Sears Settles with FTC on Information Tracking

By Mehmet Munur

FTC entered into a settlement agreement with Sears in June related to its failure to provide adequate notice to its customers during the sign up process for an information collection software. This settlement highlights the need to create accurate highlight notices for privacy policies.

Sears invited customers visiting the Sears.com website and kmart.com websites to join the My SHC Community. Sears paid the customers $10 to sign up to participate in the community. Customers downloaded and installed a “research” software for participating in the community after being presented with the privacy policy and a license agreement.

Sears mentioned on its marketing material that the software would confidentially track online browsing. However, the FTC charged that the software allowed Sears to monitor consumer’s online sessions including shopping carts, online bank statements, drug prescription records, video rental records, library borrowing histories, and the sender, recipient, subject, and size for web-based e-mails. FTC appears to be concerned that Sears’ “Privacy Statement and User License Agreement” did not discuss the full scale of the data mining until the 75th line of the agreement. The agreement stated:

Once you install our application, it monitors all of the Internet behavior that occurs on the computer on which you install the application, including both your normal web browsing and the activity that you undertake during secure sessions, such as filling a shopping basket, completing an application form or checking your online accounts, which may include personal financial or health information.

Therefore, the FTC argued, burying the scope of this information collection activity in the 75th line of legal agreement did not adequately disclose the fact that the consumer was allowing the tracking for all of his internet activity. This, the FTC concluded, was a deceptive practice under section 5 of the FTC act.

In hindsight, Sears probably did not need all of the data that it gather in the first place. The competitive advantage that Sears may gain in collecting and processing such sensitive financial and health data is likely to be outweighed by the disadvantages in maintaining the confidentiality of such sensitive information and the public relations problems that follow its disclosure. Even if Sears could in fact use this data, installation of software that practically works like a commercial key logger likely requires specific and unambiguous consent.

In light of the Sears settlement, corporations should consider building several layers of privacy policies. Article 29 Working Party and the UK ICO have proposed simplifying privacy policies to provide better notice to data subjects. Such a scheme would require that corporations build and use highlights notices that provide a summary of privacy notices that then provides links to the full privacy policy.

In fact, some corporations, such as Google and Microsoft, have started using the A29WP approach in their privacy policies. Note that the users would still be bound to the full privacy policy with such an approach. Therefore, this highlights notice makes privacy policies easy to understand for consumers while maintaining the detailed approach of a privacy policy. Possibly, Sears could have used such a privacy policy on its website and more accurately described its information collection.

Read More...

New York's consumer protections for Internet purchases

Last Month, the Governor of New York signed into law Senate Bill 4964. The bill was introduced by Senator Fuschillo at the request of Attorney General Andrew Cuomo. The AG requested the bill because of the consumer complaints the office received regarding failure to deliver goods ordered online or other improper conduct related to online purchases.

The law amends Section 396-m of the General Business law to provide Internet consumers the same level of protection as consumers who make purchases over the phone or mail.

Thus, with the new law in place, consumers who make purchases over the Internet or e-mail have the following protections:

• Orders cannot be accepted for merchandise which cannot be reasonably anticipated to be shipped within 30 days.
• All advertising and promotional materials must prominently feature: the legal name of the company, complete street address and details about what conditions in which a refund will be issued.
• If products fail to ship within 30 days, the company must clearly provide the buyer with the opportunity to cancel the order and receive a refund or receive substitute merchandise.
• Companies must maintain records of all complaints of failure to ship merchandise or provide advertised services.

Online businesses that sell to New York consumers should be aware of these new requirements. Paragraph 4 of Section 396-m of the General Business law provides:

Whenever there shall be a violation of this section, an application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violations; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding the court may make allowances to the attorney general as provided in section eighty-three hundred three, subdivision six of the civil practice law and rules, and direct restitution. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules.

===

Text of Senate Bill 4964

Introduced by Sen. FUSCHILLO -- (at request of the Attorney General) -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection

AN ACT to amend the general business law, in relation to mail-order and telephone-order merchandise

THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM- BLY, DO ENACT AS FOLLOWS:

Section 1. Paragraphs a and e of subdivision 2 and paragraph b of subdivision 3 of section 396-m of the general business law, as amended by chapter 802 of the laws of 1984, are amended to read as follows:

a. "mail-order business" shall mean a business which is engaged in the solicitation of orders by advertisement or otherwise for merchandise or services connected with merchandise to be shipped to the customer through the mail or by other carrier, upon receipt of an order with payment or with charge account authorization remitted through the mail, ELECTRONIC MAIL OR THE INTERNET or by telephone and the merchandise by its nature is ready for use or consumption when advertised or offered for sale and can be held in stock.

e. "accepts orders" shall mean, in the case of a mail order, receipt of an order with payment or with charge account authorization remitted through the mail, ELECTRONIC MAIL OR THE INTERNET, and, in the case of a telephone order, receipt of an order with charge account authorization 16 and debiting the buyer`s account.

b. accept orders for merchandise which is not reasonably anticipated to be available for shipment within thirty days from the date of receipt 19 of the order together with payment or with charge account authorization in the case of an order remitted through the mail, ELECTRONIC MAIL OR THE INTERNET or within thirty days from the date the seller debits the 22 buyer`s account in the case of an order placed by telephone.

S 2. This act shall take effect immediately.

Read More...