Consumer Law

Apparel retailers Life Is Good, Inc. and Life is Good Retail, Inc. settled Federal Trade Commission (FTC) charges that they misrepresented their security and privacy policies.  According to the FTC, the claims that the retailers were "committed to maintaining" customer privacy and "all information is kept in a secure file" were deceptive because credit card information was stored in unencrypted text files and the Life Is Good web site was vulnerable to SQL injection attacks. This allowed a hacker to access the credit card numbers, expiration dates, and security codes of thousands of consumers.  The FTC has warned retailers about unencrypted data and SQL attacks since at least 2004, when it brought an action against Petco Animal Supplies, Inc. after a hacker used that method to access unencrypted customer credit card data.  In fact, the FTC could have used a "find and replace" on the Petco complaint to draft the Life is Good complaint. 

Companies that collect consumer information should constantly ask themselves the following questions.  Is it necessary to collect the data in the first place? How will the data be secured? How long does the data need to be kept?  How will the data be securely destroyed when no longer needed?  How should the system be monitored for vulnerabilities and breaches? How can the system for collecting, storing, and disposing data be improved?  Failing to think through these issues can lead to an enforcement action and customer anger.