Dechert Cyber Bits - Issue 99 - July 23, 2026

FTC Reaches $2.25 Million Settlement with Tenant Screening Provider RentGrow for FCRA and FTC Act Violations

On July 9, 2026, the Federal Trade Commission (“FTC”), entered into a settlement with RentGrow, Inc. (“RentGrow”) after the filing of an agreed-upon consent order in federal court in the District of Columbia. RentGrow compiles and sells tenant screening reports to landlords and property managers, which the DOJ contends makes it a “consumer reporting agency” and “reseller” under the Fair Credit Reporting Act (“FCRA”).

The complaint alleges that RentGrow fell short of its FCRA obligations and violated Section 5(a) of the FTC Act. First, RentGrow allegedly failed to maintain adequate procedures to prevent duplicate entries for the same criminal or eviction proceeding on tenant screening reports. Second, RentGrow allegedly failed to disclose its vendor, LexisNexis Accurint, as a source of information it used to match criminal and eviction records to applicants, making it harder for consumers to dispute erroneous matches at the source. Third, RentGrow allegedly failed to timely investigate and correct disputed items. Finally, in cases where consumers successfully disputed information that was subsequently modified or deleted, RentGrow allegedly failed to report such changes to the property managers, despite telling consumers it had notified the properties.

Under the proposed settlement, RentGrow will pay $2.25 million and be permanently enjoined from: (i) failing to maintain reasonable accuracy procedures designed to prevent duplicate or multiple entries for the same criminal or eviction proceeding; (ii) failing to disclose, upon a consumer’s file request, all vendors used as sources of address history or middle name data; (iii) failing to comply with the FCRA’s reseller dispute requirements; and (iv) misrepresenting to consumers whether landlords and property managers have been notified of post-dispute updates to screening reports. The order includes compliance reporting and recordkeeping obligations and terminates after 10 years. RentGrow did not acknowledge any wrongdoing in connection with the proposed settlement.

Takeaway: With much legislative and regulatory attention on new state “data broker” laws, the RentGrow settlement demonstrates the FTC’s continued focus on FCRA, the original “data broker” law. The RentGrow settlement serves as a reminder to FCRA-regulated entities of the importance of timely dispute handling and responsibilities under Section 5 to make representations to consumers about FCRA disputes that arguably could be perceived as misleading or deceptive.

UK Treasury Report Emphasizes the Importance of Cyber Resilience in Financial Services

The UK Treasury issued a report on cyber resilience in the financial services sector with the aim of strengthening investment in cyber resilience among financial firms. Cyber resilience refers to an organization’s ability to maintain operations and protect data when faced with cybersecurity incidents. According to the report, resilience should be viewed as a strategic enabler of growth and stability—not solely as a compliance cost. The report presents evidence on the economic and financial benefits of operational resilience, with a focus on the costs of cyber disruption. It examines how resilience affects financial performance, recovery from disruption and longer-term growth, and how these impacts are experienced both within the financial sector and more broadly across the economy.

The report reached four key conclusions. First, cyber risk is becoming more severe and more complex. Evidence points to consistently higher rates of disruption, higher recovery costs, and growing exposure through third-party and platform dependencies. Second, the financial consequences of cyber disruption have changed materially over time. Cyber incidents are no longer limited to short-lived technical outages; rather, they can generate material profit and loss impacts, affect firm value, and undermine trust where they expose broader weaknesses in governance, controls, or operational resilience. Third, resilience outcomes are shaped by both the level of investment and the effectiveness with which capabilities are prioritized and integrated. Strong outcomes are associated with a combination of foundational controls—such as patching and vulnerability management—paired with targeted improvements in detection, response, and recovery. Finally, resilience is increasingly relevant beyond risk mitigation. Organizations with stronger resilience tend to sustain performance more effectively through disruption and are better positioned to support ongoing transformation, innovation, and growth.

Takeaway: The UK Treasury report draws on data and analysis from a broad range of sources to produce a stark picture of the financial implications of a lack of cyber resilience both in terms of financial loss attributable to cyber incidents and the role of cyber resilience as a driver for financial performance. With the EU’s Digital Operational Resilience Act ("DORA") coming fully into force last year and raising regulatory requirements for cyber resilience for financial firms in the EU, the regulation of cyber resilience has emerged as a significant strategic issue not just in the EU but increasingly in the UK.

European Data Protection Board Issues Guidance on Anonymization, Blockchain, and AI Web Scraping

On July 7, 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines on anonymization and AI web scraping and also adopted the final version of its guidelines on processing personal data through blockchain technologies.

