Guides
Privacy settlement risks for organizations: four misreadings
Privacy settlement risks for organizations: why a settlement is not a finding, a standard, a ranking number or the last word, and what to check instead.
Very few people are harmed by a privacy settlement itself. A great many organizations are harmed by what they conclude from one: that it proves wrongdoing, sets their standard, ranks seriousness by its number, or ends the matter. Four reading errors cover the ground.
What to take away
- Settling is not proof of wrongdoing, and "no admission" is not proof of innocence.
- A resolution in one matter binds the organization named in it. It is not a standard you can comply with.
- A headline figure can be a penalty, a fund, disgorgement or costs. Those are not comparable.
- An announcement is a snapshot, so record status as "not final, checked on this date".
- This text assumes United States processes and regulators, chiefly the Federal Trade Commission and state attorneys general. Where it mentions Canada, it says so.
A settlement is a contract, not a finding
A negotiated resolution trades certainty for concession. Many are agreed expressly without any admission of liability, and the document says so in terms where that is so. An organization that settles has ended a dispute. It has not been found to have done what was alleged.
In the United States the document is a contract, read under the contract law of the state that governs it, not a finding by a regulator. It does not carry the weight of a contested judgment, and citing it as one in a memo or a press line overstates what it can bear.
The reverse error is just as common. "No admission of liability" is a term of the deal, not a finding of innocence. Treating it as exoneration reads a negotiation as a verdict from the other side, and neither reading is supported by the document.
The safer response is the boring one: read what the operative document says was established, which is usually much less than either side's supporters claim, and stop there.
Another organization's terms are not your standard
Obligations in a published resolution bind the party that agreed to them. Reading them as the new expectation for a whole sector feels prudent and has two problems: they were negotiated for one set of allegations in one system, and they may not match what your own regulator expects.
They are frequently shaped by the specifics of what happened rather than by any general view of good practice. Some are stricter than anything required of anyone; some are narrower than what your own regulator expects of you. Neither tells you what to build to.
Your obligations reach you through your own route. In the United States, the FTC's privacy and security enforcement page says it can and does take law enforcement action to make sure companies live up to their promises to safeguard personal information.
| Subject | Where the obligation comes from | Who enforces |
|---|---|---|
| Consumer-facing privacy promises | The FTC Act and state consumer protection laws | The FTC and state attorneys general |
| Health data | HIPAA | The Office for Civil Rights at the Department of Health and Human Services |
| Private-sector data in Canada | Federal privacy law | The Office of the Privacy Commissioner of Canada |
Canada is a separate system, so a US settlement answers nothing there. Read breach duties under PIPEDA on their own terms, and note that face match app privacy law there runs through PIPEDA and three provincial statutes.
What a headline number can be
A figure in one of these matters can be a penalty paid to a public body, a fund for affected people, disgorgement of a gain, or costs. Those are not comparable, so a number quoted without its category says almost nothing. Ask which it is first.
Even within one category the number resists interpretation. A fund divided among a very large group yields a small individual amount, and a penalty says more about the ceiling in the applicable regime than about severity. Ranking conduct across jurisdictions by the number is the most confident wrong thing said about this subject.
The Federal Trade Commission's 2019 matter with Facebook shows the categories apart. The FTC announced a $5 billion penalty to settle charges that Facebook violated a 2012 FTC order by deceiving users about their ability to control the privacy of their personal information.
Coverage read the $5 billion as money for users. Civil penalties under the FTC Act go to the US Treasury, not to affected people, so that reading confuses a penalty with a fund, the confusion the four categories exist to prevent.
Is it final? Treat status as a field
Decisions can be appealed, stayed, varied or set aside, and an announcement is a snapshot. A matter under challenge is not a settled position, and coverage written shortly after an announcement will not reflect what happened afterwards. Reading it as final is the fourth error.
For anyone keeping a record, status is a field rather than a judgment call. The honest value is often "not final, checked on this date", which tells the next reader how old the check is. Re-check it before the matter is cited again in a memo or a press line.
Five questions before a settlement enters a memo
Before a settlement goes into a policy memo or a press line, answer five questions in writing.
- Who is bound by the document, and who is not?
- What does the operative text say was established, and what does it leave open?
- Is the headline figure a penalty, a fund, disgorgement or costs?
- Is the matter final, and on what date was that last checked?
- Where do our own obligations come from, and does the settlement add anything to them?
The answer to the last question is a regulator or statute from the table above, not the settlement. A settlement can show what a regulator considered inadequate, but it cannot replace your own route to the obligation.
What affected customers should hear from you
If your organization is the one named, publicity produces a list of people expecting money, and contact from the wrong people follows. Say plainly what an official process will and will not do, publish the official address in your own notice, and give customers three habits.
- Type the notice's address to reach the official site, rather than following a link.
- Treat urgency as the warning sign. Real deadlines in these matters are weeks or months and are published.
- Give a claim process identifying information, not credentials, because a claim form has no reason to want a password.
No legitimate process asks you to pay in order to receive money. An offer to recover money already lost to one of these approaches is itself a second approach on a person already selected as responsive. Customers who meet either should know where to report.
Common questions
If a settlement establishes so little, why do they matter?
Because of the obligations, which are real and enforceable on their own terms, and because the conduct terms frequently change how something works for everyone using the service. The part with consequences is rarely the part in the headline.
Should an organization ever adopt terms from a published resolution voluntarily?
Sometimes, as a source of ideas about what a regulator considered inadequate. As a compliance target it is the wrong instrument, since it was written for someone else's facts.
How should a press line describe a settlement?
Say what the document says and no more: who agreed, what they agreed to, what it says about liability, and whether the matter is final. Leave out any ranking by the number.
Does a regulator's settlement set a rule for everyone?
No. It binds only the party that agreed to it. Your own obligations come through your own route, such as the FTC Act, HIPAA or, in Canada, the federal private-sector process.
