of misrepresentations to consumers in its privacy policies about the measures it took to protect consumers’ personal information. The Commission’s proposed twocount complaint alleges that Respondents have violated section 5(a) of the Federal Trade Commission Act. First, the complaint alleges that Respondents have engaged in a number of unreasonable security practices that led to a hacker’s unauthorized download of personal information about 2.5 million consumers. The complaint alleges that Respondents: • Failed to develop adequate written information security standards, policies, procedures, or practices; assess or enforce compliance with the written standards, policies, procedures, and practices that it did have; and implement training for employees (including engineers) regarding such standards, policies, procedures, and practices; • Failed to securely store AWS and database login credentials, by including them in GitHub repositories, and failed to use readily available measures to scan these repositories for unsecured credentials (such as usernames, passwords, API keys, secure access tokens, and asymmetric private keys); • Failed to impose reasonable data access controls such as: (1) unique and complex passwords or multifactor authentication to access source code or databases; (2) enforcing role-based access controls; (3) monitoring and terminating employee and contractor access to source code once they no longer needed such access; (4) restricting inbound connections to known IP addresses; and (5) requiring VerDate Sep<11>2014 17:11 Oct 31, 2022 Jkt 259001 appropriate authentications between Drizly applications and the production environment; • Failed to prevent data loss by monitoring for unauthorized attempts to transfer or exfiltrate consumers’ personal information outside the company’s network boundaries; continually log and monitor its systems and assets to identify data security events; and perform regular assessments as to the effectiveness of protection measures; • Failed to test, audit, assess, or review its products’ or applications’ security features; and failed to conduct regular risk assessments, vulnerability scans, and penetration testing of its networks and databases; and • Failed to have a policy, procedure, or practice for inventorying and deleting consumers’ personal information stored on its network that was no longer necessary. The complaint alleges that Respondents could have addressed each of the failures described through well known, readily available, and relatively low-cost measures. It also alleges Respondent’s failures caused or are likely to cause substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers themselves. Such practice constitutes an unfair act or practice under section 5 of the FTC Act. Second, the complaint alleges Drizly made false statements on its corporate website and in its mobile apps about its information security practices. Specifically, Corporate Respondent misrepresented to consumers that the information it collects from them is securely stored and protected by commercially reasonable security practices. The complaint alleges Corporate Respondent’s actions constitute deceptive acts or practices in violation of section 5(a) of the FTC Act. The Proposed Order contains injunctive provisions addressing the alleged unfair and deceptive conduct in connection with Respondent’s sale of dealer management system software and services. Part I of the Proposed Order prohibits Corporate Respondent from misrepresenting the privacy and security measures it uses to protect consumers’ information and privacy. Part II of the Proposed Order requires Corporate Respondent to delete within 60 days any ‘‘Covered Information’’ that is not being used or retained in connection with providing products or services to consumers, and to provide written statements to the Commission describing the specific deletion of any PO 00000 Frm 00037 Fmt 4703 Sfmt 4703 such ‘‘Covered Information.’’ In addition, Corporate Respondent must refrain from collecting or maintaining any future ‘‘Covered Information,’’ if the purpose is not necessary for specific purposes described in a retention schedule. Part III of the Proposed Order requires Drizly to create and display on its website and apps a retention schedule for any ‘‘Covered Information’’ it collects, maintains, uses, discloses, or provides access. The schedule must provide a purpose for the information collection, the business need for any retention, and a timeframe for eventual deletion. Part IV of the Proposed Order requires Corporate Respondent to implement an Information Security Program, requiring among other things: • Training in secure software development principles, including secure engineering and defensive programming concepts; • Measures to prevent the storage of unsecured access keys or other unsecured credentials; • Implementation of data access controls; • Risk assessment of source code and controls such as software code review; and • Use of non-SMS based multi-factor authentication for employees and offering multi-factor authentication as an option for consumers. Drizly must also obtain initial and biennial third-party assessments of its Information Security Program implementation (Part V), cooperate with the third-party assessor performing such assessments (Part VI), have a senior corporate manager or corporate officer make annual certifications regarding Corporate Respondent’s compliance with the Proposed Order’s data security requirements (Part VIII), and report to the Commission any event involving consumers’ personal information that constitutes a reportable event to any U.S. federal, state, or local government authority (Part IX). Part VII of the Proposed Order requires Individual Respondent James Cory Rellas, for a period of ten years, for any business that he is a majority owner, or is employed or functions as a CEO or other senior officer with responsibility for information security, to ensure the business has established and implements, and thereafter maintains, an information security program. Parts X–XIII of the Proposed Order are standard scofflaw provisions requiring acknowledgment of the Order to be delivered for ten years to corporate officers and employees engaged in the E:\FR\FM\01NON1.SGM 01NON1 Federal Register / Vol. 87, No. 210 / Tuesday, November 1, 2022 / Notices conduct related to the order; a compliance report to be submitted within one year of the order and after corporate changes; recordkeeping requirements that last twenty years; and the submission, upon request, of additional reports and records for compliance monitoring. Part XIV of the Proposed Order provides that the order terminates 20 years after its issuance or 20 years after the latest complaint filed in federal court alleging a violation of the order. The purpose of this analysis is to aid public comment on the Proposed Order. It is not intended to constitute an official interpretation of the complaint or Proposed Order, or to modify in any way the Proposed Order’s terms. By direction of the Commission, Commissioner Wilson dissenting in part. April J. Tabor, Secretary. lotter on DSK11XQN23PROD with NOTICES1 Statement of Chair Lina M. Khan Joined by Commissioner Alvaro M. Bedoya Today the Commission announced a settlement with the alcohol delivery platform Drizly, LLC, and its CEO, James Cory Rellas, over the company’s alleged failure to implement reasonable security policies. According to the complaint, this failure led to several data breaches that exposed the personal information of 2.5 million consumers. Drizly, a wholly