The U.S. Federal Trade Commission (FTC) announced on
Data Privacy Day (January 28) that it had reached a settlement with
a cord blood bank in respect of the loss of nearly 300,000
customers' personal information. The lost data included contact
information, social security numbers, credit and debit card account
numbers, drivers' licences, banking information, and medical
information. The information had been stored on unencrypted backup
tapes, an external hard drive and a laptop that were stolen from a
backpack left in an employee's car for several days.
In the statement of allegations, the FTC alleged that the blood
bank misrepresented that it maintained reasonable and appropriate
practices to protect consumers' personal information from
unauthorized access. The proposed settlement involves an order
prohibiting future misrepresentations and requiring the cord blood
bank "to establish and maintain a comprehensive information
security program that is reasonable designed
