Expatedge Partners, LLC

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF EXPATEDGE PARTNERS, LLC CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4269; File No. 092 3138 Complaint, November 9, 2009 - Decision, November 9, 2009 This consent order addresses respondent Expatedge Partners, LLC, providers of software and consulting services to businesses with employees residing outside of origin. Respondent manages tax and payroll issues for employees that work outside their country of residence. The complaint alleges the respondent violated Section 5 of the FTC Act by making false and misleading representations concerning Expatedge Partners’s participation in the Safe Harbor privacy framework. Safe Harbor is an international program for international data transfer between the U.S. and the European Union. Respondent advertised an incorrect status as to its compliance with the program. The order prohibits Expatedge from making misrepresentations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party. Participants For the Commission: Molly Crawford and Katie Ratté. For the Respondent: David S. Kolb, President, pro se. COMPLAINT 1. The Federal Trade Commission, having reason to believe that Expatedge Partners, LLC (“respondent”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Expatedge Partners, LLC (“Expatedge”) is a Minnesota limited liability corporation with its principal office or place of business at 750 Boone Avenue North, Suite 102, Minneapolis, Minnesota 55427. 2. Respondent is in the business of providing software and consulting services to businesses that offer “expatriate” programs to manage tax and payroll issues for EXPATEDGE PARTNERS, LLC 461 Decision and Order employees that work outside their country of residence, including through a website (www.expatedge.com). 3. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act.

4. Since at least December 2002, respondent has set forth on its website, www.expatedge.com, privacy policies and statements about its practices, including statements related to its participation in the Safe Harbor privacy framework agreed upon by the U.S. and the European Union (“U.S.-EU Safe Harbor Framework” or “Safe Harbor”).

U.S.-EU SAFE HARBOR FRAMEWORK 5. The U.S.-EU Safe Harbor Framework provides a method for U.S. companies to transfer personal data outside of Europe that is consistent with the requirements of the European Union Directive on Data Protection (“Directive”). Enacted in 1995, the Directive sets forth European Union (“EU”) requirements for privacy and the protection of personal data. Among other things, it requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU, with exceptions, unless the European Commission (“EC”) has made a determination that the recipient jurisdiction’s laws ensure the protection of such personal data. See Directive 95/46/EC of the European Parliament and of the Council (Oct. 24, 1995), available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=C EL EX:31995L0046:EN:HTML. This determination is commonly referred to as meeting the EU’s “adequacy” standard.

6. To satisfy the EU adequacy standard for certain commercial transfers, the U.S. Department of Commerce (“Commerce”) and the EC negotiated the U.S.-EU Safe Harbor Framework, which went into effect in 2000. The Safe Harbor allows U.S. companies to transfer personal VOLUME 148 Complaint data lawfully from the EU. To join the Safe Harbor, a company must self-certify to Commerce that it complies with seven principles and related requirements that have been deemed to meet the EU’s adequacy standard. 7. Companies under the jurisdiction of the U.S. Federal Trade Commission (“FTC”), as well as the U.S. Department of Transportation, are eligible to join the Safe Harbor. A company under the FTC’s jurisdiction that selfcertifies to the Safe Harbor principles but fails to implement them may be subject to an enforcement action based on the FTC’s deception authority under Section 5 of the Federal Trade Commission Act.

8. Commerce maintains a public website, www.export.gov/safeharbor, where it posts the names of companies that have self-certified to the Safe Harbor. The listing of companies indicates whether their selfcertification is “current” or “not current.” Companies are required to re-certify every year in order to retain their status as “current” members of the Safe Harbor framework. According to the Safe Harbor website, “Organizations should notify the Department of Commerce if their representation to the Department is no longer valid. Failure to do so could constitute a misrepresentation.” See Safe Harbor List, available at http://web.ita.doc.gov/safeharbor/shlist.nsf/web Pages/safe+harbor+list.

VIOLATIONS OF SECTION 5 OF THE FTC ACT 9. In November 2002, respondent submitted to Commerce a self-certification to the Safe Harbor, which it renewed in November 2003, November 2004, and November 2005.

10. In November 2006, respondent did not renew its self-certification to the Safe Harbor, and Commerce updated respondent’s status to “not current” on its public website. To date, respondent has not renewed its selfcertification to the Safe Harbor and remains in “not current” status on Commerce’s website. (Exhibit A, EXPATEDGE PARTNERS, LLC 463 Decision and Order Declaration of Damon C. Greer).

11. From at least December 2002 until July 2009, respondent has disseminated or caused to be disseminated privacy policies and statements on the www.expatedge.com website, including, but not limited to, the following statements:

Expatedge self-certifies the Policy to the U.S. Department of Commerce’s Safe Harbor Privacy Program.