owned subsidiary of Uber, collects and stores a vast amount of user data, including names, physical addresses, geolocation, and alcohol order history. It also stores information about consumers that it purchases from third parties. The Commission’s complaint alleges that in 2018, Rellas and Drizly were alerted to security weaknesses that put its stockpile of consumer data at risk, yet they did not address the problem. According to the complaint, the company neglected to implement basic best practices, such as developing a written data security policy or hiring a qualified employee responsible for data security. Then, in 2020, a hacker was able to access a massive trove of customer data by using login credentials reused by an executive across personal accounts. During this period, Drizly also allegedly made multiple misrepresentations about its data security practices in the privacy policy on its corporate website. The Commission’s proposed order imposes several important conditions to prevent similar failures in the future. It prohibits Drizly from collecting or storing consumer data that is not necessary for pre-specified business purposes. Drizly must also implement a VerDate Sep<11>2014 17:11 Oct 31, 2022 Jkt 259001 comprehensive security program that features the latest multifactor authentication requirements outlined in recent orders and prevents storage of unsecured credentials on its network or in any cloud-based service. In addition, Drizly must create a public retention schedule for such data, including timeframes for eventual deletion of stored data. Notably, the order applies personally to Rellas, who presided over Drizly’s lax data security practices as CEO. In the modern economy, corporate executives sometimes bounce from company to company, notwithstanding blemishes on their track record.1 Recognizing that reality, the Commission’s proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an information security program at future companies if he moves to a business collecting consumer information from more than 25,000 individuals, and where he is a majority owner, CEO, or senior officer with information security responsibilities. Our colleague Commissioner Wilson dissents from the portion of the settlement that personally applies to Rellas. She argues that CEOs of large companies must be allowed to decide for themselves whether or not to pay attention to data security. Respectfully, we disagree. Overseeing a big company is not an excuse to subordinate legal duties in favor of other priorities. The FTC has a role to play in making sure a company’s legal obligations are weighed in the boardroom. Today’s settlement sends a very clear message: protecting Americans’ data is not discretionary. It must be a priority for any chief executive. If anything, it only grows more important as a firm grows. Today’s action will not only correct Drizly’s lax data security practices but should also put other market participants on notice. Limiting the baseline collection and retention of data, as we do here, is a critical tool for protecting Americans from the risks of data breaches, and we will continue to explore remedies centered on limiting the data that is collected or retained in the first place.2 Finally, holding 1 See, e.g., Rani Molla, Why Does the WeWork Guy Get to Fail Up?, Recode (Aug 17, 2022), https:// www.vox.com/recode/2022/8/17/23309756/weworkadam-neumann-flow-andreessen-venture-capital. 2 See Press Release, Fed. Trade Comm’n, FTC Takes Action Against CafePress for Data Breach Cover Up (Mar. 15, 2022), https://www.ftc.gov/ news-events/news/press-releases/2022/03/ftc-takesaction-against-cafepress-data-breach-cover; Press Release, Fed. Trade Comm’n, Press Release, Fed. Trade Comm’n, FTC Takes Action Against Company Formerly Known as Weight Watchers for Illegally Collecting Kids’ Sensitive Health Data PO 00000 Frm 00038 Fmt 4703 Sfmt 4703 65769 individual executives accountable, as we also do here, can further ensure firms and the officers that run them are better incentivized to meet their legal obligations.3 Statement of Commissioner Rebecca Kelly Slaughter The kinds of lax and unreasonable data security practices the Commission has alleged in this settlement with Drizly 1 have caused immense and often incalculable harm to consumers. As the complaint recounts, Drizly’s carelessness with customer information led to an intruder gaining access to its systems and downloading the personal information of 2.5 million people. This order is commendable and marks a meaningful step forward in our data security enforcement. Naming Drizly’s CEO, James Corey Rellas, who oversaw these practices, helps ensure that corporate leadership must take seriously their obligation to safeguard customer information. Mechanisms like the proposed data retention schedule are also an excellent approach to provide accountability for data use and misuse. Ensuring that Drizly only collects information necessary to effectuate its published business needs should exert a disciplining influence on its collection of consumer information. The retention schedule also provides a clear hook for future FTC enforcement actions should Drizly not follow its strict requirements under this proposed order. Going forward, I believe the law would support us doing more to safeguard Americans’ data, including requiring substantive limits on (Mar. 4, 2022), https://www.ftc.gov/news-events/ news/press-releases/2022/03/ftc-takes-actionagainst-company-formerly-known-weight-watchersillegally-collecting-kids-sensitive; see also Statement of Chair Lina M. Khan Regarding the Report to Congress on Privacy and Security (Oct. 1, 2021), https://www.ftc.gov/system/files/documents/ public_statements/1597024/statement_of_chair_ lina_m_khan_regarding_the_report_to_congress_ on_privacy_and_security_-_final.pdf; Remarks of Chair Lina M. Khan As Prepared for Delivery, IAPP Global Privacy Summit 2022 (Apr. 11, 2022), https://www.ftc.gov/system/files/ftc_gov/pdf/ Remarks%20of%20Chair%20Lina%20M.%20 Khan%20at%20IAPP%20Global%20Privacy%20 Summit%202022%20-%20Final%20Version.pdf; see generally Trade Regulation Rule on Commercial Surveillance and Data Security, 87 FR 51273 (Aug. 22, 2022). 3 See Press Release, Fed. Trade Comm’n, FTC Bans SpyFone and CEO from Surveillance Business and Orders Company to Delete All Secretly Stolen Data (Sept. 1, 2021), https://www.ftc.gov/newsevents/news/press-releases/2021/09/ftc-bansspyfone-ceo-surveillance-business-orders-companydelete-all-secretly-stolen-data. 1 Drizly is now a wholly owned subsidiary of Uber which reached a settlement with the FTC over its allegedly lax data security practices in 2018. I worry greatly about this matryoshka doll of companies with a spotty track record of protecting consumer data. E:\FR\FM\01NON1.SGM 01NON1 65770 Federal Register / Vol. 87, No. 210 / Tuesday, November 1, 2022 / Notices appropriate collection and use. While the disclosure requirements in this order have value, disclosure alone is not enough. We know that endless terms-ofservice and other disclosures have not improved customer understanding, facilitated meaningful choice, or protected data from security breaches. But hackers cannot steal data that companies did not collect in the first place; requirements that limit what data can be collected, used, and retained could meaningfully foil and deter data security breaches. There are many ways to approach data collection guardrails. As the FTC further develops a minimization framework, one framework I hope we consider is centering a consumer’s reasonable expectation that there should be limits