InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
FTC says bank impersonation is most-reported text message scam
On June 8, the FTC reported that consumers lost $330 million to text message scams in 2022, which is double the amount reported in 2021. The FTC’s recent Consumer Protection Data Spotlight found that the top five text message scams, accounting for over 40 percent of the 1,000 randomly sampled text frauds in 2022, are often impersonating well-known businesses. The data spotlight names copycat bank fraud prevention alerts, bogus “little gifts,” fake package delivery problems, phony job offers, and fake online-shopping account fraud prevention messages as the top five text message scams. With text message scam open rates at 98 percent and email scam open rates at 20 percent, scammers use the speed and cost effectiveness of text messages to their advantage, the FTC reported.
DFPI highlights CCFPL enforcement actions
On June 8, the Department of Financial Protection and Innovation (DFPI) released its second annual report covering California Consumer Financial Protection Law (CCFPL) actions two years after the statute took effect. DFPI reported growth across rulemaking, enforcement, supervision, complaint handling, stakeholder outreach, and consumer education. It also developed several new department functions to support historically underserved communities.
According to the report, DFPI’s increased visibility in the consumer protection space has generated more consumer complaints, resulting in more enforcement actions. Compared to 2021, there was a 514 percent increase in CCFPL-related complaints (approximately 454 complaints), and an 85 percent increase in CCFPL-related investigations (approximately 196 investigations). Top complaint categories included debt collection and crypto assets, with student loan servicers and credit reporting closely following at third and fourth. To address these issues, DFPI opened 110 crypto-related investigations and launched a consumer alerts page on its website featuring 67 public actions and 65 consumer alerts.
Other key takeaways from the report include that DFPI (i) ordered more than $250,000 in penalties; (ii) ordered over $300,000 in restitution to consumers; (iii) brought its first two civil actions using CCFPL authority; (iv) had 105,000 people attend its outreach and education events; (v) published a notice of proposed rulemaking requiring providers of certain financial services and products to register with the DFPI; and (vi) chaptered two pieces of legislation adding to the laws that DFPI may enforce under the CCFPL.
6th Circuit: Single RVM confers standing
The U.S. Court of Appeals for the Sixth Circuit recently held that receiving one ringless voicemail (RVM) was enough to confer standing upon a plaintiff under the TCPA. In that case, plaintiff asserted he received several RVMs to his cell phone but never consented to receiving the messages. He filed a putative class action suit for violations of the TCPA, alleging the defendant used an automated telephone dialing system (autodialer) to deliver multiple RVMs to his cell phone advertising its services. According to the plaintiff, the RVMs tied up his phone line, cost him money, and invaded his privacy. During discovery, an expert concluded that only one of the 11 voicemails plaintiff claimed to have received was from the defendant. The defendant moved to dismiss, arguing the plaintiff lacked standing because he did not suffer a concrete injury. The district court granted defendant’s motion, ruling that receiving a single RVM did not constitute a concrete harm sufficient for Article III standing, because, among other things, plaintiff could not recall what he was doing when the RVMs were sent, he was not charged for the RVM, the RVM did not tie up his phone line, and he spent a very small amount of time reviewing the message.
On appeal, the 6th Circuit noted that it had not previously considered whether receiving a single RVM for commercial purposes is sufficient to confer standing under the TCPA. To determine whether an intangible harm—such as receiving an unsolicited RVM—rises to the level of concrete injury, the appellate court reviewed U.S. Supreme Court rulings on standing. “[Plaintiff’s] receipt of an unsolicited RVM bears a close relationship to the kind of injury protected by the common law tort of intrusion upon seclusion; and his claimed harm directly correlates with the protections enshrined by Congress in the TCPA,” the 6th Circuit wrote, reversing and remanding the district court’s judgment and stating that “[plaintiff] suffered a concrete injury in fact sufficient for Article III standing purposes.”
Florida enacts privacy legislation; requirements focus on digital industry
On June 6, the Florida governor approved SB 262 to create the Florida Digital Bill of Rights (FDBR) and establish a framework for controlling and processing consumer personal data in the state, applicable only to companies that meet certain criteria and bring in global gross annual revenues of more than $1 billion. Specifically, the FDBR applies to “controllers,” or any person that conducts business in Florida, collects personal data about consumers (or is an entity on behalf of which this information is collected), determines the purposes and means of processing consumers’ personal data (alone or jointly with other entities), meets the revenue minimum, and satisfies at least one of the following criteria: (i) derives at least 50 percent of global gross revenue from the sale of online advertisements (including targeted advertising); (ii) operates a consumer smart speaker and voice command component service; or (iii) operates an app store or a digital distribution platform offering a minimum of 250,000 unique software applications available for download. The FDBR outlines exemptions, including exemptions for financial institutions and data subject to the Gramm-Leach-Bliley Act, as well as certain covered entities governed by the Health Insurance Portability and Accountability Act.
