[{"url":"https://www.ftc.gov/business-guidance/blog/2014/04/keep-fcra-foreground-when-subject-background-screening","source":"FTC USA Business Blog Posts","pubDate":"Mon, 05 Oct 2026 14:07:46 +0200","id":3198181,"titre":"Keep FCRA in the foreground when the subject is background screening","description":"Keep FCRA in the foreground when the subject is background screening chundycz April 9, 2014 | 12:13AM Keep FCRA in the foreground when the subject is background screening By Lesley Fair When the talk turns to Big Data, part of the conversation is about all the public information available about people's lives – and how companies market it to prospective employers, landlords, etc.  Two cases just announced by the FTC  serve as a cautionary reminder to members of the industry that what they do may be subject to the long-standing consumer protections of the  Fair Credit Reporting Act (FCRA) .  InfoTrack, an Illinois company, and San Diego-based Instant Checkmate will be paying civil penalties to settle FTC lawsuits that they violated the FCRA.  Is it time for an FCRA refresher at your business? Instant Checkmate marketed its reports as a way for prospective employers and landlords to investigate applicants.  For example, the company advertised that one of the “GOOD REASONS to get instant criminal checks on anyone right now” was to “check out tenants before they rent.”  It also used a Google Ad Words campaign to make sure its site appeared when people searched for background checks on nannies, babysitters, maids, and housekeepers.  What kind of information would buyers get?  Current and previous addresses, birth certificates, arrest histories, and marriage and divorce records, to name just a few examples. InfoTrack offered similar services to employers nationwide, including background screening reports with people’s driving records, education and employment information, criminal histories, and even records from sex offender registries. How does the FCRA come in?  The law defines a “consumer report” as a “communication of any information” by a consumer reporting agency (CRA) that bears on a person’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” which is used (or expected to be used) as a factor in establishing their eligibility for credit, insurance, employment, or other reasons outlined in the law. According to the FTC, what Instant Checkmate and InfoTrack were doing triggered the FCRA.  For example, companies covered by the law must follow procedures to assure their reports are as accurate as possible, must take steps to see that those using their reports have permissible purposes for accessing them, and must provide required User Notices explaining key protections for consumers.  The law imposes special requirements when CRAs provide reports containing public record information that could have an adverse effect on a person’s ability to get a job.  In that case, the CRA must either: 1) notify the consumer that it’s reporting the information in the public record; or 2) maintain “strict procedures” – that’s the language in the law – designed to ensure the reported public information is complete and up to date. You’ll want to read the complaints for specifics of where the FTC says the companies fell short, but one example cited in the lawsuit against InfoTrack offers an object lesson on why FCRA protections are so important to consumers – and how the consequences can be devastating when companies don’t live up to the law.  According to the FTC, the reports InfoTrack provided to prospective employers included information about whether a job applicant was on the National Sex Offender Registry.  The employer would provide the first and last name and the date of birth to help InfoTrack with its search.  The problem was that before the fall of 2011, no date of birth was available for many names on the Registry.  If InfoTrack’s search found more than one person with the same first and last name, it reported a “possible match” to employers and gave them reports that included several different people with the"},{"url":"https://www.edpb.europa.eu/news/news/2026/edpb-annual-report-2025-supporting-stakeholders-through-guidance-and-dialogue_en","source":"EDPB News","id":2816021,"pubDate":"Thu, 09 Apr 2026 14:14:02 +0200","titre":"EDPB annual report 2025: supporting stakeholders through guidance and dialogue","description":"Brussels, 09 April - The European Data Protection Board (EDPB) has published its  2025 Annual Report . The report provides an overview of the EDPB work carried out in 2025 and reflects on important milestones, such as the adoption of the  Helsinki Statement on Enhanced Clarity, Support, and Engagement . “In 2025, we saw the data protection landscape change significantly. The rapid expansion of the EU’s digital regulatory framework has added complexity to the data protection ecosystem. To help organisations navigate this complexity and support compliance, the EDPB focused on enhancing legal certainty, making compliance more achievable in practice, and strengthening cooperation, both among Data Protection Authorities and with other regulators.  We also prioritised meaningful dialogue with stakeholders to ensure our work reflected real-world needs. Our achievements support economic growth while continuing to protect individuals’ fundamental rights to privacy and data protection.” EDPB Chair, Anu Talus   The Helsinki’s statement initiatives leading the way In 2025, the EDPB worked actively to address the demand for regulatory simplification to support innovation and economic growth, while ensuring the protection of individuals’ personal data.  