The draft guidelines on anonymization seek to clarify when data qualifies as anonymous. Under the GDPR, data is anonymous if it does not relate to an identified or identifiable natural person. Whether data relating to an individual is anonymous should be assessed on an entity-by-entity basis taking into account the likelihood of re-identification in the context of that entity’s activities, including taking into account malicious actors that gain unauthorized access to the entity’s data, and all other datasets available for potential re-identification purposes. The guidelines provide a practical framework for organizations to assess whether anonymization has been achieved. Specifically, the framework establishes a three-part test to assess whether anonymization has been technically achieved: (1) no record isolation (i.e. there is no unique combination of attribute values that relate to a single individual), (2) no linkage (i.e. the data cannot be linked to another dataset that enables identification), and (3) no inference (i.e. identifying information cannot be inferred from the data). If all three criteria are satisfied, the data can safely be considered anonymous.

The draft guidelines on AI web scraping address various aspects of GDPR compliance for web scraping activities, including adherence to data protection principles, the legal basis for such activities, and the conditions under which special categories of personal data may be processed in this context. The EDPB recommends scraping data only from reliable sources, recording timestamps, and validating data prior to use in AI training to support compliance with the accuracy principle.

Following public consultation, the EDPB also adopted the final version of its guidelines on processing personal data through blockchain technologies. The guidelines provide a framework for organizations considering the use of blockchain technology, outlining GDPR compliance considerations for planned processing activities and clarifying the roles and responsibilities of the various actors involved in blockchain-related processing.

Takeaway: The guidelines offer an unusually practical approach to applying case law from the Court of Justice of the EU, which frequently produces often ethereal or entirely principle based imprecise tests or is focused entirely on specific factual scenarios. The draft guidelines on anonymization and AI web scraping are open for public consultation until the end of October 2026. The EDPB’s blockchain guidelines have the potential to provide greater certainty for organizations developing blockchain applications in Europe as clearer expectations under the GDPR can shape the manner in which organizations collect, process, and protect personal data.

First Circuit Affirms Dismissal of Data Breach Class Action: Plaintiff’s Injury Must Be Traceable to the Breach

Article III standing requires the plaintiff suffer an injury in fact that is “fairly traceable to the defendant’s conduct.” Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118, 134 n.6 (2014). On June 11, 2026, the First Circuit issued an important ruling emphasizing the importance of traceability in data breach cases. The case arose out of a May 2019 ransomware attack against Bayamón Medical Center (“BMC”), a Puerto Rico hospital that allegedly affected the information pertaining to over 522,000 patients, including names, social security numbers, dates of birth, and medical diagnoses. Plaintiff filed a putative class action against BMC. To demonstrate Article III standing, Plaintiff attempted to show that data from the breach actually had been misused, as indicated by the fact that she discovered a fraudulent cellphone account had been opened in her name.

The district court dismissed for lack of standing and the First Circuit affirmed. The Court of Appeals reaffirmed that under established First Circuit precedent, actual misuse of data following a data breach can establish injury in fact. See Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023). Nevertheless, the Court held that the Plaintiff lacked Article III standing because she failed to plead facts showing that injury (i.e., the fraudulent cellphone account) stemmed from the data breach. In particular, the Court noted three problems with the complaint. First, it failed to show a temporal link between the breach and when the cellphone plan was opened. Indeed, the account might have been opened before the breach. Second, it failed to rule out the possibility that the fraudster had obtained the plaintiff’s information elsewhere. For example, she did not allege that she was generally careful about protecting her information. Third, the complaint did not explain how the information affected by the breach (e.g., medical information) could have been used to open a fraudulent cellphone account. In short, the complaint did not sufficiently connect the dots between the data breach and the alleged injury.

Takeaway: While the pendulum as to what constitutes actual harm has swung in recent years and is dependent somewhat on jurisdiction, this decision creates important precedent supporting early dismissal of data breach cases based on speculative theories of harm. The plaintiffs’ bar often attempts to establish standing in data breach cases by making kitchen-sink allegations about alleged harms following breaches, such as alleging upticks in spam calls, inaccurate online profiles, or suspicious email activity. The Santos-Pagan decision makes clear that, even at the pleading stage, plaintiffs need to establish not only that they have been harmed by such incidents but also plausibly link those harms to the breach itself.

European Commission Reaches Preliminary Position That Amazon Web Services Should Be Designated as a Gatekeeper Under the Digital Markets Act

On June 25, 2026, the European Commission announced that it had reached the preliminary position that Amazon Web Services (“AWS”) should be designated as a gatekeeper under the Digital Markets Act (“DMA”).

Despite not otherwise meeting the DMA’s quantitative thresholds for designation, the Commission preliminarily found that AWS, as one of the largest cloud computing services in the EU, serves as an important gateway between businesses and their customers. In making this determination, the Commission considered that AWS has achieved significant turnover and that its operational capacity and investment levels have significantly outpaced those of many competitors. Additionally, its portfolio of AI tools and partnerships have become a decisive factor in cloud procurement, and it appears to retain a large proportion of increased AI-driven demand within its ecosystem. Finally, the Commission cited Amazon’s durable position in the EU cloud computing sector, as evidenced by the longstanding position of AWS as a leader in its market.

The Commission’s preliminary decision comes despite the fact that no cloud provider satisfies the DMA’s ordinary quantitative thresholds; however, a formal decision has yet to be made. Pre-empting the Commission’s recent announcement, Amazon published a policy blog in early June arguing that AWS cloud services do not fit the DMA’s gateway model.

