FTC Finalizes Settlements on Privacy Shield With 5 Companies

The FTC unanimously finalized settlements with five companies over allegations they falsely claimed certification under the EU-U.S. Privacy Shield framework (see 1909030063), the agency said Thursday. The FTC alleged DCR Workforce, Thru, LotaData and 214 Technologies didn’t have PS certification, as claimed. It alleged LotaData falsely claimed Swiss-U.S. PS certification. EmpiriStat allowed its certification to lapse, failed to verify annually that statements about its PS practices were accurate, and didn’t affirm it would continue to apply PS protections to personal information collected while participating in the program, the commission alleged. “All five companies are prohibited from misrepresenting their participation in the EU-U.S. Privacy Shield framework, any other privacy or data security program sponsored by the government, or any self-regulatory or standard-setting organization,” the FTC said. EmpiriStat must apply protections to personal information it collected while participating in the program, or return or delete the information.