Exhibit B, December 2002 Privacy Policy; Exhibit C, Aug. 2004 Privacy Policy; Exhibit D, Dec. 2007 Privacy Policy; Exhibit E, Apr. 2009 Privacy Policy.

12. Through the means described in Paragraph 11, respondent represented, expressly or by implication, that it is a current participant in the Safe Harbor. 13. In truth and in fact, since November 2006, respondent has not been a current participant in the Safe Harbor. Therefore, the representations set forth in Paragraph 11 were, and are, false or misleading. 14. The acts and practices of respondents as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. THEREFORE, the Federal Trade Commission this ninth day of November, 2009, has issued this complaint against respondent. By the Commission.

VOLUME 148 Complaint Exhibit A EXPATEDGE PARTNERS, LLC 465 Decision and Order VOLUME 148 Complaint Exhibit B EXPATEDGE PARTNERS, LLC 467 Decision and Order VOLUME 148 Complaint EXPATEDGE PARTNERS, LLC 469 Decision and Order VOLUME 148 Complaint ExpatEdye - Privacy Pokey ang Sign up for our free newsletter EXPATEDGE PARTNERS, LLC Decision and Order Exhibit C Page | of 5 Expatedge® Privacy Policy This Expatedge, Inc. (“Expatedge”) Privacy Policy (the “Policy"} was developed as an extension of our commitment to combine the highest-quality products and services with the highest level of integrity in dealing with our valued customers, and the companies, businesses and organizations they represent (collectively, “you").

Expatedge self-certifies the Policy to the U.S, Department of Commerce's Safe Harbor Privacy Principles. If you have any questions about this Policy, wish to amend, delete or add to any of your information contained at the Site, or otherwise wish to contact Expatedge directly, please email us at [email protected] or call us at (650) §25-8161. IF YOU DO NOT AGREE TO THE POLICY, YOU SHOULD NOT USE THIS INTERNET WEBSITE (THE "SITE"). WE MAY MODIFY THE POLICY FROM TIME TO TIME AND POST THOSE MODIFICATIONS OUR CONTINUED USE OF THE SITE AFTER ANY SUCH MODIFICATION CONSTITUTES YOUR ACCEPTANCE OF THE MODIFIED POLICY, 1. Information. €xpatEdge obtains information from and about you in a number of different ways, including: A, General Information. Some information is gathered automatically when you access the Site ("General Information’). This General Information (which includes Site pages visited, type of web browser used, type of operating system, and the domain name of your Internet Service Provider and similar information) does not identify you personally, B. Profile Information. Some information is not gathered automatically, and is instead supphed by you voluntarily when you use or register for certain services at the Site ("Profile Information’). If you wish to provide Profile htinJaueh archive ere/weh/ 200408300 15944/niip://www.expuledge.com/privacy jsp 4/2009 VOLUME 148 Complaint EXPATEDGE PARTNERS, LLC 473 Decision and Order VOLUME 148 Complaint

VOLUME 148 Complaint Exhibit D

Expathage - Privacy Policy r Sign up for our free newsletter http://www expatedge.convpnvacy.jsp EXPATEDGE PARTNERS, LLC Decision and Order Exhibit E Expatedge® Privacy Policy This Expatedge Partners, LLC (“Expatedge”) Privacy Policy (the "Policy") was developed as an extension of our commitment to combine the highest-quality products and services with the highest level of integrity in dealing with our valued customers, and the companies, businesses and organizations they represent (collectively, you"). Expatedge self-certifies the Policy to the U.S. Department of Commerce's Safe Harbor Privacy Principles. If you have any questions about this Policy, wish to amend, delete or add to any of your information contained at the Site, or otherwise wish to contact Expatedge directly, please email us at [email protected] or call us at (650) 566-1580. IF YOU DO NOT AGREE TO THE POLICY, YOU SHOULD_NOT_USE THIS INTERNET WEBSITE (THE ANY SUCH MODIFICATION CONSTITUTES YOUR ACCEPTANCE OF THE MODIFIED POLICY.

1, Information. Expat€dge obtains information from and about you in a number of different ways, including: A. General Information. Some information is gathered automatically when you access the Site ("General Information”). This General Information (which includes Site pages visited, type of web browser used, type of operating system, and the domain name of your Internet Service Provider and similar information} does not identify you personally.

