Page 1 of 3

1823152 

UNITED STATES OF AMERICA 

BEFORE THE FEDERAL TRADE COMMISSION

COMMISSIONERS: Joseph J. Simons, Chairman 

Noah Joshua Phillips 

Rohit Chopra

Rebecca Kelly Slaughter 

Christine Wilson 

In the Matter of ) 

)

SecurTest, Inc., ) DOCKET NO.

a corporation. ) 

)

 ) 

COMPLAINT

The Federal Trade Commission (“FTC”), having reason to believe that SecurTest, Inc., a 

corporation, has violated provisions of the Federal Trade Commission Act (“FTC Act”), and it 

appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent SecurTest, Inc. (“SecurTest”) is a Florida corporation with its principal 

office or place of business at 600 Grand Panama Boulevard, Suite 202, Panama City 

Beach, FL 32407. 

2. Respondent offers background screening services.

3. The acts and practices of Respondent alleged in this complaint have been in or affecting 

commerce, as “commerce” is defined in Section 4 of the FTC Act.

4. Respondent has set forth on its website, http://securtest.com/, privacy policies and 

statements about its practices, including statements related to its participation in the EUU.S. Privacy Shield framework agreed upon by the U.S. government and the European 

Commission.

Privacy Shield

5. The EU-U.S. Privacy Shield framework (“Privacy Shield”) was designed by the U.S. 

Department of Commerce (“Commerce”) and the European Commission to provide a 

mechanism for U.S. companies to transfer personal data outside of the EU that is consistent 

with the requirements of the European Union Directive on Data Protection. Enacted in 1995, 
Page 2 of 3

the Directive sets forth EU requirements for privacy and the protection of personal data.

Among other things, it requires EU Member States to implement legislation that prohibits 

the transfer of personal data outside the EU, with exceptions, unless the European 

Commission has made a determination that the recipient jurisdiction’s laws ensure the 

protection of such personal data. This determination is referred to commonly as meeting the 

EU’s “adequacy” standard.

6. To satisfy the EU adequacy standard for certain commercial transfers, Commerce and the 

European Commission negotiated the EU-U.S. Privacy Shield framework, which went into 

effect in July 2016. The EU-U.S. Privacy Shield framework allows companies to transfer 

personal data lawfully from the EU to the United States. To join the EU-U.S. Privacy Shield 

framework, a company must self-certify to Commerce that it complies with the Privacy 

Shield Principles and related requirements that have been deemed to meet the EU’s adequacy 

standard. 

7. Companies under the jurisdiction of the FTC, as well as the U.S. Department of 

Transportation, are eligible to join the EU-U.S. Privacy Shield framework. A company 

under the FTC’s jurisdiction that claims it has self-certified to the Privacy Shield Principles, 

but failed to self-certify to Commerce, may be subject to an enforcement action based on the 

FTC’s deception authority under Section 5 of the FTC Act.

8. The Swiss-U.S. Privacy Shield framework is identical to the EU-U.S. Privacy Shield 

framework and is consistent with the requirements of the Swiss Federal Act on Data 

Protection. The Swiss-U.S. Privacy Shield framework went into effect in April 2017. 

9. Commerce maintains a public website, https://www.privacyshield.gov/welcome, where it 

posts the names of companies that have self-certified to the EU-U.S. and/or Swiss-U.S. 

Privacy Shield framework. The listing of companies, https://www.privacyshield.gov/list,

indicates whether the company’s self-certification is current.

10. Until July 2018, Respondent disseminated or caused to be disseminated privacy policies and 

statements on the http://securtest.com/2012/privacy_policy.php website, including, but not 

limited to, the following statements:

SecurTest, Inc. complies with the EU-US Privacy Shield 

Framework and the Swiss-US Privacy Shield Framework as set 

forth by the US Department of Commerce regarding the collection, 

use, and retention of personal information transferred from 

European Union and Switzerland to the United States, respectively. 

SecurTest, Inc. has certified to the Department of Commerce that it 

adheres to the Privacy Shield Principles. If there is any conflict 

between the terms in this privacy policy and the Privacy Shield 

Principles, the Privacy Shield Principles shall govern. To learn 

more about the Privacy Shield program, and to view our 

certification page, please visit https://www.privacyshield.gov/The
Page 3 of 3

[sic] terms of this policy apply to SecurTest’s Web site 

and Background Screening Solutions, except where noted.

11. Although Respondent initiated an application to Commerce in September of 2017 for 

Privacy Shield certification, and in October 2017 added language at the bottom of its 

webpage that its application was pending, Respondent did not complete the steps necessary 

to participate in the EU-U.S. Privacy Shield or Swiss-U.S. Privacy Shield frameworks 

within the timeframes established by Commerce. Nevertheless, Respondent continued to 

make the statements described in Paragraph 10 in its privacy policy until July 2018. After 

FTC Staff contacted Respondent regarding this matter, Respondent completed the steps 

necessary to participate in the frameworks and received its certification on August 31, 

2018.

Count I

Privacy Misrepresentation

12. As described in Paragraph 10, from September 2017 until July 2018, Respondent 

represented, directly or indirectly, expressly or by implication, that it was a participant in 

the EU-U.S Privacy Shield framework and the Swiss-U.S Privacy Shieldframework.

13. In fact, as described in Paragraph 11, although Respondent initiated an application to 

Commerce for Privacy Shield certification, it did not complete the steps necessary to

participate in either the EU-U.S. Privacy Shield framework or the Swiss-U.S Privacy Shield 

framework until August 2018. Therefore, the representation set forth in Paragraph 12 was 

false or misleading.

Violations of Section 5 of the FTC Act

14. The acts and practices of Respondent as alleged in this complaint constitute deceptive acts or 

practices, in or affecting commerce, in violation of Section 5(a) of the Federal Trade 

Commission Act.

THEREFORE, the Federal Trade Commission day of , 2019, has 

issued this complaint against Respondent.

By the Commission.

April J. Tabor 

Acting Secretary

SEAL: