The main factor that could lead to individual liability is when an executive has awareness of cybersecurity and data privacy practices within the organization.Īccording to the FTC’s complaint, in 2018 both Drizly and Rellas were notified about security vulnerabilities prior to the data breach but failed to adequately mitigate these vulnerabilities. Under the Federal Trade Commission Act, a person can be held individually liable when the individual: (1) participated directly in the deceptive trade practice or had had authority to control them and (2) had knowledge of the deceptive conduct. The FTC’s decision marks the first time it has held an executive personally liable for failing to follow cybersecurity and data privacy compliance. Notably, the order extends to any future employment of Rellas for the next 10 years. Under the order, Drizly must implement data security measures that include the minimization, deletion, and retention of personal information. 10, 2023, the Federal Trade Commission (FTC) finalized its order against online alcohol marketplace, Drizly, and its CEO, James Cory Rellas for failing to implement security safeguards that led to a data breach in 2020 that exposed 2.5 million users’ personal information. Cybersecurity Awareness Month – FTC Holds Corporate Executive Personally Liable for Cybersecurity FailuresĬybersecurity Awareness Month – FTC Holds Corporate Executive Personally Liable for Cybersecurity Failuresīy: Jessica L.This material may not be published, broadcast, rewritten or redistributed without permission. The proposed consent agreement will be opened to public comment for 30 days, after which the FTC will decide whether to make it final. 'We take consumer privacy and security very seriously at Drizly, and are happy to put this 2020 event behind us,' the company said in a statement.

'CEOs who take shortcuts on security should take note.'ĭrizly collects and stores on Amazon Web Services cloud-computing service a wide range of personal data from customers such as email and postal addresses, phone numbers, geolocation information and data purchased from third parties, according to the FTC. 'Our proposed order against Drizly not only restricts what the company can retain and collect going forward but also ensures the CEO faces consequences for the company's carelessness,' Samuel Levine, director of the FTC's bureau of consumer protection, said in a statement. The regulators allege that the company and Rellas were alerted to security problems two years before the 2020 breach yet failed to act to protect consumers' data.ĭrizly agreed to put in a comprehensive data security program and establish security safeguards, and to limit future data collection or storage to that which is necessary for specific purposes. The proposed consent agreement with the FTC also names Drizly CEO James Cory Rellas. The Federal Trade Commission announced the action Monday against Drizly, a Boston-based subsidiary of Uber that delivers beer, wine and spirits in states where it's legal, and partners with retailers in hundreds of cities around the US.

Drizly data breach claim