- Consumer rights. Under the FDBR, Florida consumers will have the right to, among other things, (i) confirm whether their personal data is being processed and to access their data; (ii) correct inaccuracies; (iii) delete their data; (iv) obtain a copy of personal data processed by a controller; and (v) opt out of the processing of their data for targeted advertising, the sale of their data, or certain profiling. The FDBR also adds biometric data and geolocation information to the definition of personal information.
- Controllers’ responsibilities. Data controllers under the FDBR will be responsible for, among other things, (i) responding to consumers’ requests within 45 days unless extenuating circumstances arise and providing requested information free of charge, up to twice annually for each consumer; (ii) establishing an appeals process to allow consumer appeals within a reasonable time period after a controller’s refusal to take action on a consumer’s request; (iii) limiting the collection of data to what is required and reasonably necessary for a specified purpose; (iv) securing personal data and implementing appropriate data security protection practices; (v) not processing data in violation of state or federal anti-discrimination laws; (vi) obtaining consumer consent in order to process sensitive data (consent may be revoked at any time); (vii) ensuring contracts and agreements do not waive or limit consumers’ data rights; and (viii) providing clear privacy notices. The FDBR also sets forth obligations relating to contracts between a controller and a processor.
- No private cause of action but enforcement by the Florida Department of Legal Affairs. The FDBR explicitly prohibits a private cause of action. Instead, it grants the department exclusive authority to bring actions under the Florida Deceptive and Unfair Trade Practices Act and seek penalties of up to $50,000 per violation, which may be tripled for any violation involving a child under the age of 18 for which the online platform has actual knowledge. The department is also granted authority to adopt rules to implement the FDBR.
- Right to cure. Upon discovering a potential violation of the FDBR, the department must give the controller written notice. The controller then has 45 days to cure the alleged violation before the department can file suit.
Minor children are also afforded specific protections under the FDBR, including prohibiting online platforms that provide services or features to children from processing children’s personal information or from collecting, selling, sharing, or retaining any personal information that is not necessary to provide an online service, product, or feature. Additionally, the FDBR includes provisions addressing political ideology and government-led censorship.
The FDBR takes effect July 1, 2024.
Florida now joins nine other states in enacting comprehensive consumer privacy measures, following California, Colorado, Connecticut, Virginia, Utah, Iowa, Indiana, Tennessee, and Montana.
FTC seeks to work with states on combatting fraud
On June 7, the FTC announced it is soliciting public comments on how the Commission can work more effectively with state attorneys general to prevent and inform consumers about potential fraud. The FTC said in its announcement that the agency and the AGs share a common mission to protect the public from “deceptive or unfair business practices and from unfair methods of competition through law enforcement, advocacy, research, and education.” The request for public comments comes as a result of the FTC Collaboration Act of 2021 (the “Act”), which requires the Commission to not only solicit public comments, but also to consult directly with interested stakeholders. Signed into law last year, the Act directs the FTC to conduct a study on how to streamline and leverage the relationship between the Commission and the AGs to better protect Americans from fraud and hold those committing malicious acts accountable. The FTC requests comments specifically regarding: (i) the roles and responsibilities of the Commission and AGs that best advance collaboration and consumer protection; (ii) how resources should be dedicated to further such collaboration and consumer protection; and (iii) the accountability mechanisms that should be implemented to promote collaboration and consumer protection between the FTC and AGs.
The completed report will be submitted to the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation. Comments are due 60 days after publication in the Federal Register.
Florida tightens restrictions on phone and text solicitations
On May 25, the Florida governor signed HB 761 (the “Act”) to clarify notice requirements relating to telephone and text message solicitations and to outline conditions under which certain civil actions may be brought. Specifically, the amendments provide that “unsolicited” telephone sales calls involving an automated system used to select and dial numbers or one that plays a recorded message cannot be made without the prior express written consent of the called party. Consent may now be obtained by a consumer “checking a box indicating consent or responding affirmatively to receiving text messages, to an advertising campaign, or to an e-mail solicitation.”
The Act also clarifies that before the commencement of a civil action for damages for text message solicitations, the called party must reply “STOP” to the number that sent the message. The called party may bring an action only if consent is not given and the telephone solicitor continues to send text messages 15 days after being told to cease. The new requirements apply to any suit filed on or after the Act’s immediate effective date, as well as to any putative class action not certified on or before the effective date of the Act. The Act became effective immediately.
FTC, DOJ sue e-commerce company over child data
On May 31, the DOJ filed a complaint on behalf of the FTC against a global e-commerce tech company for allegedly violating the Children’s Online Privacy Protection Act Rule (COPPA) relating to its smart voice assistant’s data collection and retention practices. While the company repeatedly assured users that they could delete collected voice recordings and geolocation information, the complaint alleged that the company held onto some of this information for years to improve its voice assistant’s algorithm, thus putting the data at risk of harm from unnecessary access. Additionally, the complaint also contended that, for a significant period of time, the company continued to retain transcripts for recordings even after the voice recordings were deleted. According to the complaint, the company failed to provide complete, truthful notice to parents about its deletion practices and lacked an effective system to ensure users’ data deletion requests were honored.