on the collection and use of their information based on the service they’ve actually requested. I believe the agency is in a better position to effectuate this expectation than it is to anticipate, understand, and police every claim of reasonable business necessity. A consumer centered data minimization standard could work hand-in-hand with the kinds of disclosures and effective data security practices in this proposed order to protect Americans from the ongoing epidemic of data breaches, which are greatly exacerbated by overcollection of consumer information. I am grateful to the staff for their hard work on this strong order. I look forward to seeing how our work continues to evolve in the pursuit of protecting Americans’ data and ensuring our confidence in the practices of the businesses with which we all transact. lotter on DSK11XQN23PROD with NOTICES1 Concurring and Dissenting Statement of Commissioner Christine S. Wilson Today the Commission announces a complaint and settlement resolving allegations that Drizly, LLC and its CEO, James Cory Rellas, violated Section 5 of the FTC Act. The complaint asserts that Drizly made false statements on its website and in its mobile apps about its information security practices. The Commission also alleges that Drizly engaged in several unreasonable data security practices that led to multiple security breaches, including a hacker’s unauthorized download of personal information about 2.5 million consumers. The FTC has long provided clear guidance to the business community about the fundamentals of sound data security.1 But, as the complaint details, 1 Fed. Trade Comm’n, Start with Security: A Guide for Business (Jun. 2015), https://www.ftc.gov/ tips-advice/business-center/guidance/start-securityguide-business; Press Release, Fed. Trade Comm’n, VerDate Sep<11>2014 17:11 Oct 31, 2022 Jkt 259001 Drizly failed to develop any written information security standards, policies, or procedures; failed to require unique and complex passwords or multifactor authentication to access source code or databases; failed to terminate employee or contractor access to data once they no longer needed such access; failed to monitor for unauthorized attempts to transfer or exfiltrate consumers’ personal information outside company networks; and engaged in other security shortcomings. Notably, simple, readily available, low-cost measures could have addressed Drizly’s security shortcomings. I support the complaint against the company and the order provisions that require Drizly to implement numerous data security practices to address the company’s missing security safeguards.2 In particular, my Democratic colleagues and I agree that data minimization plays an important role in a healthy data security program. As Commissioner Slaughter notes in her concurring statement, ‘‘hackers cannot steal data that companies did not collect in the first place.’’ While I support the complaint against the corporate defendant, I do not support holding the individual defendant, Rellas, liable. To seek injunctive relief with respect to a CEO or other principal, the Commission must show only that the individual ‘‘participated directly in the deceptive practices or had authority to control those practices.’’ 3 Authority to control does not require the FTC to show a ‘‘specific link from [the individual] to the particular deceptive [acts] and instead looks at whether [the individual] had authority to control the Stick with Security: FTC to Provide Additional Insights on Reasonable Data Security Practices (July 21, 2017), https://www.ftc.gov/news-events/pressreleases/2017/07/sticksecurity-ftc-provideadditional-insights-reasonable-data. 2 While I support the settlement against Drizly, I continue to question whether data security orders should remain in effect for 20 years. It is not realistic for the Commission to expect that injunctive relief with respect to this dynamic and rapidly evolving issue will remain relevant and beneficial to consumers for 20 years. See Concurring Statement of Commissioner Christine S. Wilson, In the Matter of InfoTrax Systems, L.C. and Mark Rawlins, File No. 1623130 (Nov. 19, 2020), https://www.ftc.gov/system/files/documents/ public_statements/1553676/162_3130_infotrax_ concurring_statement_cw_11-12-2019.pdf. 3 FTC v. Ross, 743 F.3d 886, 892–93 (4th Cir. 2014) (adopting the test for individual liability used by other federal appellate courts, including the First, Seventh, Ninth, Tenth, and Eleventh Circuits). The Commission also can establish liability for monetary relief by showing the defendant ‘‘had actual knowledge of the deceptive conduct, was recklessly indifferent to its deceptiveness, or had an awareness of a high probability of deceptiveness and intentionally avoided learning the truth.’’ Id. PO 00000 Frm 00039 Fmt 4703 Sfmt 4703 corporate entity’s practices.’’ 4 This broad standard effectively could enable the Commission to hold individually liable the CEOs of most companies against which we initiate enforcement action. The Commission traditionally has exercised its prosecutorial discretion and assessed a variety of factors when deciding whether to name a CEO or principal, including consideration of whether individual liability is necessary to obtain effective relief, and the level of the individual’s knowledge and participation in the alleged illegal conduct.5 The order against Drizly requires the company to implement extensive data security safeguards regardless of whether Rellas is at the helm of the organization. Naming Rellas does not change the injunctive obligations placed on the company to ensure that customers’ personal information is protected going forward. Moreover, the case against Drizly makes clear that the FTC expects technology start-ups to start with security and establish reasonable data security practices that grow with the company. As for knowledge and participation, the number of issues crossing a CEO’s desk on any given day is substantial. In most large companies, I would expect CEOs to have little to no involvement with, and no direct knowledge of, practices that are the subject of an FTC investigation. Here, we do not allege that Rellas oversaw day-to-day operations of the company’s data security practices, had any data security expertise, or was responsible for decisions about data security policies, procedures, or programs.6 Instead, we allege that Rellas did not appropriately 4 Id. at 893. FTC cases involve fraudulent or deceptive conduct by small, closely held companies that essentially serve as the alter egos of their principal or CEO. I support naming the CEO in such a case because the individual defendant is necessary to obtain effective relief and/or to prevent the fraudster from opening and shuttering companies to stay one step ahead of law enforcement. See Concurring Statement of Commissioner Christine S. Wilson Regarding FTC v. Progressive Leasing, LLC, File No. 1823127 (April 20, 2020), https:// www.ftc.gov/system/files/documents/public_ statements/1571921/182_3127_prog_leasing_-_ statement_of_commissioner_christine_s_wilson_ 0.pdf. 6 Cf Complaint, In re InfoTrax Systems, L.C., a limited liability company, and Mark Rawlins, Docket No. C–4696 (Dec. 30, 2019) (alleging Rawlins spent eighteen years at a software company, studied computer science in college, ‘‘reviewed and approved InfoTrax’s information technology security policies, was involved in discussions with clients about data security regularly, and was involved in the company’s longterm data security strategy.’’), https://www.ftc.gov/ system/files/documents/cases/c-4696_162_3130_ infotrax_complaint_clean.pdf. 5 Many E:\FR\FM\01NON1.SGM 01NON1 Federal Register / Vol. 87, No. 210 / Tuesday, November 1, 2022 / Notices prioritize hiring a senior executive responsible for privacy and data security. Our complaint notes that he hired other members of the c-suite but not a Chief Technology Officer or Chief Information Security Officer. And for Rellas’ failure to prioritize information security over other business obligations, the order imposes on Rellas significant compliance obligations even if he leaves Drizly.7 By naming Rellas, the Commission has not put the market on notice that the FTC will use its resources to target lax data security practices. Instead, it has signaled that the agency will substitute its own judgement about corporate priorities and governance decisions for those of companies.8 There is no doubt that robust data security is important. Having a federal data security law would signal to companies, executives, and boards of directors the importance of implementing and maintaining data security programs that address potential risks, taking into account the size of the business and the nature of the data at issue. But CEOs have hundreds of issues and numerous regulatory obligations to navigate. Companies, not federal regulators, are better positioned to evaluate what risks require the regular attention of a CEO. And when companies err in making those assessments, the government will hold them accountable. Accordingly, I dissent from the inclusion of the individual defendant in the complaint and settlement in this matter. [FR Doc. 2022–23669 Filed 10–31–22; 8:45 am] lotter on DSK11XQN23PROD with NOTICES1 BILLING CODE 6750–01–P 7 The Order binds Rellas to implement an information security program at any future company in which he is a majority owner, CEO, or senior officer with information security responsibilities, where that company collects personal information from at least 25,000 individuals. The Order does not address scenarios in which Boards of Directors, other owners, or higher-ranking executives make it impossible for Rellas to fulfill his obligations. 8 Then-Commissioner Phillips and I raised similar concerns in our dissents to the FTC’s regulatory reviews of the Safeguards Rule. See Joint Statement of Commissioners Noah Joshua Phillips and Christine S. Wilson, In the Matter of the Final Rule amending the Gramm-Leach-Bliley Act’s Safeguards Rule, File No. P145407 (Oct. 27, 2021), https:// www.ftc.gov/system/files/documents/public_ statements/1597994/joint_statement_of_ commissioners_phillips_and_wilson_in_the_ matter_of_regulatory_review_of_the_1.pdf; Dissenting Statement of Commissioner Noah Joshua Phillips and Commissioner Christine S. Wilson, Regulatory Review of Safeguards Rule, File No. P145407 (Mar. 5, 2019), https://www.ftc.gov/ system/files/documents/public_statements/ 1466705/reg_review_of_safeguards_rule_cmr_ phillips_wilson_dissent.pdf. VerDate Sep<11>2014 17:11 Oct 31, 2022 Jkt 259001 [Notice–PBS–2022–06; Docket No. 2022– 0002; Sequence No. 26] Notice of Intent To Prepare an Environmental Impact Statement and Initiate Section 106 Consultation for Four Buildings at 202, 208–212, 214 and 220 South State Street, Chicago, Illinois, and Notice of Public Scoping Meetings and Comment Period Public Buildings Service (PBS), General Services Administration (GSA). ACTION: Notice; public meeting. AGENCY: The General Services Administration (GSA) intends to prepare an Environmental Impact Statement (EIS) and conduct the Section 106 Process of the National Historic Preservation Act (NHPA) to address the future of buildings 202, 208–212, 214 and 220 South State Street between Adams Street and Jackson Boulevard, adjacent to the Dirksen Federal Courthouse in Chicago’s South Loop, downtown Chicago, Illinois. All four properties, for which Congress has appropriated funds for demolition, reside in the Loop Retail Historic District listed in the National Register of Historic Places. Two of the four buildings, the Century Building (202 State Street) and the Consumers Building (220 South State Street) are identified as contributing structures to the historic district. DATES: A scoping meeting will be held at the Morrison Conference Center in the Ralph H. Metcalfe Federal Building, 77 W. Jackson Blvd., Chicago, IL 60604, on Thursday, November 10, 2022, from 4 to 7 p.m., CST (Central Standard Time). Written comments must be received by Monday, December 12, 2022, in order to be considered in the EIS. Participants will be given an opportunity to comment based on the order in which they register. Each person will be allowed three minutes to comment during the meeting. Written comments will be accepted before and after the meeting and given the same priority as oral comments. ADDRESSES: People wishing to attend the public meeting in-person or virtually are asked to register for the event at this link: https://GSA-South_ State-Street-ScopingMeeting.eventbrite.com. Written comments may be sent by the following methods: • Email: statestreet@gsa.gov. • Mail: Joseph Mulligan, U.S. General Services Administration, 230 S. Dearborn St., Suite 3600, Chicago, IL 60604. PO 00000 Frm 00040 Fmt 4703 Sfmt 4703 Mr. Joseph Mulligan, U.S. General Services Administration, 230 S. Dearborn St., Suite 3600, Chicago, IL 60604; email: statestreet@gsa.gov. SUPPLEMENTARY INFORMATION: FOR FURTHER INFORMATION CONTACT: GENERAL SERVICES ADMINISTRATION SUMMARY: 65771 Scoping Process The purpose of the public scoping process is to identify relevant issues that will influence the scope of analysis of the human and natural environment including cultural resources. The EIS will include public input on alternatives and impacts. This meeting will also initiate GSA’s public consultation required by NHPA. GSA seeks input at this meeting that will assist the agency in planning for the Section 106 consultation process, identifying consulting parties, determining the area of the undertaking’s potential effects on cultural resources (Area of Potential Effects), and envisioning alternatives to demolition that will avoid, minimize or mitigate adverse effects. Federal, state, and local agencies, along with affected members of the public, are invited to participate in the NEPA scoping and Section 106 process. The National Historic Preservation Act (NHPA) and the National Environmental Policy Act (NEPA) are two separate laws which require federal agencies to consider the impacts to historic properties and the human environment before making decisions. NHPA and NEPA are independent statutes, yet may be executed concurrently to optimize efficiencies, transparency, and accountability to better understand the effects to the human, natural, and cultural environment. The EIS will be prepared pursuant to the requirements of the National Environmental Policy Act (NEPA) of 1969, the Council on Environmental Quality NEPA regulations, and the GSA Public Buildings Service NEPA Desk Guide. GSA will also consult with appropriate parties in accordance with Section 106 of the National Historic Preservation Act (NHPA) of 1966. Opportunities for affected members of the public to become a consulting party during the NHPA Section 106 process will be presented during the public scoping meeting. You may submit a comment to express your interest in being a consulting party if you cannot attend the meeting. Purpose and Need for the Proposed Action and Undertaking The purpose of the Proposed Action and Undertaking is to address the potential security vulnerabilities associated with buildings 202, 208–212, E:\FR\FM\01NON1.SGM 01NON1

