Directors Desk LLC

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF DIRECTORS DESK LLC CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5(A) OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4281; File No. 092 3140 Filed, January 12, 2010 CDecision, January 12, 2010 This consent order addresses Directors Desk LLC=s alleged false or misleading representations made to consumers concerning its participation in the Safe Harbor privacy framework agreed upon by the U.S. and the European Union. The Commission=s complaint alleges that Directors Desk falsely represented that it was a current participant in the Safe Harbor when, in fact, from February 2008 until August 2009, Directors Desk was not a current participant in the Safe Harbor. The Commission=s complaint alleges that in February 2007, Directors Desk submitted to Commerce a self-certification, which it did not renew in February 2008. Commerce then updated its status to Anot current@ on the Commerce public website. Directors Desk remained in Anot current@ status until it submitted a self-certification to Commerce in August 2009. The order prohibits Directors Desk from making representations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party. It contains provisions designed to prevent Directors Desk from engaging in the future in practices similar to those alleged in the complaint, as well as reporting and compliance provisions. Participants For the Commission: Molly Crawford and Katie Ratté. For the Respondents: Chris Wolf, Esq., Hogan & Hartson . COMPLAINT The Federal Trade Commission, having reason to believe that Directors Desk LLC (Arespondent”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: VOLUME 149 Complaint 1. Respondent Directors Desk LLC (ADirectors Desk”) is a Delaware limited liability company with its principal office or place of business at 1 Liberty Plaza, New York, New York 10006. 2. Respondent is in the business of providing a secure online application that allows members of corporate boards of directors to access board meeting materials, board minutes, and other related documents through a website (www.directorsdesk.com). 3. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as Acommerce” is defined in Section 4 of the Federal Trade Commission Act. 4. Respondent has set forth on its website, www.directorsdesk.com, privacy policies and statements about its practices, including statements related to its participation in the Safe Harbor privacy framework agreed upon by the U.S. and the European Union (AU.S.-EU Safe Harbor Framework” or ASafe Harbor”).

U.S.-EU SAFE HARBOR FRAMEWORK 5. The U.S.-EU Safe Harbor Framework provides a method for U.S. companies to transfer personal data outside of Europe that is consistent with the requirements of the European Union Directive on Data Protection (ADirective”). Enacted in 1995, the Directive sets forth European Union (AEU”) requirements for privacy and the protection of personal data. Among other things, it requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU, with exceptions, unless the European Commission (AEC@) has made a determination that the recipient jurisdiction=s laws ensure the protection of such personal data. See Directive 95/46/EC of the European Parliament and of the Council (Oct. 24, 1995), available at http://eur-lex.europa.eu/LexUriServ/ LexUriServ.do?uri=CELEX:31995L0046:EN:HTML. This determination is commonly referred to as meeting the EU=s DIRECTORS DESK LLC 231 Complaint Aadequacy” standard.

6. To satisfy the EU adequacy standard for certain commercial transfers, the U.S. Department of Commerce (ACommerce”) and the EC negotiated the U.S.-EU Safe Harbor Framework, which went into effect in 2000. The Safe Harbor allows U.S. companies to transfer personal data lawfully from the EU. To join the Safe Harbor, a company must self-certify to Commerce that it complies with seven principles and related requirements that have been deemed to meet the EU=s adequacy standard.

7. Companies under the jurisdiction of the U.S. Federal Trade Commission (AFTC”), as well as the U.S. Department of Transportation, are eligible to join the Safe Harbor. A company under the FTC=s jurisdiction that self-certifies to the Safe Harbor principles but fails to implement them may be subject to an enforcement action based on the FTC=s deception authority under Section 5 of the Federal Trade Commission Act. 8. Commerce maintains a public website, www.export.gov/safeharbor, where it posts the names of companies that have self-certified to the Safe Harbor. The listing of companies indicates whether their self-certification is Acurrent” or Anot current.” Companies are required to re-certify every year in order to retain their status as Acurrent” members of the Safe Harbor framework. According to the Safe Harbor website, AOrganizations should notify the Department of Commerce if their representation to the Department is no longer valid. Failure to do so could constitute a misrepresentation.@ See Safe Harbor List, available at http://web.ita.doc.gov/safeharbor/shlist.nsf/ webpages/safe+harbor+list.

VIOLATIONS OF SECTION 5 OF THE FTC ACT 9. In February 2007, respondent submitted to Commerce a self-certification to the Safe Harbor. That self-certification stated VOLUME 149 Complaint that its privacy policy has been effective since June 2004. (Exhibit A, Safe Harbor Certification). 10. In February 2008, respondent did not renew its selfcertification to the Safe Harbor, and Commerce updated respondent=s status to Anot current@ on its public website. Until August 2009, respondent did not renew its self-certification to the Safe Harbor and was in Anot current@ status on Commerce=s website. (Exhibit B, Declaration of Damon C. Greer). 11. Respondent has disseminated or caused to be disseminated privacy policies and statements on the www.directorsdesk.com website, including, but not limited to, the following statements: Directors Desk is a participant in the Safe Harbor program developed by the U.S. Department of Commerce and the European Union. We have certified that we adhere to the Safe Harbor Privacy Principles agreed upon by the U.S. and the E.U. For more information about the Safe Harbor and to view our certification, visit the U.S. Department of Commerce=s Safe Harbor web site.

Exhibit C, December 2008 Privacy Policy. 12. Through the means described in Paragraph 11, respondent represented, expressly or by implication, that it is a current participant in the Safe Harbor.

13. In truth and in fact, from February 2008 to August 2009, respondent was not a current participant in the Safe Harbor. Therefore, the representations set forth in Paragraph 11 were, and are, false or misleading.