The proposed court order would require the company to pay a $25 million civil money penalty and would prohibit the company from using geolocation and voice to create or improve any of its data products after a deletion request. The company would also be required to (i) delete any inactive smart voice assistant children’s accounts; (ii) notify users about its data retention and deletion practices and controls; and (iii) implement a privacy program specific to its use of users’ geolocation information, among other things.
NYDFS calls its virtual currency framework the “gold standard”
On May 25, NYDFS Superintendent Adrienne Harris testified before the New York assembly to address the regulation of virtual currency in the state. Harris highlighted the value and “gold standard” set by NYDFS’s virtual currency regulatory framework. She detailed how novel risks in that landscape were met with subsequential growth of the virtual currency unit since her arrival, including the addition of 50 professionals and a range of seasoned experts to streamline enforcement investigations.
In her testimony, Harris also voiced how the framework responsibly supports innovation for entities engaging primarily in virtual currency activities, leveraging their licensing (BitLicense) and chartering (the limited purpose trust company charter) regimes, whereas other states license virtual currency entities only as money transmitters. Adding on, she specified how NYDFS’s customized approach continues after approval, specifically, “NYDFS creates a detailed supervisory agreement that is tailored to the specific risks presented by the company’s business model. Licensed and chartered entities also are subject to ongoing supervision and are regularly examined for compliance with broadly applicable virtual currency regulations and other rules, as well as with their supervisory agreements.” The development of these tools, among other safeguards, is demonstrative of NYDFS’ focus on addressing the inherently high-risk nature of virtual currency business activity with respect to illicit transactions, she noted.
Harris further clarified that secure, customized regulatory requirements, as outlined in the framework, coupled with transparency, ushers in more business for the state, especially in the case of crypto startups. Further, other regulators, jurisdictions, and economic development agencies are seeking to replicate the framework, Harris commented, as consumer protection is not only achieved as outlined in the law, but by regulators that are able to move at a faster pace than the former.
Texas amends breach notification requirements
On May 27, the Texas governor signed SB 768 to amend the state’s data breach notification statutes. The Act requires entities to notify the attorney general “as soon as practicable” and not later than 30 days after the date a computerized security system breach occurs involving at least 250 Texas residents. The Act now details that notification must be submitted electronically using a form accessible through the attorney general’s website. No substantive changes were made to the required information within the form. The Act is effective September 1.
Montana becomes the ninth state to enact comprehensive privacy legislation
On May 19, the Montana governor signed SB 384 to enact the Consumer Data Privacy Act (CDPA) and establish a framework for controlling and processing consumer personal data in the state. Montana is now the ninth state in the nation to enact comprehensive consumer privacy measures, following California, Colorado, Connecticut, Virginia, Utah, Iowa, Indiana, and Tennessee. The CDPA applies to any person that conducts business in the state or produces products or services targeted to state residents and, during a calendar year, (i) controls or processes personal data of at least 50,000 consumers (“excluding personal data controlled or processed solely for the purpose of completing a payment transaction”), or (ii) controls or processes personal data of at least 25,000 consumers and derives 25 percent of gross revenue from the sale of personal data. The CDPA provides several exemptions, including nonprofit organizations, registered securities associations, financial institutions, data governed by the Gramm-Leach-Bliley Act and certain other federal laws, and covered entities governed by the Health Insurance Portability and Accountability Act. Highlights of the CDPA include:
- Consumers’ rights. Under the CDPA, consumers will be able to access their personal data; correct inaccuracies; request deletion of their data; obtain a copy of their data in a portable format; and opt out of the sale of their data. A consumer may also designate an authorized agent to act on the consumer’s behalf to opt out of the processing of their personal data.
- Data controllers’ responsibilities. Data controllers under the CDPA will be responsible for, among other things, (i) responding to consumer requests within 45 days unless extenuating circumstances arise and providing requested information free of charge, one for each consumer during a 12-month period; (ii) establishing a process to allow consumer appeals within a reasonable time period after a controller’s refusal to take action on a consumer’s request; (iii) establishing clear and conspicuous opt-out methods on a website that require consumers to affirmatively and freely choose to opt out of any processing of their personal data (and allowing for a mechanism that lets consumers revoke consent that is at least as easy as the mechanism used to provide consent); (iv) limiting the collection of data to what is adequate, relevant, and reasonably necessary for a specified purpose; (v) securing personal data from unauthorized access; (vi) processing data in compliance with state and federal anti-discrimination laws; (vii) obtaining consumer consent in order to process sensitive data; (viii) providing clear and meaningful privacy notices; and (ix) conducting data protection assessments and ensuring deidentified data cannot be associated with a consumer. The CDPA also sets forth obligations relating to contracts between a controller and a processor, including ensuring that contracts between a controller and a processor do not waive or limit consumer data rights.
- No private right of action but enforcement by state attorney general. The CDPA explicitly prohibits a private right of action. Instead, it grants the state attorney general excusive authority to enforce the law.
- Right to cure. Upon discovering a potential violation of the CDPA, the attorney general must give the data controller notice. The data controller then has 60 days to cure the alleged violation before the attorney general can file suit. The cure provision expires April 1, 2026.
The CDPA takes effect October 1, 2024.