Research

[« previous] [next »]

Byte - US Prosecution for false web claim of Safe Harbor status (11 September 2009)

Steven Robertson, Consultant, Galexia

Related Galexia news Galexia presenting at CPDP2017 (The Age of Intelligent Machines) Computers, Privacy & Data Protection 10th International Conference, Brussels - 25 January 2017 » Article in Data Protection Leader - Regulators fight back against privacy fraud - November 2016 » Galexia chapter in 'Enforcing Privacy' book published (Springer) - April 2016 » Galexia article about Implementation of the new EU-US Privacy Shield - 21 March 2016 » Galexia Director speaking at Privacy Law and Business Conference in Cambridge (UK) - 7 July 2015 » Galexia presents on The Future of the EU-US Safe Harbor at Brussels conference - 1 June 2014 » Galexia gives evidence about EU/US Safe Harbor privacy framework to the UK House of Lords - 12 March 2014 » Galexia invited to provide evidence to the European Parliament LIBE Inquiry on Electronic Mass Surveillance of EU Citizens - 7 October 2013 » Galexia presented at the Privacy Laws & Business 23rd Annual International Conference - 14 April 2010 » Galexia interviewed by Privacy Laws and Business International Journal on the US Safe Harbor and recent actions by the FTC - 26 February 2010 » Related Galexia services and solutions Strategic Privacy Consulting. Read more » Specialised Legal and Regulatory Consulting. Read more » Cite as Robertson S, US Prosecution for false web claim of Safe Harbor status, 11 September 2009, <http://www.galexia.com/public/research/articles/research_articles-byte08.html>.

Californian Internet retailer Balls of Kryptonite has become the first company to be charged by the US Federal Trade Commission (FTC) for falsely claiming compliance with the US Safe Harbor Privacy Principles. The charge is one of several levelled in an FTC complaint against Balls of Kryptonite.

The FTC claims that Balls of Kryptonite, through its trading names Best Priced Brands and Bite Size Deals, falsely represented that they had self-certified their compliance with the Safe Harbor to the Department of Commerce. The FTC complaint claims that this constitutes a deceptive act or practice, in violation of the Federal Trade Commission Act (15 U.S.C. § 45(a)).

The FTC complaint also claims that Balls of Kryptonite had led consumers to believe it was located in the UK. The websites for Best Priced Brands and Bite Size Deals used .uk domains, listed prices in pounds, referred to the Royal Mail, gave no indication that typical duties and taxes for shipments from outside the UK would apply, and gave no clear US contact details, in some case providing a UK address.

A temporary restraining order preventing Balls of Kryptonite from continuing the activities listed in the complaint was issued by the US District Court for the Central District of California on 31 July 2009.

The Safe Harbor Privacy Principles were developed to allow the export of personal information from the EU to the US, in the absence of any US laws meeting the EU ‘adequacy’ requirement of the EU Data Protection Directive 95/46/EC. The Safe Harbor is a voluntary arrangement; organisations wishing to receive personal information from the EU must self-certify to the Department of Commerce that they comply with the Principles. A 2008 study by Galexia found over 200 organisations which claimed to have self-certified were in fact not members of the Safe Harbor. At present, no law expressly prohibits falsely claiming membership of the Safe Harbor; any prosecution must rely on more general prohibitions against, for instance, deceptive or misleading conduct.

Related links:

• Galexia’s 2008 study of the Safe Harbor »

External links:

• The US Safe Harbor Privacy Principles (external link) »
• The FTC Action entry for the Balls of Kryptonite complaint (external link) »

[« previous] [next »]

[up to articles, papers, conferences & seminars] [up to research]