More Than A Ban On Facial Recognition Use: The Federal Trade Commission's Rite-Aid Action And Proposed Stipulated Order

MB
Mayer Brown

Contributor

Mayer Brown is a distinctively global law firm, uniquely positioned to advise the world’s leading companies and financial institutions on their most complex deals and disputes. We have deep experience in high-stakes litigation and complex transactions across industry sectors, including our signature strength, the global financial services industry.
In this article, the authors examine a recent enforcement action brought by the Federal Trade Commission that offers insight into the potential...
United States Technology
To print this article, all you need is to be registered or login on Mondaq.com.

In this article, the authors examine a recent enforcement action brought by the Federal Trade Commission that offers insight into the potential consequences for businesses that do not comply with the agency's policy statement guidelines.

The Federal Trade Commission (FTC) warned businesses of its stance on the use and collection of biometric information in a May 2023 policy statement.1 Now, a recent enforcement action2 offers insight into the potential consequences for businesses that do not comply with the FTC's policy statement guidelines.

The FTC has sued3 Rite-Aid Corporation and its parent company Rite-Aid Headquarters Corporation (together, Rite-Aid) in the U.S. District Court for the Eastern District of Pennsylvania for (1) an unfair Facial Recognition Technology (FRT) practice, improperly using FRT that falsely flagged Rite-Aid customers for shoplifting, and (2) failing to implement a comprehensive security program to protect customers' personal information. The complaint alleges that Rite-Aid's failure to take reasonable measures that would prevent harm to consumers violated a 2010 consent order4 (2010 order) with the FTC and Section 5 of the FTC Act.5

The FTC attached a stipulated order to its complaint that, if approved, would not only ban Rite-Aid from using FRT for five years but also require significant modification to Rite-Aid's existing information security policies.

BACKGROUND

The FTC filed an administrative complaint6 on November 12, 2010, against Rite-Aid for failing to implement reasonable and appropriate security measures to prevent unauthorized access to personal information. Rite-Aid later agreed to the 2010 order, which required it to (1) implement and maintain a comprehensive information security program, and (2) retain documents relating to its compliance with that provision of the order.

About 10 years later, in 2020, Reuters published7 an investigative report about Rite-Aid's use of FRT in its stores. As reported in Rite-Aid's SEC filings,8 the FTC opened an investigation that same year into Rite-Aid's compliance with the 2010 order and followed up in 2022 with information requests related to Rite-Aid's procedure for ensuring that contracted vendors appropriately safeguard Rite-Aid costumer information.

In its new lawsuit, the FTC brings two claims against Rite-Aid under Section 5 of the FTC Act:

  1. Unfair FRT practices, and
  2. Failure to implement or maintain a comprehensive information security program as required by the 2010 order.

THE COMPLAINT

Unfair FRT Practices

The FTC alleges that between 2012 and 2020, Rite-Aid deployed artificial intelligence-based FRT to identify customers who potentially were shoplifting in its stores. According to the complaint, Rite-Aid maintained an enrollment database of images (along with other personal information) of people who it considered "persons of interest" because they had allegedly engaged in actual or attempted criminal activity at a Rite-Aid store or because Rite-Aid had received "Be On the Look Out" information about the individual from law enforcement. The FRT captured live images of individual shoppers in Rite-Aid stores and purported to match them with images from the enrollment database. If there was a match, the FRT would generate and send employees "match alerts" with instructions for handling the suspected shoplifter. The complaint faults Rite-Aid for allegedly failing to:

  • Assess, consider, or take reasonable steps to mitigate risks to consumers associated with its implementation of FRT, including risks associated with misidentification of consumers at higher rates depending on their race or gender;
  • Take reasonable steps to prevent its FRT from using low-quality images, increasing the likelihood of false-positive match alerts;
  • Take reasonable steps to train or oversee employees tasked with operating FRT and interpreting and acting on match alerts; and
  • Take reasonable steps, after deploying FRT, to regularly monitor or test the accuracy of the technology, including by failing to implement any procedure for tracking the rate of false positive facial recognition matches or actions taken on the basis of false positive facial recognition matches.

The FTC concluded that Rite-Aid's alleged conduct caused harm to consumers by:

  1. Surveilling and following store customers around Rite-Aid stores;
  2. Preventing store customers from making needed or desired purchases (in the event employees were instructed to remove the consumer from the store);
  3. Subjecting consumers to unwarranted searches and calling the police on consumers who were falsely flagged as shoplifters, and
  4. Wrongly accusing store customers of shoplifting.

Unsurprisingly, the FTC's conclusions regarding Rite-Aid's alleged FRT practices appear to be based on the unfairness factors set forth in its May 2023 policy statement.9

AILURE TO IMPLEMENT OR MAINTAIN A COMPREHENSIVE INFORMATION SECURITY PROGRAM

After addressing Rite-Aid's alleged improper use of FRT, the FTC then found Rite-Aid's existing information security program deficient because it failed to:

  • Use reasonable steps for selecting and retaining capable service providers that appropriately safeguarded personal information;
  • Require that service providers, by contract, implement and maintain appropriate safeguards for personal information; and
  • Maintain written records relating to Rite-Aid's information security program.

