Privacy & Information Security Law Blog

On July 2, 2019, the Federal Trade Commission announced a case involving the operator of an online rewards website who allegedly failed to take reasonable steps to secure consumers’ personal data.

According to the FTC, James V. Grago, Jr., the operator of the website ClixSense, deceived consumers by falsely claiming that the website “utilizes the latest security and encryption techniques to ensure the security of your account information.” In fact, the FTC stated, “ClixSense engaged in unreasonable security practices and failed to implement minimal data security measures to secure the personal data it collected, such as Social Security numbers and dates of birth.”

Under the terms of the settlement with the FTC, Grago is barred from misrepresenting how any company he controls protects personal information. He must also implement and annually certify a comprehensive data security program, verified by outside monitoring.