Onyx Graphics, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF ONYX GRAPHICS, INC.

CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4270; File No. 092 3139 Complaint November 9, 2009 - Decision, November 9, 2009 This consent order addresses respondent Onyx Graphics, providers of software and consulting services to businesses with employees residing outside of origin. Respondent manages tax and payroll issues for employees that work outside their country of residence. The complaint alleges the respondent violated Section 5 of the FTC Act by making false and misleading representations concerning Onyx Graphics’ participation in the Safe Harbor privacy framework. Safe Harbor is an international program for international data transfer between the U.S. and the European Union. Respondent advertised an incorrect status as to its compliance with the program. The order prohibits Onyx Graphics from making misrepresentations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party.

Participants For the Commission: Molly Crawford and Katie Ratté For the Respondent: Jeb Hurley, Chief Executive Officer, pro se.

COMPLAINT The Federal Trade Commission, having reason to believe that Onyx Graphics, Inc. (“respondent”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Onyx Graphics, Inc. (“Onyx Graphics”) is a Delaware corporation with its principal office or place of business at 6915 South High Tech Drive, Salt Lake City, Utah 84101. 2. Respondent is in the business of developing and marketing commercial printing software and solutions for the digital color ONYX GRAPHICS, INC. 493 Complaint printing marketplace, including through a website (www.onyx gfx.com).

3. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. 4. Since at least October 2006, respondent has set forth on its website, www.onyxgfx.com, privacy policies and statements about its practices, including statements related to its participation in the Safe Harbor privacy framework agreed upon by the U.S. and the European Union (“U.S.-EU Safe Harbor Framework” or “Safe Harbor”).

U.S.-EU SAFE HARBOR FRAMEWORK 5. The U.S.-EU Safe Harbor Framework provides a method for U.S. companies to transfer personal data outside of Europe that is consistent with the requirements of the European Union Directive on Data Protection (“Directive”). Enacted in 1995, the Directive sets forth European Union (“EU”) requirements for privacy and the protection of personal data. Among other things, it requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU, with exceptions, unless the European Commission (“EC”) has made a determination that the recipient jurisdiction’s laws ensure the protection of such personal data. See Directive 95/46/EC of the European Parliament and of the Council (Oct. 24, 1995), available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do? uri=CELEX:31995L0046:EN:HTML. This determination is commonly referred to as meeting the EU’s “adequacy” standard. 6. To satisfy the EU adequacy standard for certain commercial transfers, the U.S. Department of Commerce (“Commerce”) and the EC negotiated the U.S.-EU Safe Harbor Framework, which went into effect in 2000. The Safe Harbor allows U.S. companies to transfer personal data lawfully from the EU. To join the Safe Harbor, a company must self-certify to Commerce that it complies with seven principles and related requirements that have been deemed to meet the EU’s adequacy standard.

VOLUME 148 Complaint 7. Companies under the jurisdiction of the U.S. Federal Trade Commission (“FTC”), as well as the U.S. Department of Transportation, are eligible to join the Safe Harbor. A company under the FTC’s jurisdiction that self-certifies to the Safe Harbor principles but fails to implement them may be subject to an enforcement action based on the FTC’s deception authority under Section 5 of the Federal Trade Commission Act. 8. Commerce maintains a public website, www.export.gov/ safeharbor, where it posts the names of companies that have selfcertified to the Safe Harbor. The listing of companies indicates whether their self-certification is “current” or “not current.” Companies are required to re-certify every year in order to retain their status as “current” members of the Safe Harbor framework. According to the Safe Harbor website, “Organizations should notify the Department of Commerce if their representation to the Department is no longer valid. Failure to do so could constitute a misrepresentation.” See Safe Harbor List, available at http://web.ita.doc.gov/safeharbor/shlist.nsf/webpages/safe+harbor +list.

VIOLATIONS OF SECTION 5 OF THE FTC ACT 9. In August 2006, respondent submitted to Commerce a self-certification to the Safe Harbor.

