COMPANY ACCUSED OF RE-WRITING PRIVACY POLICY WITHOUT NOTICE TO CONSUMERS
In an administrative complaint, the Federal Trade Commission (FTC) charged 1Health.io Inc., a/k/a Vitagene, Inc., with failing to safeguard consumers’ data and with misrepresenting their customers’ ability to get their personal information deleted from the company’s databases. (The company is also alleged to have changed its privacy policy, midstream, without appropriate notice to all impacted consumers.)
In a press release, dated June 16, 2023, the FTC announced that it had reached a proposed settlement with the company, In addition to a $75,000 cash payment (which will be used for consumer refunds), the company will be required to enhance protections of all genetic information and will be required to instruct its labs that all DNA samples over 180 days old must be destroyed.
Additionally, the proposed settlement provides that the company:
- will be prohibited from sharing health data with third parties—including information provided by consumers before and after its 2020 privacy policy change—without obtaining consumers’ affirmative express consent;
- must ensure any company that purchases all or parts of 1Health’s business agrees by contract to adhere to provisions of the order;
- must notify the FTC about incidents of unauthorized disclosure of consumers’ personal health data; and
- must implement a comprehensive information security program addressing the security failures outlined in the complaint.
In a written statement, Samuel Levine, Director of the FTC’s Bureau of Consumer Protection noted, “Companies that try to change the rules of the game by re-writing their privacy policy are on notice …. The FTC Act prohibits companies from unilaterally applying material privacy policy changes to previously collected data.”
Think they were shaking in their genes when they got this complaint?
# # #
FTC PRESS RELEASE ~ (06.16.23)