Agencies

[Federal Register Volume 87, Number 210 (Tuesday, November 1, 2022)]
[Notices]
[Pages 65767-65771]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-23669]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

[File No. 202 3185]


Drizly, LLC; Analysis of Proposed Consent Order To Aid Public 
Comment

AGENCY: Federal Trade Commission.

ACTION: Proposed consent agreement; request for comment.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged 
violations of federal law prohibiting unfair or deceptive acts or 
practices. The attached Analysis of Proposed Consent Order to Aid 
Public Comment describes both the allegations in the draft complaint 
and the terms of the consent order--embodied in the consent agreement--
that would settle these allegations.

DATES: Comments must be received on or before December 1, 2022.

ADDRESSES: Interested parties may file comments online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Please write ``Drizly, LLC; 
File No. 202 3185'' on your comment and file your comment online at 
https://www.regulations.gov by following the instructions on the web-
based form. If you prefer to file your comment on paper, please mail 
your comment to the following address: Federal Trade Commission, Office 
of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), 
Washington, DC 20580.

FOR FURTHER INFORMATION CONTACT: Jamie Hine (202-326-2188) or Elizabeth 
Averill (202-326-2993), Bureau of Consumer Protection, Federal Trade 
Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: Pursuant to section 6(f) of the Federal 
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule Sec.  2.34, 16 CFR 
2.34, notice is hereby given that the above-captioned consent agreement 
containing a consent order to cease and desist, having been filed with 
and accepted, subject to final approval, by the Commission, has been 
placed on the public record for a period of 30 days. The following 
Analysis to Aid Public Comment describes the terms of the consent 
agreement and the allegations in the complaint. An electronic copy of 
the full text of the consent agreement package can be obtained at 
https://www.ftc.gov/news-events/commission-actions.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before December 1, 
2022. Write ``Drizly, LLC; File No. 202 3185'' on your comment. Your 
comment--including your name and your state--will be placed on the 
public record of this proceeding, including, to the extent practicable, 
on the https://www.regulations.gov website.
    Because of heightened security screening, postal mail addressed to 
the Commission will be subject to delay. We strongly encourage you to 
submit your comments online through the https://www.regulations.gov 
website.
    If you prefer to file your comment on paper, write ``Drizly, LLC; 
File No. 202 3185'' on your comment and on the envelope, and mail your 
comment to the following address: Federal Trade Commission, Office of 
the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), 
Washington, DC 20580.
    Because your comment will be placed on the publicly accessible 
website at https://www.regulations.gov, you are solely responsible for 
making sure your comment does not include any sensitive or confidential 
information. In particular, your comment should not include sensitive 
personal information, such as your or anyone else's Social Security 
number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure your comment does not include 
sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule Sec.  
4.10(a)(2), 16 CFR 4.10(a)(2)--including competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule Sec.  4.9(c). In 
particular, the written request for confidential treatment that 
accompanies the comment must include the factual and legal basis for 
the request, and must identify the specific portions of the comment to 
be withheld from the public record. See FTC Rule Sec.  4.9(c). Your 
comment will be kept confidential only if the General Counsel grants 
your request in accordance with the law and the public interest. Once 
your comment has been posted on the https://www.regulations.gov 
website--as legally required by FTC Rule Sec.  4.9(b)--we cannot redact 
or remove your comment from that website, unless you submit a 
confidentiality request that meets the requirements for such treatment 
under FTC Rule Sec.  4.9(c), and the General Counsel grants that 
request.
    Visit the FTC website at https://www.ftc.gov to read this document 
and the news release describing the proposed settlement. The FTC Act 
and other laws the Commission administers permit the collection of 
public comments to consider and use in this proceeding, as appropriate. 
The Commission will consider all timely and responsive public comments 
that it receives on or before December 1, 2022. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

    The Federal Trade Commission (``Commission'') has accepted, subject 
to final approval, an agreement containing a Proposed Consent Order 
(``Proposed Order'') from Drizly, LLC (``Drizly'' or ``Corporate 
Respondent'') and James Cory Rellas (``Rellas'' or ``Individual 
Respondent''), individually and as an officer of Drizly (collectively, 
``Respondents'').

[[Page 65768]]

    The Proposed Order has been placed on the public record for 30 days 
for receipt of comments from interested persons. Comments received 
during this period will become part of the public record. After 30 
days, the Commission will again review the agreement and the comments 
received and will decide whether it should withdraw from the agreement 
and take appropriate action or make final the agreement's Proposed 
Order.
    This matter involves Respondents' data security practices. Drizly 
operates an e-commerce platform that enables local retailers to sell 
alcohol online to consumers of legal drinking age and stored personal 
information for more than 2.5 million consumers. Respondents engaged in 
a number of unreasonable data security practices which caused or are 
likely to cause substantial consumer injury. In addition, Corporate 
Respondent made a number of misrepresentations to consumers in its 
privacy policies about the measures it took to protect consumers' 
personal information.
    The Commission's proposed two-count complaint alleges that 
Respondents have violated section 5(a) of the Federal Trade Commission 
Act. First, the complaint alleges that Respondents have engaged in a 
number of unreasonable security practices that led to a hacker's 
unauthorized download of personal information about 2.5 million 
consumers.
    The complaint alleges that Respondents:
     Failed to develop adequate written information security 
standards, policies, procedures, or practices; assess or enforce 
compliance with the written standards, policies, procedures, and 
practices that it did have; and implement training for employees 
(including engineers) regarding such standards, policies, procedures, 
and practices;
     Failed to securely store AWS and database login 
credentials, by including them in GitHub repositories, and failed to 
use readily available measures to scan these repositories for unsecured 
credentials (such as usernames, passwords, API keys, secure access 
tokens, and asymmetric private keys);
     Failed to impose reasonable data access controls such as: 
(1) unique and complex passwords or multifactor authentication to 
access source code or databases; (2) enforcing role-based access 
controls; (3) monitoring and terminating employee and contractor access 
to source code once they no longer needed such access; (4) restricting 
inbound connections to known IP addresses; and (5) requiring 
appropriate authentications between Drizly applications and the 
production environment;
     Failed to prevent data loss by monitoring for unauthorized 
attempts to transfer or exfiltrate consumers' personal information 
outside the company's network boundaries; continually log and monitor 
its systems and assets to identify data security events; and perform 
regular assessments as to the effectiveness of protection measures;
     Failed to test, audit, assess, or review its products' or 
applications' security features; and failed to conduct regular risk 
assessments, vulnerability scans, and penetration testing of its 
networks and databases; and
     Failed to have a policy, procedure, or practice for 
inventorying and deleting consumers' personal information stored on its 
network that was no longer necessary.
    The complaint alleges that Respondents could have addressed each of 
the failures described through well known, readily available, and 
relatively low-cost measures. It also alleges Respondent's failures 
caused or are likely to cause substantial injury to consumers that is 
not outweighed by countervailing benefits to consumers or competition 
and is not reasonably avoidable by consumers themselves. Such practice 
constitutes an unfair act or practice under section 5 of the FTC Act.
    Second, the complaint alleges Drizly made false statements on its 
corporate website and in its mobile apps about its information security 
practices. Specifically, Corporate Respondent misrepresented to 
consumers that the information it collects from them is securely stored 
and protected by commercially reasonable security practices. The 
complaint alleges Corporate Respondent's actions constitute deceptive 
acts or practices in violation of section 5(a) of the FTC Act.
    The Proposed Order contains injunctive provisions addressing the 
alleged unfair and deceptive conduct in connection with Respondent's 
sale of dealer management system software and services. Part I of the 
Proposed Order prohibits Corporate Respondent from misrepresenting the 
privacy and security measures it uses to protect consumers' information 
and privacy.
    Part II of the Proposed Order requires Corporate Respondent to 
delete within 60 days any ``Covered Information'' that is not being 
used or retained in connection with providing products or services to 
consumers, and to provide written statements to the Commission 
describing the specific deletion of any such ``Covered Information.'' 
In addition, Corporate Respondent must refrain from collecting or 
maintaining any future ``Covered Information,'' if the purpose is not 
necessary for specific purposes described in a retention schedule.
    Part III of the Proposed Order requires Drizly to create and 
display on its website and apps a retention schedule for any ``Covered 
Information'' it collects, maintains, uses, discloses, or provides 
access. The schedule must provide a purpose for the information 
collection, the business need for any retention, and a timeframe for 
eventual deletion.
    Part IV of the Proposed Order requires Corporate Respondent to 
implement an Information Security Program, requiring among other 
things:
     Training in secure software development principles, 
including secure engineering and defensive programming concepts;
     Measures to prevent the storage of unsecured access keys 
or other unsecured credentials;
     Implementation of data access controls;
     Risk assessment of source code and controls such as 
software code review; and
     Use of non-SMS based multi-factor authentication for 
employees and offering multi-factor authentication as an option for 
consumers.
    Drizly must also obtain initial and biennial third-party 
assessments of its Information Security Program implementation (Part 
V), cooperate with the third-party assessor performing such assessments 
(Part VI), have a senior corporate manager or corporate officer make 
annual certifications regarding Corporate Respondent's compliance with 
the Proposed Order's data security requirements (Part VIII), and report 
to the Commission any event involving consumers' personal information 
that constitutes a reportable event to any U.S. federal, state, or 
local government authority (Part IX).
    Part VII of the Proposed Order requires Individual Respondent James 
Cory Rellas, for a period of ten years, for any business that he is a 
majority owner, or is employed or functions as a CEO or other senior 
officer with responsibility for information security, to ensure the 
business has established and implements, and thereafter maintains, an 
information security program.
    Parts X-XIII of the Proposed Order are standard scofflaw provisions 
requiring acknowledgment of the Order to be delivered for ten years to 
corporate officers and employees engaged in the

