UNITED STATES OF AMERICA 

Federal Trade Commission 

WASHINGTON, D.C. 20580 

Office of Commissioner 

Rebecca Kelly Slaughter 

STATEMENT OF COMMISSIONER REBECCA KELLY SLAUGHTER 

In the Matter of Drizly 

October 21, 2022 

The kinds of lax and unreasonable data security practices the Commission has alleged in 

this settlement with Drizly1 have caused immense and often incalculable harm to consumers. As 

the complaint recounts, Drizly’s carelessness with customer information led to an intruder 

gaining access to its systems and downloading the personal information of 2.5 million people. 

This order is commendable and marks a meaningful step forward in our data security 

enforcement. Naming Drizly’s CEO, James Corey Rellas, who oversaw these practices, helps 

ensure that corporate leadership must take seriously their obligation to safeguarding customer 

information. Mechanisms like the proposed data retention schedule are also an excellent 

approach to provide accountability for data use and misuse. Ensuring that Drizly only collects 

information necessary to effectuate its published business needs should exert a disciplining 

influence on its collection of consumer information. The retention schedule also provides a clear 

hook for future FTC enforcement actions should Drizly not follow its strict requirements under 

this proposed order. 

Going forward, I believe the law would support us doing more to safeguard Americans’ 

data, including requiring substantive limits on appropriate collection and use. While the 

disclosure requirements in this order have value, disclosure alone is not enough. We know that 

endless terms-of-service and other disclosures have not improved customer understanding, 

facilitated meaningful choice, or protected data from security breaches. But hackers cannot steal 

data that companies did not collect in the first place; requirements that limit what data can be 

collected, used, and retained could meaningfully foil and deter data security breaches. 

There are many ways to approach data collection guardrails. As the FTC further develops 

a minimization framework, one framework I hope we consider is centering a consumer’s 

reasonable expectation that there should be limits on the collection and use of their information 

based on the service they’ve actually requested. I believe the agency is in a better position to 

effectuate this expectation than it is to anticipate, understand, and police every claim of 

reasonable business necessity. 

1

Drizly is now a wholly owned subsidiary of Uber which reached a settlement with the FTC over its allegedly lax 

data security practices in 2018. I worry greatly about this matryoshka doll of companies with a spotty track record of 

protecting consumer data. 

1 
 

A consumer centered data minimization standard could work hand-in-hand with the kinds 

of disclosures and effective data security practices in this proposed order to protect Americans 

from the ongoing epidemic of data breaches, which are greatly exacerbated by overcollection of 

consumer information. 

I am grateful to the staff for their hard work on this strong order. I look forward to seeing 

how our work continues to evolve in the pursuit of protecting Americans’ data and ensuring our 

confidence in the practices of the businesses with which we all transact. 

2