|
Jon,
Regarding your press release yesterday on "widespread data breaches" by private firms, I am curious as to the FTC's policies with respect to the personal data collected by your own employees. For example, I reported last year that the FTC illegally published the private financial data of a North Carolina couple, William and Doris Isely. You may recall approving an administrative complaint against Mr. Isely that your own chief administrative law judge dismissed as baseless.
After exposing the incompetence of your staff, Mr. Isely filed a motion to recover his attorney's fees and other costs incurred due to your agency's misconduct. As my article explained, I discovered that the FTC secretary's office posted the entire motion, unredacted, on the FTC's website. This included a lengthy statement of the Isely's assets and financial records -- the very type of information you have criticized the private sector for not protecting.
When I contacted [FTC Secretary] Don Clark about this, he disclaimed any responsibility, citing the duty of Mr. Isely's attorney to mark certain documents "confidential." Now, we both know the FTC would never tolerate such an excuse from a private firm. Indeed, you've brought actions against a number of companies for failing to have proper procedures in place to secure private information -- as well as training all employees in such procedures.
So my question to you is two-fold: First, what procedures does the FTC have in place to ensure what happened to the Iselys doesn't happen again? And second, what actions, if any, were taken to discipline Don Clark and his staff following the illegal disclosure of the Iselys' personal information?
Skip Oliva
(Sent to FTC Chairman Jon Leibowitz --
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
-- on February 23, 2010.)
Update, 2/24: An FTC employee left a voicemail this afternoon regarding the above email. He said, "It's a legitimate question," but he did not elaborate further.
|