14. The acts and practices of respondents as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal DIRECTORS DESK LLC 233 Complaint Trade Commission Act.

THEREFORE, the Federal Trade Commission this twelfth day of January, 2010, has issued this complaint against respondent.

By the Commission.

VOLUME 149 Complaint EXHIBIT A

VOLUME 149 Complaint EXHIBIT B

VOLUME 149 Complaint EXHIBIT C

VOLUME 149 Complaint EXHIBIT C (continued)

VOLUME 149 Decision and Order DECISION AND ORDER The Federal Trade Commission, having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft of Complaint which the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued, would charge the Respondent with violation of the Federal Trade Commission Act; and The Respondent and counsel for the Commission having thereafter executed an agreement containing a consent order, an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of the agreement is for settlement purposes only and does not constitute an admission by the Respondent that the law has been violated as alleged in such complaint, or that any of the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission=s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the Respondent has violated the Federal Trade Commission Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, and having duly considered the comment received from an interested person pursuant to Section 2.34 of its Rules, now in further conformity with the procedure prescribed in Section 2.34 of its Rules, 16 C.F.R. ' 2.34, the Commission hereby issues its complaint, makes the following jurisdictional findings, and enters the following order: 1. Respondent Directors Desk LLC is a Delaware limited liability company with its principal office or place of DIRECTORS DESK LLC 243 Decision and Order business at 1 Liberty Plaza, New York, New York 10006.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply:

A. Unless otherwise specified, Arespondent” shall mean Directors Desk LLC and its subsidiaries, divisions, affiliates, successors and assigns.

B. ACommerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. ' 44. I.

IT IS ORDERED that respondent and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, website, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication, the extent to which respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy, security, or any other compliance program sponsored by the government or any other third party.

VOLUME 149 Decision and Order II.

IT IS FURTHER ORDERED that respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of, for a period of five (5) years from the date of preparation or dissemination, whichever is later, all documents relating to compliance with this order, including but not limited to: A. all advertisements, promotional materials, and any other statements containing any representations covered by this order, with all materials relied upon in disseminating the representation; and B. any documents, whether prepared by or on behalf of respondent, that call into question respondent=s compliance with this order.

III.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities relating to the subject matter of this order, and shall secure from each such person a signed and dated statement acknowledging receipt of the order. Respondent shall deliver this order to such current personnel within thirty (30) days after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. IV.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations arising under this order, including, but not limited to: a dissolution, assignment, sale, merger, or other action that would result in the DIRECTORS DESK LLC 245 Decision and Order emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation(s) about which respondent learns fewer than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

V.

IT IS FURTHER ORDERED that respondent shall, within sixty (60) days after service of this order, and at such other times as the Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order.

VI.

This order will terminate on January 12, 2030, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Part in this order that terminates in fewer than twenty (20) years;

B. this order=s application to any respondent that is not named as a defendant in such complaint; and VOLUME 149 Decision and Order C. this order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order as to such respondent will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

DIRECTORS DESK LLC 247 Analysis to Aid Public Comment ANALYSIS OF PROPOSED CONSENT ORDERS TO AID PUBLIC COMMENT The Federal Trade Commission (AFTC” or ACommission”) has accepted, subject to final approval, a consent agreement from Directors Desk LLC (ADirectors Desk”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement=s proposed order. This matter concerns alleged false or misleading representations that Directors Desk made to consumers concerning its participation in the Safe Harbor privacy framework (ASafe Harbor”) agreed upon by the U.S. and the European Union (AEU”). It is among the Commission=s first cases to challenge deceptive claims about the Safe Harbor. The Safe Harbor provides a mechanism for U.S. companies to transfer data outside the EU consistent with European law. To join the Safe Harbor, a company must self-certify to the U.S. Department of Commerce (ACommerce”) that it complies with seven principles and related requirements. Commerce maintains a public website, www.export.gov/safeharbor, where it posts the names of companies that have self-certified to the Safe Harbor. The listing of companies indicates whether their self-certification is Acurrent” or Anot current.” Companies are required to re-certify every year in order to retain their status as Acurrent@ members of the Safe Harbor framework.

Directors Desk provides an online application that allows members of corporate boards of directors to access board meeting materials, board minutes, and other related documents through a website (www.directorsdesk.com). According to the VOLUME 149 Analysis to Aid Public Comment Commission=s complaint, Directors Desk set forth on its website privacy policies and statements about its practices, including statements that it is a current participant in the Safe Harbor. The Commission=s complaint alleges that Directors Desk falsely represented that it was a current participant in the Safe Harbor when, in fact, from February 2008 until August 2009, Directors Desk was not a current participant in the Safe Harbor. The Commission=s complaint alleges that in February 2007, Directors Desk submitted to Commerce a self-certification, which it did not renew in February 2008. Commerce then updated its status to Anot current” on the Commerce public website. Directors Desk remained in Anot current” status until it submitted a selfcertification to Commerce in August 2009. The proposed order applies to Directors Desk=s representations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party. It contains provisions designed to prevent Directors Desk from engaging in the future in practices similar to those alleged in the complaint.

Part I of the proposed order prohibits Directors Desk from making misrepresentations about its membership in any privacy, security, or any other compliance program sponsored by the government or any other third party.

Parts II through VI of the proposed order are reporting and compliance provisions. Part II requires Directors Desk to retain documents relating to its compliance with the order for a five-year period. Part III requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part IV ensures notification to the FTC of changes in corporate status. Part V mandates that Directors Desk submit an initial compliance report to the FTC, and make available to the FTC subsequent reports. Part VI is a provision Asunsetting” the order after twenty (20) years, with certain exceptions.

DIRECTORS DESK LLC 249 Analysis to Aid Public Comment The purpose of the analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way their terms.

VOLUME 149 Complaint