10. In August 2007, respondent did not renew its selfcertification to the Safe Harbor, and Commerce updated respondent’s status to “not current” on its public website. Until July 2009, respondent did not renew its self-certification to the Safe Harbor and was in “not current” status on Commerce’s website. (Exhibit A, Declaration of Damon C. Greer). 11. Since at least October 2006 to the present, respondent has disseminated or caused to be disseminated privacy policies and statements on the www.onyxgfx.com website, including, but not limited to, the following statements:

Safe Harbor Certified ONYX is Safe Harber [sic] Certified. For ONYX Safe Harbor Agreement, click here.

ONYX GRAPHICS, INC. 495 Complaint For more information on being Safe Harbor Compliant, click here.

Exhibit B, Privacy Policy.

Onyx has self-certified its privacy practices as consistent with the U.S.-E.U. Safe Harbor principles as published by the US Department of Commerce (the “Principles”). These include: Notice, Choice, Onward Transfer, Access and Accuracy, Security, and Oversight/ Enforcement. More information about the U.S. Department of Commerce Safe Harbor Program can be found at http://www.export .gov/safeharbor/.

Exhibit C, Onyx Safe Harbor Statement.

12. Through the means described in Paragraph 11, respondent represented, expressly or by implication, that it is a current participant in the Safe Harbor.

13. In truth and in fact, from August 2007 to July 2009, respondent was not a current participant in the Safe Harbor. Therefore, the representations set forth in Paragraph 11 were, and are, false or misleading.

14. The acts and practices of respondents as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this ninth day of November, 2009, has issued this complaint against respondent. By the Commission.

VOLUME 148 Complaint Exhibit A

VOLUME 148 Complaint Exhibit B ONYX GRAPHICS, INC.

Complaint Exhibit C Onyx Sale Harbor Statement - Rev C (Final Sep 1 2006-Corrected Aug 3, 2007) Introduction Onyx Graphics, Inc. is strongly committed to protecting the privacy of those who entrust us with their personal information. Ouricustomers and workers have certain expectations and trust in telatlon to the way we protect their personal information. We are pleased to provide you with this information fo inform you of the Onyx’ practices with respect to the collection and use: of personal information received from the European Economic Area (EEA) and the transfer of such information from countries in the EEA to the Uniled States. Onyx has self-cartiied its privacy practices as consistent with U.S-E.U. Safe Harbor principles as published by the US Department of Commerce ithe “Principles"), These include; Notice, Choice, Onward Transfer, Access and Accuracy, Security, and Qversight/Enforcement, More information about the U.S, Department of Commerce Safe Harbor Program can be found at httpsiwww export qoulsafoharbar!, Personal Data This statement applies to all personal information we handle (except a noted below), including on-line, offline, and manually processed data. For purposes of this statement, "personal information” means information that: - §S transferred fram the EU to the United States; - isrecorded in any form:

- fsaboul, or pertains to, a specific individual; and = can be linked to that individual.

It dose not include information that pertains to a specific individual, but from which that individual could not reasonably be identiied. This is known as "aggregate data” and is not tied to a specific individual. Principles Protecting Individuals’ Privacy Notice and Choice In accordance with Safe Harbor principles, we may process personal information in the course of providing professional services to our customers wilhou the knowledge of individuals involved. Where we collect personal information directly from individuals in the E.U.. we inform ther about the types. of personal information we collect from them, the purpeses for which we collect and use it, and the types of nonsacent third parties to which we disclose that information. We also inform these individuals about the chaloes and means, 4 any, we offer individuals for limiting the use or disclosure of their Information. Disclosures and Transfars VOLUME 148 Complaint ONYX will nat disclose an individual's personal intormation to third parties, except when one or mare of the following conditions is tua: - We have the individual's permission to make tha disclosure; ~The disclosure is required by law or professional standards; - The disclosure is reasonably related to the sale or disposition of all or part of our business;

- The information in question is publicly availabe; - The disclosure is reasonably necessary for the establishment or defense of legal claims; or - The disclosure is to another Onyx enlity or to persons or entities providing services on our or the indhviduals behalf (each a “ransferee"), consistent with the purpose for which the information was obtained, if the transfesee, with respect to the information in question;

+ is subject to law providing an adequate level of privacy protection; or, ‘ has agreed in writing to provide an adequate level of privacy protection; ar = — $ubacribes to the Principles, Permitted transfers of information, either io third parties or within Onyx include the transfer of data from one jurisdiction to another, including transters to and @ from the United States of America, Because privacy laws vary from one jurisdiction lo another, personal information may be fransterred to a jurisdiction where the laws provide less or different protection than the jurisdiction in which the information onginated.

