In late July 2019, U.S. federal and state regulators announced
three headline‑grabbing data privacy and cybersecurity
enforcement actions against Equifax and Facebook. Although coverage
of these cases has focused largely on their striking financial
penalties, as important are the terms the settlements imposed on
the companies' operations as well as their officers, directors,
and compliance professionals—and what they signal about
potential future enforcement activity to come.
The July 2019 Enforcement Actions
On July 22, the U.S. Federal Trade Commission ("FTC"
or "Commission"), U.S. Consumer Financial Protection
Bureau ("CFPB"), New York Department of Financial
Services ("NYDFS"), and attorneys general from 48 states,
D.C., and Puerto Rico announced proposed settlements totaling up to
$700 million with Equifax Inc. related to a 2017 data breach that
exposed sensitive personal information of more than 147 million
consumers. These settlements resolve numerous