With this in mind, the Board adopted the  Helsinki Statement on Enhanced Clarity, Support, and Engagement , which outlines new initiatives to  make GDPR compliance easier, strengthen consistency, enhance the dialogue and improve transparency with stakeholders and boost cross-regulatory cooperation .   For example, the Board launched a public consultation to ask organisations which templates would be most useful, organised several stakeholder events to consult organisations on upcoming guidelines and systematically published reports on stakeholder input.    Easing compliance for organisations and providing legal advice In the context of ongoing discussions on regulatory simplification at EU level, the EDPB actively contributed to legislative initiatives aimed at reducing administrative burden and streamlining requirements. The Board adopted a  joint opinion with the European Data Protection Supervisor (EDPS) on the Commission’s Proposal for a Regulation amending certain regulations, including the GDPR.  In addition, the Board held important discussions on this matter during plenary meetings, which subsequently informed the  EPDB/EDPS joint opinions on the Commission’s proposals on the  Digital Omnibus and on the  Digital Omnibus on AI adopted at the beginning of 2026. The Board also delivered five adequacy-related opinions concerning United Kingdom, Brazil and the European Patent Organisation (EPO).  In addition, the Board adopted  Recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites , and  Recommendations on the 2027 WADA World Anti-Doping Code  upon request from the Commission.   Strengthening cross-regulatory cooperation Cross-regulatory cooperation was a key focus for the EDPB last year. The EDPB worked together with the European Commission to clarify how data protection and digital laws interact and to address legal and practical challenges in cross-sectoral cases. In 2025, the EDPB adopted its first set of  joint guidelines with the Commission on the interplay between the Digital Markets Act (DMA) and the GDPR . The Board also worked with the Commission on joint guidelines on the interplay between the AI act and EU data protection laws for adoption in 2026.  In addition, the EDPB adopted  guidelines on the interplay between the Digital Services Act (DSA) and the GDPR .   Placing stakeholders at the heart of the EDPB work In 2025, a public consultation was launched on the  joint guidelines with the Commission on the DMA and the GDPR . The Board has also organised public consultations on the EDPB guidelines on  DSA and GDPR"},{"source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program","titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program","pubDate":"Wed, 17 Dec 2025 09:50:37 +0100","id":2577895,"description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer"},{"url":"https://www.edpb.europa.eu/news/news/2025/interplay-between-dsa-and-gdpr-edpb-adopts-guidelines_en","source":"EDPB News","pubDate":"Fri, 12 Sep 2025 15:51:31 +0200","id":2368407,"titre":"Interplay between the DSA and the GDPR: EDPB adopts guidelines","description":"Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by intermediary service providers and include references to GDPR concepts and definitions. While it is up to the competent authorities under the DSA - with the support of the European Board for Digital Services and EU courts - to interpret the DSA, there are a number of provisions which relate to the GDPR. These include: notice-and-action systems that help individuals or entities report illegal content recommender systems used by online platforms to automatically present specific content to the users of the platform with a certain relative order or prominence the provisions to ensure a high level of privacy, safety, and security of minors and prohibiting that profile-based advertising using their data is presented to them transparency of advertising by online platforms prohibition of profiling-based advertising using special categories of data  The EDPB guidelines help to understand how the GDPR should be applied in the context of DSA obligations. The EDPB also provides practical guidance relating to the cross-regulatory cooperation between authorities to coordinate enforcement which will provide more legal certainty for intermediary service providers and ultimately to protect the rights and freedoms of individuals. The guidelines will be subject to public consultation, providing stakeholders with the opportunity to comment and provide feedback. EDPB Chair Anu Talus said: “By clarifying the interplay between the DSA and the GDPR, these guidelines mark a significant step towards ensuring a coherent and effective EU digital rulebook, and they will help uphold the fundamental rights and freedoms of individuals. I hope that stakeholders, including the competent authorities under the DSA, will make the most of the opportunity to contribute to the public consultation\". More work in the pipeline Following these first guidelines on the interplay between the GDPR and the DSA, further work is underway with other regulators to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working on joint guidelines with the European Commission on the interplay between the Digital Markets Act (DMA) and the GDPR, as well as on joint guidelines on the interplay between the AI Act and EU data protection laws."}]