FTC’s Drizly Action Delivers Data-Security Message
The U.S. Federal Trade Commission’s action this week against Drizly over its 2020 data breach is garnering some notice because of its focus on the CEO of the Boston-based and Uber-owned booze deliverer. That’s important in terms of crisis awareness. But so are other aspects of the matter.
On Mon., Oct. 24, the FTC said it reached an agreement with Drizly and CEO Cory Rellas, who, despite warnings from another data intrusion in 2018, didn’t take measures to prevent the more-recent breach that involved the personal data of about 2.5 million customers.
The proposed settlement comes up for finalization after a 30-day comment period. Most press reports are spotlighting that the FTC would require Rellas to implement security measures even if, under certain conditions, he moves to a different company. That’s unusual though apparently not unprecedented.
“Rellas is responsible for this failure, as he did not implement, or properly delegate the responsibility to implement, reasonable information-security practices,” according to the FTC’s complaint.
As far as corporate governance and crisis prevention go, the agency notes that, while Rellas hired people for many corporate functions, data security wasn’t one of them.
“In the modern economy, corporate executives frequently move from company to company, notwithstanding blemishes on their track record,” the FTC said in the release. “Recognizing that reality, the commission’s proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an information-security program at future companies if he moves to a business collecting consumer information from more than 25,000 individuals, and where he is a majority owner, CEO or senior officer with information-security responsibilities.”
News: The FTC-Drizly saga comes as a wake-up call for marketers to take data minimization seriously; FTC chair Lina Khan and Democratic commissioners at the agency have indicated more enforcements to come soon. https://t.co/2WFOP2zuCx via @Adweek
— Trishla Ostwal (@trishlaostwal) October 26, 2022
Is this a warning for the future? It appears so. “CEOs who take shortcuts on security should take note,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in the press release.
All of this should be a caution to any organization about the importance of data protection. What’s particularly brutal is the accusation that, despite the warnings, Drizly didn’t do anything to address its security lapses and instead papered over them with dubious assurances.
We haven’t seen much in the way of comment from the company about the proposed settlement. “We take consumer privacy and security very seriously at Drizly, and are happy to put this 2020 event behind us,” CNBC quoted a Drizly spokesperson from a statement.
Image Credit: Drizly
Sign up for our free weekly newsletter on crisis communications. Each week we highlight a crisis story in the news or a survey or study with an eye toward the type of best practices and strategies you can put to work each day. Click here to subscribe.