Federal Register / Vol. 77, No. 11 / Wednesday, January 18, 2012 / Notices 2543 

1 In particular, the written request for confidential 

treatment that accompanies the comment must 

include the factual and legal basis for the request, 

and must identify the specific portions of the 

comment to be withheld from the public record. See 

FTC Rule 4.9(c), 16 CFR 4.9(c). 

PLACE: 999 E Street NW., Washington, 

DC (Ninth Floor). 

STATUS: This meeting will be open to 

the public. 

CHANGES IN THE MEETING: The following 

item has been added to the agenda: 

Draft Advisory Opinion 2011–24: 

Louder Solutions, LLC d/b/a 

StandLouder.com. 

Individuals who plan to attend and 

require special assistance, such as sign 

language interpretation or other 

reasonable accommodations, should 

contact Shawn Woodhead Werth, 

Secretary, at (202) 694–1040, at least 72 

hours prior to the meeting date. 

PERSON TO CONTACT FOR INFORMATION: 

Judith Ingram, Press Officer, Telephone: 

(202) 694–1220. 

Shawn Woodhead Werth, 

Secretary of the Commission. 

[FR Doc. 2012–934 Filed 1–13–12; 11:15 am] 

BILLING CODE 6715–01–P 

FEDERAL TRADE COMMISSION 

[File No. 102 3116] 

Upromise, Inc.; Analysis of Proposed 

Consent Order to Aid Public Comment 

AGENCY: Federal Trade Commission. 

ACTION: Proposed consent agreement. 

SUMMARY: The consent agreement in this 

matter settles alleged violations of 

federal law prohibiting unfair or 

deceptive acts or practices or unfair 

methods of competition. The attached 

Analysis to Aid Public Comment 

describes both the allegations in the 

draft complaint and the terms of the 

consent order—embodied in the consent 

agreement—that would settle these 

allegations. 

DATES: Comments must be received on 

or before February 6, 2012. 

ADDRESSES: Interested parties may file a 

comment online or on paper, by 

following the instructions in the 

Request for Comment part of the 

SUPPLEMENTARY INFORMATION section 

below. Write ‘‘Upromise, File No. 102 

3116’’ on your comment, and file your 

comment online at https:// 

ftcpublic.commentworks.com/ftc/ 

upromiseconsent, by following the 

instructions on the web-based form. If 

you prefer to file your comment on 

paper, mail or deliver your comment to 

the following address: Federal Trade 

Commission, Office of the Secretary, 

Room H–113 (Annex D), 600 

Pennsylvania Avenue NW., Washington, 

DC 20580. 

FOR FURTHER INFORMATION CONTACT: 

Ruth Yodaiken (202) 326–2127 or 

Katrina Blodgett (202) 326–3158, FTC, 

Bureau of Consumer Protection, 600 

Pennsylvania Avenue NW., Washington, 

DC 20580. 

SUPPLEMENTARY INFORMATION: Pursuant 

to section 6(f) of the Federal Trade 

Commission Act, 38 Stat. 721, 15 U.S.C. 

46(f), and § 2.34 the Commission Rules 

of Practice, 16 CFR 2.34, notice is 

hereby given that the above-captioned 

consent agreement containing a consent 

order to cease and desist, having been 

filed with and accepted, subject to final 

approval, by the Commission, has been 

placed on the public record for a period 

of thirty (30) days. The following 

Analysis to Aid Public Comment 

describes the terms of the consent 

agreement, and the allegations in the 

complaint. An electronic copy of the 

full text of the consent agreement 

package can be obtained from the FTC 

Home Page (for January 5, 2012), on the 

World Wide Web, at http://www.ftc.gov/ 

os/actions.shtm. A paper copy can be 

obtained from the FTC Public Reference 

Room, Room 130–H, 600 Pennsylvania 

Avenue NW., Washington, DC 20580, 

either in person or by calling (202) 326– 

2222. 

You can file a comment online or on 

paper. For the Commission to consider 

your comment, we must receive it on or 

before February 6, 2012. Write 

‘‘Upromise, File No. 102 3116’’ on your 

comment. Your comment—including 

your name and your state—will be 

placed on the public record of this 

proceeding, including, to the extent 

practicable, on the public Commission 

Web site, at http://www.ftc.gov/os/ 

publiccomments.shtm. As a matter of 

discretion, the Commission tries to 

remove individuals’ home contact 

information from comments before 

placing them on the Commission Web 

site. 

Because your comment will be made 

public, you are solely responsible for 

making sure that your comment does 

not include any sensitive personal 

information, like anyone’s Social 

Security number, date of birth, driver’s 

license number or other state 

identification number or foreign country 

equivalent, passport number, financial 

account number, or credit or debit card 

number. You are also solely responsible 

for making sure that your comment does 

not include any sensitive health 

information, like medical records or 

other individually identifiable health 

information. In addition, do not include 

any ‘‘[t]rade secret or any commercial or 

financial information which is obtained 

from any person and which is privileged 

or confidential,’’ as provided in Section 

6(f) of the FTC Act, 15 U.S.C. 46(f), and 

FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). 

