The Federal Trade Commission (FTC) has developed a well-known penchant for using individually negotiated settlement agreements and consent decrees to announce for the first time what qualifies as “unfair” or “deceptive” conduct under the FTC Act. In the data-privacy arena, FTC views these enforcement actions (and the resulting consent decrees) as a source of “common law” that places the business community on sufficient notice of what data-security practices § 5 of the FTC Act requires.
The U.S. District Court for the Western District of Washington recently ratified that view in a controversial ruling, Veridian Credit Union v. Eddie Bauer. The case arose following a 2016 cyberattack on Eddie Bauer’s network that compromised customers’ payment-card data. Veridian Credit Union, whose cardholders had their data stolen after shopping at Eddie Bauer, brought suit under Washington’s Consumer Protection Act (CPA), which like § 5 of the FTC Act also allows courts to award treble damages to private plaintiffs who are injured by “unfair” or “deceptive” acts. Veridian alleged that Eddie Bauer’s failure to adopt data-security measures that FTC has required in other cases constitutes an “unfair” practice under the Washington CPA.
The firm at the centre of the Paradise Papers says it’s pursuing legal action against those who made allegations.
Appleby, which has a large office in Douglas, had millions of confidential files leaked earlier this year, sparking a global debate about tax ethics.
Many of them surrounded the affairs of wealthy individuals operating in the Isle of Man.
There has been speculation over the legality of the data leak since it went public in November – and now Appleby has formally hit back, saying it is ‘obliged’ to file proceedings against the UK outlets who broke many of the stories.
Bosses have demanded The Guardian and the BBC hand over the documents they’ve seen and used in investigations.
The firm is also seeking damages, claiming there was ‘no public interest’ in any of the stories published.
Both media outlets have vowed to defend themselves in any future proceedings.