FTC Settles with TJX Over Data Breach

Under the Federal Trade Commission Act, the US Federal Trade Commission (FTC) is concerned with practices which affect commerce generally. In particular, the FTC oversees consumer protection and the prevention of unfair business practices including consumer privacy, credit reporting, identity theft, and information security. E-TIPS® previously reported on the security breach of personal information held by TJX Companies Inc (TJX) in 2007, which operates Winners and Home Sense stores in Canada (see ETIPS®, "CIPPIC Urges Canadian Privacy Commissioner to Investigate Customer Data Security Breach by Winners" Vol 5, No 15, January 31, 2007 and ETIPS®, "Federal Privacy Commissioner Reports on TJX Data Breach as its Extent Grows" Vol 6, No 10, November 7, 2007). After the TJX data breach, the FTC investigated TJX, alleging that it failed to use reasonable security measures to adequately safeguard personal information contained on its computer systems from unauthorized access, which was an unfair practice affecting commerce. The FTC has reached a settlement with TJX which requires TJX to implement and maintain a comprehensive security program and obtain independent third-party audits on its security program every other year for the next 20 years. The settlement is available for public comment until April 28, 2008. For the FTC Complaint and Consent Order, visit: http://www.ftc.gov/os/caselist/0723055/index.shtm Summary by: Lauren Lodenquai