In particular, do not include 

competitively sensitive information 

such as costs, sales statistics, 

inventories, formulas, patterns, devices, 

manufacturing processes, or customer 

names. 

If you want the Commission to give 

your comment confidential treatment, 

you must file it in paper form, with a 

request for confidential treatment, and 

you have to follow the procedure 

explained in FTC Rule 4.9(c), 16 CFR 

4.9(c).1 Your comment will be kept 

confidential only if the FTC General 

Counsel, in his or her sole discretion, 

grants your request in accordance with 

the law and the public interest. 

Postal mail addressed to the 

Commission is subject to delay due to 

heightened security screening. As a 

result, we encourage you to submit your 

comments online. To make sure that the 

Commission considers your online 

comment, you must file it at https:// 

ftcpublic.commentworks.com/ftc/ 

upromiseconsent by following the 

instructions on the web-based form. If 

this Notice appears at http:// 

www.regulations.gov/#!home, you also 

may file a comment through that Web 

site. 

If you file your comment on paper, 

write ‘‘Upromise, File No. 102 3116’’ on 

your comment and on the envelope, and 

mail or deliver it to the following 

address: Federal Trade Commission, 

Office of the Secretary, Room H–113 

(Annex D), 600 Pennsylvania Avenue 

NW., Washington, DC 20580. If possible, 

submit your paper comment to the 

Commission by courier or overnight 

service. 

Visit the Commission Web site at 

http://www.ftc.gov to read this Notice 

and the news release describing it. The 

FTC Act and other laws that the 

Commission administers permit the 

collection of public comments to 

consider and use in this proceeding as 

appropriate. The Commission will 

consider all timely and responsive 

public comments that it receives on or 

before February 6, 2012. You can find 

more information, including routine 

uses permitted by the Privacy Act, in 

the Commission’s privacy policy, at 

http://www.ftc.gov/ftc/privacy.htm. 

Analysis of Agreement Containing 

Consent Order To Aid Public Comment 

The Federal Trade Commission has 

accepted, subject to final approval, an 


tkelley on DSK3SPTVN1PROD with NOTICES
2544 Federal Register / Vol. 77, No. 11 / Wednesday, January 18, 2012 / Notices 

agreement containing a consent order 

applicable to Upromise, Inc. 

The proposed consent order has been 

placed on the public record for thirty 

(30) days for receipt of comments by 

interested persons. Comments received 

during this period will become part of 

the public record. After thirty (30) days, 

the Commission will again review the 

agreement and the comments received, 

and will decide whether it should 

withdraw from the agreement and take 

appropriate action or make final the 

agreement’s proposed order. 

Upromise offers, among other things, 

a membership service through which 

consumers who join can receive cash 

rebates for making online purchases 

from merchants who participate in the 

Upromise program. To take part in the 

program, consumers download and 

install software, the Upromise 

TurboSaver Toolbar (‘‘Toolbar’’), from 

Upromise that modifies the consumers’ 

Internet browser to highlight Upromise 

member merchants. 

The Commission’s complaint involves 

the advertising, marketing, and 

operation of an optional feature of that 

Toolbar, the ‘‘personalized offers’’ 

feature. That feature modified the 

Toolbar to provide targeted advertising 

to the consumer based upon the 

consumers’ online behavior (the 

modified version is referred to here as 

the ‘‘Targeting Tool’’). Upromise 

engaged a service provider to develop 

the Toolbar and the personalized offers 

feature. 

According to the FTC complaint, 

while Upromise represented to 

consumers that the Targeting Tool 

collected information about the web 

sites consumers visited, its failure to 

disclose the full extent of data collected 

through the software was deceptive. The 

complaint alleges that the Targeting 

Tool collected the names of all Web 

sites visited; all links clicked; 

information that consumers entered into 

some web pages such as usernames, 

passwords, and search terms; and, from 

July 2009 through mid-January 2010, 

consumers’ interactions with forms on 

secure web pages. The complaint further 

alleges that Upromise misrepresented its 

privacy and security practices, 

including misrepresenting that 

consumers’ data would be encrypted. 

The complaint alleges that these claims 

were false and thus violate Section 5 of 

the FTC Act. 

In addition, the FTC complaint alleges 

that Upromise engaged in a number of 

practices that, taken together, failed to 

provide reasonable and appropriate 

security for the personal information it 

collected and maintained. Among other 

things, Upromise: (1) Transmitted 

sensitive information from secure web 

pages, such as financial account 

numbers and security codes, in clear 

readable text; (2) did not use readily 

available, low-cost measures to assess 

and address the risks to consumer 

information; (3) failed to ensure that 

employees responsible for the 

information collection program received 

adequate guidance and training; (4) 

failed to take adequate measures to 

ensure that its service provider 

employed reasonable and appropriate 

measures to protect consumer 

information. 

