Byte - US Prosecution for false web claim of Safe Harbor status (11 September 2009)
Californian Internet retailer Balls of Kryptonite has become the first company to be charged by the US Federal Trade Commission (FTC) for falsely claiming compliance with the US Safe Harbor Privacy Principles. The charge is one of several levelled in an FTC complaint against Balls of Kryptonite.
The FTC claims that Balls of Kryptonite, through its trading names Best Priced Brands and Bite Size Deals, falsely represented that they had self-certified their compliance with the Safe Harbor to the Department of Commerce. The FTC complaint claims that this constitutes a deceptive act or practice, in violation of the Federal Trade Commission Act (15 U.S.C. § 45(a)).
The FTC complaint also claims that Balls of Kryptonite had led consumers to believe it was located in the UK. The websites for Best Priced Brands and Bite Size Deals used .uk domains, listed prices in pounds, referred to the Royal Mail, gave no indication that typical duties and taxes for shipments from outside the UK would apply, and gave no clear US contact details, in some case providing a UK address.
A temporary restraining order preventing Balls of Kryptonite from continuing the activities listed in the complaint was issued by the US District Court for the Central District of California on 31 July 2009.
The Safe Harbor Privacy Principles were developed to allow the export of personal information from the EU to the US, in the absence of any US laws meeting the EU ‘adequacy’ requirement of the EU Data Protection Directive 95/46/EC. The Safe Harbor is a voluntary arrangement; organisations wishing to receive personal information from the EU must self-certify to the Department of Commerce that they comply with the Principles. A 2008 study by Galexia found over 200 organisations which claimed to have self-certified were in fact not members of the Safe Harbor. At present, no law expressly prohibits falsely claiming membership of the Safe Harbor; any prosecution must rely on more general prohibitions against, for instance, deceptive or misleading conduct.
- The US Safe Harbor Privacy Principles (external link) »
- The FTC Action entry for the Balls of Kryptonite complaint (external link) »