Today the FTC released news that Executive Financial Home Loan Corp. was given a $1.1 million fine, reduced to $50,000 because of "inability to pay", for using the Do-Not-Call list to call "tens of thousands of consumers who are on the National Do Not Call (DNC) Registry for telemarketers and for failing to pay the annual fee required to access the DNC Registry. In addition, the company and its officers are permanently barred from violating the DNC provisions of the Telemarketing Sales Rule (TSR) and from making illegal telemarketing calls in the future." 

Executive Financial Home Loan Corp. claimed they purchased lead lists that they had been assured were not on the list.  However, the FTC indicated that even when an organization purchases such lists, “The bottom line is that telemarketers are responsible for complying with the Do Not Call provisions of the Telemarketing Sales Rule, and cannot hide behind the claims of their service providers."

I have spoken with many organizations, and most depend upon the claims of their business partners about such situations, and do not go the step further to ensure the lists purchased truly does consist of consumers who have given their permission to use their personal information for marketing. 

This is a good example, and lesson, for the need for organizations to perform due diligence activities to validate the customer lists they are purchasing actually do consist of valid, legal, information.  If they don't, not only could they face a fine and accompanying consent orders, but they may face even more damaging negative publicity...and significant lost customers and revenue...as a result.  Never underestimate the impact of bad PR.  Go the step further and validate the legality of any customer/marketing lists you purchase.

The FTC also indicated that the Executive Financial Home Loan Corp. did not "pay the required fees to gain access to the phone numbers in the Registry itself."  I wrote about another situation where the FTC took action against a telemarketer that was inappropriately using the Do-Not-Call list for marketing and did not pay the required fees to get access to the Registry.  How do these organizations get access to the Registry without paying the fee?  Hmm...another topic to explore...

Learn from these experiences of others.

It is good to see the FTC is taking actions to enforce the laws for which they are responsible for overseeing; it is the only way in which the laws will be effective.  The Department of Health and Human Services should take note and consider being more proactive for the HIPAA rules that are so limp and ineffective without active enforcement.

Technorati Tags
information security
IT compliance
corporate governance
awareness and training
government
data protection law
privacy law
do not call list
FTC
privacy