Overview
In December, the Federal Trade Commission (FTC or Commission) announced a first-of-its-kind enforcement action against Rite Aid Corporation and Rite Aid Headquarters Corporation (collectively, Rite Aid) to settle allegations that Rite Aid engaged in unfair and discriminatory practices with its use of a facial recognition technology (FRT) surveillance system in hundreds of its stores. The FTC alleged that Rite Aid’s FRT system generated thousands of false-positive matches that incorrectly identified patrons that Rite Aid had previously deemed likely to engage in shoplifting or other criminal behavior. These false-positive matches occurred most frequently in areas that had a plurality of Black and Asian residents. The FTC contended that Rite Aid violated Section 5 of the FTC Act and a previous FTC order by failing to (1) implement reasonable procedures to prevent harm to consumers in its use of FRT and (2) adopt a comprehensive information security program and document retention procedure for vendor management.
In its proposed order,[1] which replaces and supersedes a 2010 administrative order binding Rite Aid, the FTC prohibits Rite Aid from using FRT for surveillance purposes for five years. Other requirements and restrictions mandate that Rite Aid:
- Satisfy various requirements regarding Rite Aid’s collection and use of biometric data before deploying or using any type of biometric technology again, including instituting a biometric system monitoring program, data retention and destruction schedules and guidelines, individualized and public notices and disclosures, and consumer complaint procedures.
- Delete all data, models, and algorithms developed or derived from Rite Aid’s improper use of facial biometrics (and notify all vendors and other third parties to do the same).
- Implement an information and security program to protect personal data collected and processed by Rite Aid or its service providers.
For companies, the FTC’s latest actions illustrate that there is a tangible law enforcement risk to the alleged misuse of artificial intelligence (AI) technology. The FTC’s action against Rite Aid demonstrates the Commission’s continued and increasing focus on AI and the ways in which AI impacts consumers. This comes as no surprise to Commission observers, who will recall that FTC Chair Lina Khan described generative AI as technology that risks “turbocharging fraud” in May 2023.
The Commission has signaled its intention to continue to monitor ways to protect consumers against the alleged misuse of AI technology by, for example, announcing a virtual summit on AI to take place later this month. And the Rite Aid case certainly will not be where the FTC’s law enforcement ends. In addition to its ongoing investigation of ChatGPT creator Open AI, the FTC issued a resolution in November 2023 streamlining Staff’s ability to use compulsory process such as Civil Investigative Demands to investigate products or services that use, are produced using, or that purport to detect the use of AI. Just last week, staff in the FTC’s Office of Technology warned that “[t]here is no AI exemption from the laws on the books.”
The FTC is not alone in its efforts. The Security and Exchange Commission recently cautioned business owners not to "AI wash" or mislead investors as to their true artificial intelligence capabilities, comparing the practice to "greenwashing" and saying that securities laws require "full, fair and truthful disclosure." Numerous State Attorneys General have similarly engaged in policy and/or enforcement activity that reflects an effort to create a law enforcement framework for scrutinizing the commercial use of AI technology.
We will continue to monitor these types of developments in the FTC, AI, and data privacy space.
[1] Rite Aid filed for Chapter 11 bankruptcy protection in October, 2023, and remains in bankruptcy proceedings. Final approval of the FTC’s proposed order has been stayed so that the parties can seek approval of the settlement from the bankruptcy court.