B. Profile Information. Some information is not gathered automatically, and is instead supplied by you voluntarily when you use or register for certain services at the Site (“Profile Information"). If you wish to provide Profile 4/20/2009

VOLUME 148 Decision and Order DECISION AND ORDER The Federal Trade Commission, having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft of Complaint, which the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued, would charge the Respondent with violation of the Federal Trade Commission Act; and The Respondent and counsel for the Commission having thereafter executed an agreement containing a consent order, an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of the agreement is for settlement purposes only and does not constitute an admission by the Respondent that the law has been violated as alleged in such complaint, or that any of the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the Respondent has violated the Federal Trade Commission Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, now in further conformity with the procedure prescribed in Section 2.34 of its Rules, 16 C.F.R. § 2.34, the Commission hereby issues its complaint, makes the following jurisdictional findings, and enters the following order: 1. Respondent Expatedge Partners, LLC is a Minnesota limited liability corporation with its principal office or place of business at 750 Boone Avenue North, Suite 102, Minneapolis, Minnesota 55427.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the EXPATEDGE PARTNERS, LLC 487 Decision and Order Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply:

A. Unless otherwise specified, “respondent” shall mean Expatedge Partners, LLC and its subsidiaries, divisions, affiliates, successors and assigns. B. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. I.

IT IS ORDERED that respondent and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, website, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication, the extent to which respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy, security, or any other compliance program sponsored by the government or any other third party.

II.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of, for a period of five (5) years from the date of preparation or dissemination, whichever is later, all documents relating to compliance with this order, including but not limited to: A. all advertisements, promotional materials, and any other statements containing any representations VOLUME 148 Decision and Order covered by this order, with all materials relied upon in disseminating the representation; and B. any documents, whether prepared by or on behalf of respondent, that call into question respondent’s compliance with this order.

III.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities relating to the subject matter of this order, and shall secure from each such person a signed and dated statement acknowledging receipt of the order. Respondent shall deliver this order to such current personnel within thirty (30) days after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. IV.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations arising under this order, including, but not limited to: a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation(s) about which respondent learns fewer than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

EXPATEDGE PARTNERS, LLC 489 Decision and Order V.

IT IS FURTHER ORDERED that respondent shall, within sixty (60) days after service of this order, and at such other times as the Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order. VI.

This order will terminate on November 9, 2029, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order’s application to any respondent that is not named as a defendant in such complaint; and C. this order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order as to such respondent will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

VOLUME 148 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (“FTC” or “Commission”) has accepted, subject to final approval, a consent agreement from Expatedge Partners LLC (“Expatedge”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. This matter concerns alleged false or misleading representations that Expatedge made to consumers concerning its participation in the Safe Harbor privacy framework (“Safe Harbor”) agreed upon by the U.S. and the European Union (“EU”). It is among the Commission’s first cases to challenge deceptive claims about the Safe Harbor. The Safe Harbor provides a mechanism for U.S. companies to transfer data outside the EU consistent with European law. To join the Safe Harbor, a company must self-certify to the U.S. Department of Commerce (“Commerce”) that it complies with seven principles and related requirements. Commerce maintains a public website, www.export.gov/safeharbor, where it posts the names of companies that have self-certified to the Safe Harbor. The listing of companies indicates whether their self-certification is “current” or “not current.” Companies are required to re-certify every year in order to retain their status as “current” members of the Safe Harbor framework.

Expatedge provides software and consulting services to businesses that offer “expatriate” programs to manage tax and payroll issues for employees that work outside their country of residence, including through a website (www.expatedge.com). According to the Commission’s complaint, from at least December 2002 until July 2009, Expatedge has set forth on its website privacy policies and statements about its practices, including statements that it is a current participant in the Safe Harbor.

EXPATEDGE PARTNERS, LLC 491 Analysis to Aid Public Comment The Commission’s complaint alleges that until July 2009, Expatedge falsely represented that it was a current participant in the Safe Harbor when, in fact, Expatedge has not been a current participant in the Safe Harbor since November 2006. The Commission’s complaint alleges that in November 2002, Expatedge submitted to Commerce a self-certification to the Safe Harbor, which it renewed in November 2003, November 2004, and November 2005. Expatedge did not renew its selfcertification to the Safe Harbor in November 2006, and Commerce updated its status to “not current” on the Commerce public website. To date, Expatedge has not renewed its selfcertification to the Safe Harbor and remains in “not current” status on Commerce’s website.

The proposed order applies to ExpatEdge’s representations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party. It contains provisions designed to prevent Expatedge from engaging in the future in practices similar to those alleged in the complaint.

Part I of the proposed order prohibits Expatedge from making misrepresentations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party.

Parts II through VI of the proposed order are reporting and compliance provisions. Part II requires Expatedge to retain documents relating to its compliance with the order for a five-year period. Part III requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part IV ensures notification to the FTC of changes in corporate status. Part V mandates that Expatedge submit an initial compliance report to the FTC, and make available to the FTC subsequent reports. Part VI is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

The purpose of the analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way their terms.

VOLUME 148 Complaint