Under current FTC leadership, it seems increasingly probable that the agency will seek personal liability for executives over alleged security failures. These limitations and obligations would potentially follow executives even if they move on to work at other organizations, significantly limiting their employability, much like personal liability for Securities and Exchange Commission (SEC) related offenses. The FTC claimed in its complaint that Rellas, as CEO, was personally responsible for Drizly’s alleged security failures, as he did not implement, or properly delegate the responsibility to implement, reasonable information security practices, even after he was alerted to security problems two years prior to the breach. The order requires that Rellas, even if he leaves Drizly, implement an information security program at future companies. As noted in the FTC’s press release, “In the modern economy, corporate executives frequently move from company to company, notwithstanding blemishes on their track record. Recognizing that reality, the Commission’s proposed order will follow Rellas even if he leaves Drizly.” While the Drizly order binds only Rellas, future cases may implicate other executives whose duties relate more directly to data security, privacy, and oversight of these functions.

Minimizing data collection, is an emerging consideration (and enforcement risk) for any company subject to the agency’s jurisdiction – it is also directly at odds with many service, quality, and product goals of businesses. The FTC’s order requires the destruction of any personal data the company has collected that is not necessary for it to provide products or services to consumers – a standard that is problematic and may be at odds with the First Amendment. Moving forward, the company must refrain from collecting or storing personal information unless it is necessary for specific purposes outlined in a retention schedule. The FTC’s recent proposed rulemaking on commercial surveillance and data security also seems to foreshadow the agency’s intention to take an active role in encouraging data minimization and usage by businesses. This proposal suggests that the risk of being accused of and investigated for failing to abide by data minimization principles is expanding under present agency leadership.

Data minimization and proportionality remain issues of global concern. Whether personal liability for executives will spread outside the United States remains uncertain but disaffection with corporate accountability remains high with many regulators.