[[Page 65769]]

conduct related to the order; a compliance report to be submitted 
within one year of the order and after corporate changes; recordkeeping 
requirements that last twenty years; and the submission, upon request, 
of additional reports and records for compliance monitoring.
    Part XIV of the Proposed Order provides that the order terminates 
20 years after its issuance or 20 years after the latest complaint 
filed in federal court alleging a violation of the order.
    The purpose of this analysis is to aid public comment on the 
Proposed Order. It is not intended to constitute an official 
interpretation of the complaint or Proposed Order, or to modify in any 
way the Proposed Order's terms.

    By direction of the Commission, Commissioner Wilson dissenting 
in part.
April J. Tabor,
Secretary.

Statement of Chair Lina M. Khan Joined by Commissioner Alvaro M. Bedoya

    Today the Commission announced a settlement with the alcohol 
delivery platform Drizly, LLC, and its CEO, James Cory Rellas, over the 
company's alleged failure to implement reasonable security policies. 
According to the complaint, this failure led to several data breaches 
that exposed the personal information of 2.5 million consumers. Drizly, 
a wholly owned subsidiary of Uber, collects and stores a vast amount of 
user data, including names, physical addresses, geolocation, and 
alcohol order history. It also stores information about consumers that 
it purchases from third parties.
    The Commission's complaint alleges that in 2018, Rellas and Drizly 
were alerted to security weaknesses that put its stockpile of consumer 
data at risk, yet they did not address the problem. According to the 
complaint, the company neglected to implement basic best practices, 
such as developing a written data security policy or hiring a qualified 
employee responsible for data security. Then, in 2020, a hacker was 
able to access a massive trove of customer data by using login 
credentials reused by an executive across personal accounts. During 
this period, Drizly also allegedly made multiple misrepresentations 
about its data security practices in the privacy policy on its 
corporate website.
    The Commission's proposed order imposes several important 
conditions to prevent similar failures in the future. It prohibits 
Drizly from collecting or storing consumer data that is not necessary 
for pre-specified business purposes. Drizly must also implement a 
comprehensive security program that features the latest multifactor 
authentication requirements outlined in recent orders and prevents 
storage of unsecured credentials on its network or in any cloud-based 
service. In addition, Drizly must create a public retention schedule 
for such data, including timeframes for eventual deletion of stored 
data.
    Notably, the order applies personally to Rellas, who presided over 
Drizly's lax data security practices as CEO. In the modern economy, 
corporate executives sometimes bounce from company to company, 
notwithstanding blemishes on their track record.\1\ Recognizing that 
reality, the Commission's proposed order will follow Rellas even if he 
leaves Drizly. Specifically, Rellas will be required to implement an 
information security program at future companies if he moves to a 
business collecting consumer information from more than 25,000 
individuals, and where he is a majority owner, CEO, or senior officer 
with information security responsibilities. Our colleague Commissioner 
Wilson dissents from the portion of the settlement that personally 
applies to Rellas. She argues that CEOs of large companies must be 
allowed to decide for themselves whether or not to pay attention to 
data security. Respectfully, we disagree. Overseeing a big company is 
not an excuse to subordinate legal duties in favor of other priorities. 
The FTC has a role to play in making sure a company's legal obligations 
are weighed in the boardroom. Today's settlement sends a very clear 
message: protecting Americans' data is not discretionary. It must be a 
priority for any chief executive. If anything, it only grows more 
important as a firm grows.
---------------------------------------------------------------------------

    \1\ See, e.g., Rani Molla, Why Does the WeWork Guy Get to Fail 
Up?, Recode (Aug 17, 2022), https://www.vox.com/recode/2022/8/17/23309756/wework-adam-neumann-flow-andreessen-venture-capital.
---------------------------------------------------------------------------

    Today's action will not only correct Drizly's lax data security 
practices but should also put other market participants on notice. 
Limiting the baseline collection and retention of data, as we do here, 
is a critical tool for protecting Americans from the risks of data 
breaches, and we will continue to explore remedies centered on limiting 
the data that is collected or retained in the first place.\2\ Finally, 
holding individual executives accountable, as we also do here, can 
further ensure firms and the officers that run them are better 
incentivized to meet their legal obligations.\3\
---------------------------------------------------------------------------