The FTC concluded that Rite-Aid's conduct violated the 2010 order and that its violation is likely to cause substantial consumer injury.

THE STIPULATED ORDER

To settle the case, Rite-Aid agreed to comply with comprehensive information security policy mandates and ongoing reporting to the FTC. Rite-Aid is not required to pay a monetary fine. Among other things, the order10 requires Rite-Aid to:

  • Refrain from using FRT for five years;
  • Delete biometric information collected by FRT;
  • Provide notice to third-parties of the FTC's complaint and order and require that these third-parties delete biometric information received from Rite-Aid;
  • Provide the FTC with a list of all third-parties that received any of the following information from Rite-Aid:
    • A first and last name;
    • A home or physical address;
    • An email address or other online contact information, such as an instant messaging user identifier or a screen name;
    • A mobile or other telephone number;
    • A driver's license or other government-issued identification number;
    • A date of birth;
    • Geolocation information sufficient to identify street name and name of a city or town;
    • Bank account information or credit or debit card information (including a partial credit or debit card number with more than five digits);
    • A user identifier, or other persistent identifier that can be used to recognize a user over time and across different devices, websites, or online services;
    • User account credentials, such as a login name and password (whether plain text, encrypted, hashed, and/or salted);
    • Biometric information; or
    • Health information;
  • Implement a comprehensive protocol for assessment, collection, maintenance, testing, retention, and safeguarding biometric information (if Rite-Aid intends to use a non-FRT biometric security system not subject to the five-year ban);
  • Disclose the use of any non-FRT biometric security system to consumers in Rite-Aid stores via "clear and conspicuous" physical signs, and on each website, mobile app, or online service that collects biometric information;
  • Disclose to consumers the specific types of biometric information collected, outputs generated by any non-FRT biometric security system, purposes for collecting biometric information, and timeframe for deletion of each type of biometric information;
  • Implement a comprehensive information security program;
  • Retain a third-party assessor to periodically assess Rite-Aid's security program;
  • Report data breaches of over 500 individuals to the FTC within 72 hours of Rite-Aid's reasonable belief of unauthorized access to covered information;
  • Implement mandatory recordkeeping of Rite-Aid's revenue/sales; personnel records; consumer complaints; records related to compliance with the FTC's order; materials relied on for the mandatory system assessment; material different representations of Rite-Aid's privacy, security, availability, confidentiality, and integrity of any covered information; copies of the third-party assessor's report; subpoenas from law enforcement related to the FTC's order; and records showing lack of compliance with the FTC's orders; and
  • Submit an annual certification of compliance with the FTC's order.

WHAT DOES THIS MEAN FOR BUSINESSES?

The Rite-Aid enforcement action confirms the conclusion that the FTC's May 2023 policy statement reflects a broad set of guidelines for companies that collect or use biometric information, and non-compliance may result in the FTC filing suit under Section 5 of the FTC Act. Accordingly, companies operating in the United States should consider reviewing their biometric information collection practices, employee training for handling biometric information, and contracts with vendors that process biometric information for compliance with the FTC's policy statement.

Footnotes

1. https://www.ftc.gov/system/files/ftc_gov/pdf/p225402biometricpolicystatement.pdf.

2. https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without.

3. https://www.ftc.gov/system/files/ftc_gov/pdf/2023190_riteaid_complaint_filed.pdf.

4. https://www.ftc.gov/sites/default/files/documents/cases/2010/07/100727riteaidagree.pdf.

5. 15 U.S.C. §§ 45(a), (n).

6. https://www.ftc.gov/sites/default/files/documents/cases/2010/11/101122riteaidcmpt.pdf.

7. https://www.reuters.com/investigates/special-report/usa-riteaid-software/.

8. https://www.sec.gov/Archives/edgar/data/84129/000155837023016503/rad-20230902x10q.htm.

9. https://www.ftc.gov/system/files/ftc_gov/pdf/p225402biometricpolicystatement.pdf.

10. https://www.ftc.gov/system/files/ftc_gov/pdf/2023190_riteaid_stipulated_order_filed.pdf.

Originally published by Pratt's Privacy & Cybersecurity Law Report.

Visit us at mayerbrown.com

Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.

© Copyright 2024. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.

More Than A Ban On Facial Recognition Use: The Federal Trade Commission's Rite-Aid Action And Proposed Stipulated Order

United States Technology

Contributor

Mayer Brown is a distinctively global law firm, uniquely positioned to advise the world’s leading companies and financial institutions on their most complex deals and disputes. We have deep experience in high-stakes litigation and complex transactions across industry sectors, including our signature strength, the global financial services industry.
See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More