"Ding Dong" -- FTC-Drizly Data Breach Settlement Will Follow CEO Personally For A Decade

The Federal Trade Commission ("FTC") announced on Monday that it is settling a case against Drizly and its CEO stemming from a 2020 data breach that impacted roughly 2.5 million consumers. The proposed order not only contains a laundry list of security-related obligations for Drizly that span twenty years, but also names and targets its CEO James Cory Rellas personally, hitting him with obligations that will follow him for a decade, even if he moves to other organizations. There are also hints that the FTC intends to elevate information security issues to boards of directors and other top-level executives.

In its press release announcing the settlement, the FTC stated, "In the modern economy, corporate executives frequently move from company to company, notwithstanding blemishes on their track record. Recognizing that reality, the Commission's proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an