    \2\ See Press Release, Fed. Trade Comm'n, FTC Takes Action 
Against CafePress for Data Breach Cover Up (Mar. 15, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-cafepress-data-breach-cover; Press Release, Fed. 
Trade Comm'n, Press Release, Fed. Trade Comm'n, FTC Takes Action 
Against Company Formerly Known as Weight Watchers for Illegally 
Collecting Kids' Sensitive Health Data (Mar. 4, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive; see also Statement of Chair Lina M. Khan 
Regarding the Report to Congress on Privacy and Security (Oct. 1, 
2021), https://www.ftc.gov/system/files/documents/public_statements/1597024/statement_of_chair_lina_m_khan_regarding_the_report_to_congress_on_privacy_and_security_-_final.pdf; Remarks of Chair Lina M. Khan As 
Prepared for Delivery, IAPP Global Privacy Summit 2022 (Apr. 11, 
2022), https://www.ftc.gov/system/files/ftc_gov/pdf/Remarks%20of%20Chair%20Lina%20M.%20Khan%20at%20IAPP%20Global%20Privacy%20Summit%202022%20-%20Final%20Version.pdf; see generally Trade 
Regulation Rule on Commercial Surveillance and Data Security, 87 FR 
51273 (Aug. 22, 2022).
    \3\ See Press Release, Fed. Trade Comm'n, FTC Bans SpyFone and 
CEO from Surveillance Business and Orders Company to Delete All 
Secretly Stolen Data (Sept. 1, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/09/ftc-bans-spyfone-ceo-surveillance-business-orders-company-delete-all-secretly-stolen-data.
---------------------------------------------------------------------------

Statement of Commissioner Rebecca Kelly Slaughter

    The kinds of lax and unreasonable data security practices the 
Commission has alleged in this settlement with Drizly \1\ have caused 
immense and often incalculable harm to consumers. As the complaint 
recounts, Drizly's carelessness with customer information led to an 
intruder gaining access to its systems and downloading the personal 
information of 2.5 million people.
---------------------------------------------------------------------------

    \1\ Drizly is now a wholly owned subsidiary of Uber which 
reached a settlement with the FTC over its allegedly lax data 
security practices in 2018. I worry greatly about this matryoshka 
doll of companies with a spotty track record of protecting consumer 
data.
---------------------------------------------------------------------------

    This order is commendable and marks a meaningful step forward in 
our data security enforcement. Naming Drizly's CEO, James Corey Rellas, 
who oversaw these practices, helps ensure that corporate leadership 
must take seriously their obligation to safeguard customer information. 
Mechanisms like the proposed data retention schedule are also an 
excellent approach to provide accountability for data use and misuse. 
Ensuring that Drizly only collects information necessary to effectuate 
its published business needs should exert a disciplining influence on 
its collection of consumer information. The retention schedule also 
provides a clear hook for future FTC enforcement actions should Drizly 
not follow its strict requirements under this proposed order.
    Going forward, I believe the law would support us doing more to 
safeguard Americans' data, including requiring substantive limits on

[[Page 65770]]

appropriate collection and use. While the disclosure requirements in 
this order have value, disclosure alone is not enough. We know that 
endless terms-of-service and other disclosures have not improved 
customer understanding, facilitated meaningful choice, or protected 
data from security breaches. But hackers cannot steal data that 
companies did not collect in the first place; requirements that limit 
what data can be collected, used, and retained could meaningfully foil 
and deter data security breaches.
    There are many ways to approach data collection guardrails. As the 
FTC further develops a minimization framework, one framework I hope we 
consider is centering a consumer's reasonable expectation that there 
should be limits on the collection and use of their information based 
on the service they've actually requested. I believe the agency is in a 
better position to effectuate this expectation than it is to 
anticipate, understand, and police every claim of reasonable business 
necessity. A consumer centered data minimization standard could work 
hand-in-hand with the kinds of disclosures and effective data security 
practices in this proposed order to protect Americans from the ongoing 
epidemic of data breaches, which are greatly exacerbated by 
overcollection of consumer information.
    I am grateful to the staff for their hard work on this strong 
order. I look forward to seeing how our work continues to evolve in the 
pursuit of protecting Americans' data and ensuring our confidence in 
the practices of the businesses with which we all transact.

Concurring and Dissenting Statement of Commissioner Christine S. Wilson

    Today the Commission announces a complaint and settlement resolving 
allegations that Drizly, LLC and its CEO, James Cory Rellas, violated 
Section 5 of the FTC Act. The complaint asserts that Drizly made false 
statements on its website and in its mobile apps about its information 
security practices. The Commission also alleges that Drizly engaged in 
several unreasonable data security practices that led to multiple 
security breaches, including a hacker's unauthorized download of 
personal information about 2.5 million consumers.
    The FTC has long provided clear guidance to the business community 
about the fundamentals of sound data security.\1\ But, as the complaint 
details, Drizly failed to develop any written information security 
standards, policies, or procedures; failed to require unique and 
complex passwords or multifactor authentication to access source code 
or databases; failed to terminate employee or contractor access to data 
once they no longer needed such access; failed to monitor for 
unauthorized attempts to transfer or exfiltrate consumers' personal 
information outside company networks; and engaged in other security 
shortcomings. Notably, simple, readily available, low-cost measures 
could have addressed Drizly's security shortcomings. I support the 
complaint against the company and the order provisions that require 
Drizly to implement numerous data security practices to address the 
company's missing security safeguards.\2\ In particular, my Democratic 
colleagues and I agree that data minimization plays an important role 
in a healthy data security program. As Commissioner Slaughter notes in 
her concurring statement, ``hackers cannot steal data that companies 
did not collect in the first place.''
---------------------------------------------------------------------------

    \1\ Fed. Trade Comm'n, Start with Security: A Guide for Business 
(Jun. 2015), https://www.ftc.gov/tips-advice/business-center/guidance/start-security-guide-business; Press Release, Fed. Trade 
Comm'n, Stick with Security: FTC to Provide Additional Insights on 
Reasonable Data Security Practices (July 21, 2017), https://www.ftc.gov/news-events/press-releases/2017/07/sticksecurity-ftc-provide-additional-insights-reasonable-data.
    \2\ While I support the settlement against Drizly, I continue to 
question whether data security orders should remain in effect for 20 
years. It is not realistic for the Commission to expect that 
injunctive relief with respect to this dynamic and rapidly evolving 
issue will remain relevant and beneficial to consumers for 20 years. 
See Concurring Statement of Commissioner Christine S. Wilson, In the 
Matter of InfoTrax Systems, L.C. and Mark Rawlins, File No. 1623130 
(Nov. 19, 2020), https://www.ftc.gov/system/files/documents/public_statements/1553676/162_3130_infotrax_concurring_statement_cw_11-12-2019.pdf.
---------------------------------------------------------------------------

