FTC and 20 AGs sue Dollar General on GLBA privacy claims

The FTC and twenty state attorneys general filed suit against Dollar General on October 26, alleging violations of Section 5 of the FTC Act and of GLBA Sections 521-522 (15 U.S.C. §§ 6801-6802) — the privacy and safeguard provisions Congress enacted for financial institutions. As reported by Hogan Lovells via JD Supra, this is the FTC's latest attempt to extend GLBA's data-protection requirements to a non-financial company; the available source does not set out the specific misrepresentations or security failures alleged, so the underlying conduct should be confirmed from the complaint itself.

For major-firm clients, what matters is the reach of the theory, not any finding: an enforcement route that could convert ordinary consumer-protection and state privacy exposure into GLBA liability for retailers, app-based businesses and other non-financial handlers of consumer data. Counsel should identify which categories of data such entities hold, whether GLBA standards are being asserted as a benchmark elsewhere, including in state comprehensive privacy statutes and breach-notification regimes, and whether parallel actions are being coordinated against other retailers.

Watch for the filed complaint, the motion-to-dismiss or preliminary-injunction schedule, and whether the FTC continues filing GLBA-based cases against non-financial institutions; any FTC position statement on the outer limits of the theory would also be significant.