Data Security Onyx takes your security seriously and takes reasonable steps to prolect your intormation. Ta prevent unauthorized access or disclosure, maintain data accuracy, and ensure the appropriate use and confidentiality of information, either for ls qwn purposes oF on behalf of our customers, Onyse has put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information wae process. However, we cannot guarantee the security of information on or transmitied via (he Intemet Hate Integnty We process personal information only in ways compatible with the purpose for which itwas collected of subsequently authorized fry Uhe individual, To the extent necessary for such purposes, we take reasonable sleps to make sure that personal information & accurate, complete, current, and otherwise reliable with ragard to its iitended use Access ard Corrector ONYX GRAPHICS, INC.

Complaint fan individual becomes aware that informalon we maintain about that individual is inacturale, or if.an individual would like fo Updale or review his er her information, tive individual may contact us using the contact information belew, We will Jake reasonable steps to permit individuals to correct, amend, or delete information (hat is demonstrated to ba inaccurate, The individual will need to provide sufficient identifying information, such as name, address, birth date, and/or a password. We may raquest additional identifying information as a security precaution. In addition, we may limit or deny access to personal information where providing such access would be unreasonably burdensome or expensive in the ciroumstanocs, or where we are otherwise permitted by the Safe Harber Principles todo so, in some cleumstances, we may charge a reasonable fee, where warranted, for access to personal information. Enforcement and Digoule Resolution Onys utilizes the sel-assessment approach to assure Hs compliance with our privacy slalerment. Onyx periodically verifies that the policy is accurate, comprehensive for the information intanded to be covered, prominently displayed, completely implemented, and in conformity with the Principles. We encourage interested persons (p alse any conperns with us using the contact Information below, We vill Investigate and alternpt to resolve complaints and disputes regarding use and disclosure of personal information in accordance with the principles contained in this policy. With respect fo any complaints relating to this policy that cannot he resolved through our intamal processes, we have agreed to participate in the dispute resolulion procedures of the panel established by the EU data protection authorities to reaclve disputes pursuant to the Safe Harbor Principles. In the even! that we or such authorities determine that we did not comply with this policy, we will take appropriate steps to address any adverse affects and to promote fulure compliance, Privacy Staiament Changes This privacy statement may be changed from time to time, consistent with the requirements of the Safe Harbor. We will post any revised policy an this Web sila, or a similar Web site that replaces (his Web site. information Sulyeet to Other Policies We are committed to following the Principles for all persanal information within the scope of the Safe Harbor Agreement. However, certain information is subject fo policies of the company that may differ in some respects from the general policies set forth in this statement, Information obtained from oF relating lo customers. or formar customers is further subject to the terms of any prvecy notice to the customer, any engagement letier of letiers with the customer, and applicable laws and professional standards.

ONYX GRAPHICS, INC. 503 Decision and Order DECISION AND ORDER The Federal Trade Commission, having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft of Complaint which the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued, would charge the Respondent with violation of the Federal Trade Commission Act; and The Respondent and counsel for the Commission having thereafter executed an agreement containing a consent order, an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of the agreement is for settlement purposes only and does not constitute an admission by the Respondent that the law has been violated as alleged in such complaint, or that any of the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the Respondent has violated the Federal Trade Commission Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, now in further conformity with the procedure prescribed in Section 2.34 of its Rules, 16 C.F.R. § 2.34, the Commissionhereby issues its complaint, makes the following jurisdictional findings, and enters the following order: 1. Respondent Onyx Graphics, Inc. is a Delaware corporation with its principal office or place of business at 6915 High Tech Drive, Salt Lake City, Utah 84047.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the VOLUME 148 Decision and Order Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply:

A. Unless otherwise specified, “respondent” shall mean Onyx Graphics, Inc. and its subsidiaries, divisions, affiliates, successors and assigns.

B. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. I.

IT IS ORDERED that respondent and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, website, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication, the extent to which respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy, security, or any other compliance program sponsored by the government or any other third party.

II.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of, for a period of five (5) years from the date of preparation or dissemination, whichever is later, all documents relating to compliance with this order, including but not limited to: A. all advertisements, promotional materials, and any other statements containing any representations ONYX GRAPHICS, INC. 505 Decision and Order covered by this order, with all materials relied upon in disseminating the representation; and B. any documents, whether prepared by or on behalf of respondent, that calls into question respondent’s compliance with this order.

III.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities relating to the subject matter of this order, and shall secure from each such person a signed and dated statement acknowledging receipt of the order. Respondent shall deliver this order to such current personnel within thirty (30) days after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. IV.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations arising under this order, including, but not limited to: a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation(s) about which respondent learns fewer than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VOLUME 148 Decision and Order V.

IT IS FURTHER ORDERED that respondent shall, within sixty (60) days after service of this order, and at such other times as the Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order.

VI.

This order will terminate on November 9, 2029, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order’s application to any respondent that is not named as a defendant in such complaint; and C. this order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order as to such respondent will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

ONYX GRAPHICS, INC. 507 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (“FTC” or “Commission”) has accepted, subject to final approval, a consent agreement from Onyx Graphics, Inc. (“Onyx Graphics”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. This matter concerns alleged false or misleading representations that Onyx Graphics made to consumers concerning its participation in the Safe Harbor privacy framework (“Safe Harbor”) agreed upon by the U.S. and the European Union (“EU”). It is among the Commission’s first cases to challenge deceptive claims about the Safe Harbor. The Safe Harbor provides a mechanism for U.S. companies to transfer data outside the EU consistent with European law. To join the Safe Harbor, a company must self-certify to the U.S. Department of Commerce (“Commerce”) that it complies with seven principles and related requirements. Commerce maintains a public website, www.export.gov/safeharbor, where it posts the names of companies that have self-certified to the Safe Harbor. The listing of companies indicates whether their self-certification is “current” or “not current.” Companies are required to re-certify every year in order to retain their status as “current” members of the Safe Harbor framework.

Onyx Graphics develops and markets commercial printing software and solutions for the digital color printing marketplace, including through a website (www.onyxgfx.com). According to the Commission’s complaint, since at least October 2006, Onyx Graphics has set forth on its website privacy policies and statements about its practices, including statements that it is a current participant in the Safe Harbor.

VOLUME 148 Analysis to Aid Public Comment The Commission’s complaint alleges that Onyx Graphics falsely represented that it was a current participant in the Safe Harbor when, in fact, from August 2007 until July 2009, Onyx Graphics was not a current participant in the Safe Harbor. The Commission’s complaint alleges that in August 2006, Onyx Graphics submitted a self-certification to Commerce, which it did not renew in August 2007. Commerce then updated the company’s status to “not current” on the Commerce public website. Onyx Graphics remained in “not current” status until it submitted a self-certification to Commerce in July 2009. The proposed order applies to Onyx Graphics’s representations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party. It contains provisions designed to prevent Onyx Graphics from engaging in the future in practices similar to those alleged in the complaint.

Part I of the proposed order prohibits Onyx Graphics from making misrepresentations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party.

Parts II through VI of the proposed order are reporting and compliance provisions. Part II requires Onyx Graphics to retain documents relating to its compliance with the order for a five-year period. Part III requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part IV ensures notification to the FTC of changes in corporate status. Part V mandates that Onyx Graphics submit an initial compliance report to the FTC, and make available to the FTC subsequent reports. Part VI is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

The purpose of the analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way their terms.

PROGRESSIVE GAITWAYS LLC 509 Complaint