    While I support the complaint against the corporate defendant, I do 
not support holding the individual defendant, Rellas, liable. To seek 
injunctive relief with respect to a CEO or other principal, the 
Commission must show only that the individual ``participated directly 
in the deceptive practices or had authority to control those 
practices.'' \3\ Authority to control does not require the FTC to show 
a ``specific link from [the individual] to the particular deceptive 
[acts] and instead looks at whether [the individual] had authority to 
control the corporate entity's practices.'' \4\ This broad standard 
effectively could enable the Commission to hold individually liable the 
CEOs of most companies against which we initiate enforcement action.
---------------------------------------------------------------------------

    \3\ FTC v. Ross, 743 F.3d 886, 892-93 (4th Cir. 2014) (adopting 
the test for individual liability used by other federal appellate 
courts, including the First, Seventh, Ninth, Tenth, and Eleventh 
Circuits). The Commission also can establish liability for monetary 
relief by showing the defendant ``had actual knowledge of the 
deceptive conduct, was recklessly indifferent to its deceptiveness, 
or had an awareness of a high probability of deceptiveness and 
intentionally avoided learning the truth.'' Id.
    \4\ Id. at 893.
---------------------------------------------------------------------------

    The Commission traditionally has exercised its prosecutorial 
discretion and assessed a variety of factors when deciding whether to 
name a CEO or principal, including consideration of whether individual 
liability is necessary to obtain effective relief, and the level of the 
individual's knowledge and participation in the alleged illegal 
conduct.\5\
---------------------------------------------------------------------------

    \5\ Many FTC cases involve fraudulent or deceptive conduct by 
small, closely held companies that essentially serve as the alter 
egos of their principal or CEO. I support naming the CEO in such a 
case because the individual defendant is necessary to obtain 
effective relief and/or to prevent the fraudster from opening and 
shuttering companies to stay one step ahead of law enforcement. See 
Concurring Statement of Commissioner Christine S. Wilson Regarding 
FTC v. Progressive Leasing, LLC, File No. 1823127 (April 20, 2020), 
https://www.ftc.gov/system/files/documents/public_statements/1571921/182_3127_prog_leasing_-_statement_of_commissioner_christine_s_wilson_0.pdf.
---------------------------------------------------------------------------

    The order against Drizly requires the company to implement 
extensive data security safeguards regardless of whether Rellas is at 
the helm of the organization. Naming Rellas does not change the 
injunctive obligations placed on the company to ensure that customers' 
personal information is protected going forward. Moreover, the case 
against Drizly makes clear that the FTC expects technology start-ups to 
start with security and establish reasonable data security practices 
that grow with the company.
    As for knowledge and participation, the number of issues crossing a 
CEO's desk on any given day is substantial. In most large companies, I 
would expect CEOs to have little to no involvement with, and no direct 
knowledge of, practices that are the subject of an FTC investigation. 
Here, we do not allege that Rellas oversaw day-to-day operations of the 
company's data security practices, had any data security expertise, or 
was responsible for decisions about data security policies, procedures, 
or programs.\6\ Instead, we allege that Rellas did not appropriately

[[Page 65771]]

prioritize hiring a senior executive responsible for privacy and data 
security. Our complaint notes that he hired other members of the c-
suite but not a Chief Technology Officer or Chief Information Security 
Officer. And for Rellas' failure to prioritize information security 
over other business obligations, the order imposes on Rellas 
significant compliance obligations even if he leaves Drizly.\7\
---------------------------------------------------------------------------

    \6\ Cf Complaint, In re InfoTrax Systems, L.C., a limited 
liability company, and Mark Rawlins, Docket No. C-4696 (Dec. 30, 
2019) (alleging Rawlins spent eighteen years at a software company, 
studied computer science in college, ``reviewed and approved 
InfoTrax's information technology security policies, was involved in 
discussions with clients about data security regularly, and was 
involved in the company's long-term data security strategy.''), 
https://www.ftc.gov/system/files/documents/cases/c-4696_162_3130_infotrax_complaint_clean.pdf.
    \7\ The Order binds Rellas to implement an information security 
program at any future company in which he is a majority owner, CEO, 
or senior officer with information security responsibilities, where 
that company collects personal information from at least 25,000 
individuals. The Order does not address scenarios in which Boards of 
Directors, other owners, or higher-ranking executives make it 
impossible for Rellas to fulfill his obligations.
---------------------------------------------------------------------------

    By naming Rellas, the Commission has not put the market on notice 
that the FTC will use its resources to target lax data security 
practices. Instead, it has signaled that the agency will substitute its 
own judgement about corporate priorities and governance decisions for 
those of companies.\8\ There is no doubt that robust data security is 
important. Having a federal data security law would signal to 
companies, executives, and boards of directors the importance of 
implementing and maintaining data security programs that address 
potential risks, taking into account the size of the business and the 
nature of the data at issue. But CEOs have hundreds of issues and 
numerous regulatory obligations to navigate. Companies, not federal 
regulators, are better positioned to evaluate what risks require the 
regular attention of a CEO. And when companies err in making those 
assessments, the government will hold them accountable.
---------------------------------------------------------------------------

    \8\ Then-Commissioner Phillips and I raised similar concerns in 
our dissents to the FTC's regulatory reviews of the Safeguards Rule. 
See Joint Statement of Commissioners Noah Joshua Phillips and 
Christine S. Wilson, In the Matter of the Final Rule amending the 
Gramm-Leach-Bliley Act's Safeguards Rule, File No. P145407 (Oct. 27, 
2021), https://www.ftc.gov/system/files/documents/public_statements/1597994/joint_statement_of_commissioners_phillips_and_wilson_in_the_matter_of_regulatory_review_of_the_1.pdf; Dissenting Statement of 
Commissioner Noah Joshua Phillips and Commissioner Christine S. 
Wilson, Regulatory Review of Safeguards Rule, File No. P145407 (Mar. 
5, 2019), https://www.ftc.gov/system/files/documents/public_statements/1466705/reg_review_of_safeguards_rule_cmr_phillips_wilson_dissent.pdf.
---------------------------------------------------------------------------

    Accordingly, I dissent from the inclusion of the individual 
defendant in the complaint and settlement in this matter.

[FR Doc. 2022-23669 Filed 10-31-22; 8:45 am]
BILLING CODE 6750-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.