Takeaway: The designation raises broader questions as to the kinds of services that can be brought into scope of the DMA. Being designated as a “gatekeeper” triggers a variety of obligations under the DMA designed to preserve competition in the digital market. There are multiple pending challenges to European Commission decisions to designate (or not designate) various services as “gatekeepers.” The European Court of Justice is likely to have the final say on this.

Supreme Court Overturns Humphrey’s Executor, Eliminates For-Cause Removal Protections for FTC Commissioners

On June 29, 2026, the United States Supreme Court issued its decision in Trump v. Slaughter, No. 25-332, upholding 6-3 President Trump’s firing of FTC Commissioners. The decision, authored by Chief Justice John Roberts, overturns the Court’s 1935 precedent in Humphrey’s Executor v. United States, establishing that FTC Commissioners could be removed by the President only for “inefficiency, neglect of duty, or malfeasance in office,” and confirms that the President possesses unrestricted authority to remove FTC Commissioners—and, by extension, the leadership of similarly structured independent federal agencies—at will.

The case arose from President Trump’s March 2025 removal of the FTC’s two Democratic Commissioners, Rebecca Slaughter and Alvaro Bedoya, without providing a statute recognized “for cause” reason —actions we covered in Cyber Bits Issue 73, Issue 74, Issue 75, and Issue 95. Commissioner Slaughter filed suit and prevailed in the District Court for the District of Columbia and the D.C. Circuit before the Supreme Court stayed the lower courts’ orders and granted certiorari.

Writing for the majority, Chief Justice Roberts traced the President’s removal authority from the Constitutional Convention and the “Decision of 1789” through the Court’s 1926 landmark in Myers v. United States, concluding that Humphrey’s Executor’s distinction between “purely executive” and “quasi-legislative” or “quasi-judicial” functions had been progressively undermined and “has not withstood the test of time.”

Justice Sotomayor, joined by Justices Kagan and Jackson, dissented, warning that the decision to consolidate so much power with the presidency “replaces 90 years of proven, workable practice” and “creates an executive branch that Congress never dreamed of establishing.” In a solo concurrence, Justice Gorsuch cautioned that overruling Humphrey’s Executor carries “weighty consequences” for the vast legislative and judicial powers Congress has delegated to independent agencies.

Takeaway: The Slaughter decision carries broad implications for independent federal agencies across the regulatory landscape, as the Court’s reasoning would seem to extend to any agency (except the Fed) whose leadership exercises executive power, including the SEC, FCC, NLRB, and FERC, among others. Agency leadership now effectively serves at the pleasure of the President, introducing the potential for more significant shifts in enforcement priorities and regulatory posture with each administration. This development stands to potentially affect privacy enforcement at the FTC, and it has already been cited as a basis for challenging the EU-U.S. Data Privacy Framework, which relies on the FTC for enforcement.

Dechert Tidbits

On July 1, 2026, the Federal Trade Commission released a proposed policy statement explaining how Section 5 of the FTC Act may apply when companies deliberately steer AI systems away from the accurate or useful results users reasonably expect. The FTC warned that companies steering AI outputs away from users’ reasonable expectations—for example, to advance undisclosed ideological objectives, or even to comply with state laws such as Colorado’s revised Artificial Intelligence Act—risk violating Section 5’s prohibition on deceptive practices. As with other FTC guidance, the policy statement would not change the application of Section 5, and the theories of liability advanced in the policy statement have yet to be tested in courts. Public comments on the proposed statement are due by July 31, 2026.

The Washington State Artificial Intelligence Task Force released its final report to the state Legislature and Governor Bob Ferguson, concluding a two-year effort to shape AI regulation. The 19-member body put forward eleven policy recommendations covering AI development transparency, companion chatbot safeguards, law enforcement disclosure requirements, and the creation of a permanent emerging technology advisory board. Four recommendations have already been signed into law, including a measure protecting minors from harmful content generated by companion AI chatbots. The task force’s voting majority declined to advance proposals to impose guardrails on data center development or to expand public sector employee bargaining rights over AI-related workplace decisions.

On June 30, 2026, New Jersey Governor Mikie Sherrill signed A5328 into law, establishing registration and fee requirements for data brokers and a newly created category of “data collectors”—entities that have a direct relationship with consumers but sell their personal data to data brokers. The law requires both data brokers and data collectors to register annually with the New Jersey Division of Consumer Affairs and pay registration fees based on a seven-tier structure tied to the number of New Jersey consumers whose data they sell or license, ranging from $5,000 (for 100,000 consumers or fewer) to $1.5 million (for more than 4.5 million consumers). Entities that fail to register or pay the required fee face a $2,500 daily fine. The law also prohibits the sale or licensing of sensitive data, with violations carrying a $50,000 per-record civil penalty. The Division has 270 days to stand up the registry, placing the registration deadline around March 27, 2027; the remainder of the law goes into effect immediately.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.