Statement of Chairman Robert Pitofsky and Commissioner
Mozelle Thompson We are writing to address the concerns raised by Commissioner Swindle, in his statement concurring in part and dissenting in part, that certain relief in the negotiated Consent Agreements is inappropriate. While we appreciate our colleague's views, we think the injunctive relief is reasonably related to the conduct challenged in the Complaint. Commissioner Swindle dissents as to Parts III, IV, and V of the orders, which impose various requirements to protect consumers' privacy such as posting a privacy policy, not disclosing personal information to third parties absent a consumer's express authorization, and taking steps to enable consumers to access and review information collected from them. This relief relates to defendants' misrepresentation that information collected would be used only for medical consultations and billing. Instead, as alleged, the personal information was used to develop a target marketing list and defendants intended to disclose it to third parties to bill consumers as part of a Y2K remediation scam. We disagree with our colleague that the scope of the injunctive relief is unwarranted because the complaint does not allege that an actual transfer of personal information to a third party occurred. Certainly, the egregiousness of the alleged behavior would be more severe if a third-party disclosure had occurred. But, we do not think this missing piece means there was no likely injury to consumers' privacy interests.(1) The receipt of an unsolicited e-mail indicating consumers' personal information (presumably at a minimum their name, credit card number and existence of a relationship with an online pharmacy) had been disclosed to a third party, in contravention of a prior express representation that no such disclosure would occur, within the context of an alleged Y2K billing scam, raises significant concerns about the misuse of personal information. Further, these concerns are significantly heightened where medical and financial information is implicated. Thus, while we agree with our colleague that not every case challenging false claims about how personal information is used necessitates the injunctive requirements to protect privacy included here, we think these are reasonably related to the alleged misconduct. 1. Also, it is worth emphasizing that the other misrepresentations allegedly made by defendants -- that consumers are served by a clinic with physicians and an on-site pharmacy and that the information consumers provide is encrypted and secure -- are quite serious. In future circumstances where significant health issues may arise, additional injunctive relief such as a notification to past customers might be appropriate. |