The complaint alleges that Upromise’s 

failure to employ reasonable and 

appropriate measures to protect 

consumer information—including credit 

card and financial account numbers, 

security codes and expiration dates, and 

Social Security numbers—was unfair. 

Tools for capturing data in transit, for 

example over unsecured wireless 

networks such as those often provided 

in coffee shops and other public spaces, 

are commonly available, making such 

clear-text data vulnerable to 

interception. The misuse of such 

information—particularly financial 

account information and Social Security 

numbers—can facilitate identity theft 

and related consumer harms. 

The proposed order contains 

provisions designed to prevent 

Upromise from engaging in the future in 

practices similar to those alleged in the 

complaint. 

Part I of the proposed order requires 

Upromise to disclose to consumers— 

before the download or installation of 

software that records or transmits 

information about any activity occurring 

on a computer involving the computer’s 

interactions with Web sites, services, 

applications, or forms—the types of 

information collected and how the 

information will be used. The disclosure 

must be clear and prominent and 

separate from other notices. The 

company must also obtain consumers’ 

express affirmative consent before the 

consumer downloads, installs, or 

otherwise activates such software. In 

addition, the company must provide 

this clear and prominent notice, and 

obtain express affirmative consent, 

before enabling data collection through 

any previously installed TurboSaver 

Toolbar and before making any material 

change from stated practices about 

collection or sharing of personal 

information through the Toolbar. 

Part II of the proposed order requires 

Upromise to provide notice to 

consumers who, prior to the issuance of 

the order, had the Personalized Offers 

feature enabled. The notice must inform 

consumers about the categories of 

personal information that were, or could 

have been, transmitted by the feature, 

and how to disable the Personalized 

Offers feature and uninstall the Toolbar. 

Part III of the proposed order requires 

the company to destroy data it collected 

during the years covered by the 

complaint unless otherwise directed by 

the Commission. 

Part IV of the proposed order 

prohibits the company from making any 

misrepresentations about the extent to 

which it maintains and protects the 

security, privacy, confidentiality, or 

integrity of any information collected 

from or about consumers. Part V of the 

proposed complaint requires Upromise 

to maintain a comprehensive 

information security program that is 

reasonably designed to protect the 

security, confidentiality, and integrity of 

such information (whether in paper or 

electronic format) about consumers. The 

security program must contain 

administrative, technical, and physical 

safeguards appropriate to Upromise’s 

size and complexity, the nature and 

scope of its activities, and the sensitivity 

of the information collected from or 

about consumers and employees. 

Specifically, the proposed order 

requires Upromise to: 

• Designate an employee or 

employees to coordinate and be 

accountable for the information security 

program; 

• Identify material internal and 

external risks to the security, 

confidentiality, and integrity of personal 

information that could result in the 

unauthorized disclosure, misuse, loss, 

alteration, destruction, or other 

compromise of such information, and 

assess the sufficiency of any safeguards 

in place to control these risks; 

• Design and implement reasonable 

safeguards to control the risks identified 

through risk assessment, and regularly 

test or monitor the effectiveness of the 

safeguards’ key controls, systems, and 

procedures; 

• Develop and use reasonable steps to 

select and retain service providers 

capable of appropriately safeguarding 

personal information they receive from 

Upromise or obtain on behalf of 

Upromise, and require service providers 

by contract to implement and maintain 

appropriate safeguards; and 

• Evaluate and adjust its information 

security programs in light of the results 

of testing and monitoring, any material 

changes to operations or business 

arrangements, or any other 

circumstances that it knows or has 

reason to know may have a material 

impact on its information security 

program. 


tkelley on DSK3SPTVN1PROD with NOTICES
Federal Register / Vol. 77, No. 11 / Wednesday, January 18, 2012 / Notices 2545 

Part VI of the proposed order requires 

Upromise to obtain within the first one 

hundred eighty (180) days after service 

of the order, and on a biennial basis 

thereafter for a period of twenty (20) 

years, an assessment and report from a 

qualified, objective, independent thirdparty professional, certifying, among 

other things, that: (1) It has in place a 

security program that provides 

protections that meet or exceed the 

protections required by the proposed 

order; and (2) its security program is 

operating with sufficient effectiveness to 

provide reasonable assurance that the 

security, confidentiality, and integrity of 

sensitive consumer, employee, and job 

applicant information has been 

protected. 

Parts VII, VIII, IX, X, XI, and XII of the 

proposed order are reporting and 

compliance provisions. Part VII requires 

Upromise to retain documents relating 

to its compliance with the order. For 

most records, the order requires that the 

documents be retained for a five-year 

period. For the third-party assessments 

and supporting documents, Upromise 

must retain the documents for a period 

of three years after the date that each 

assessment is prepared. Part VIII 

requires the company to cooperate with 

the FTC in connection with this action 

or any subsequent investigations related 

to or associated with the transactions or 

the occurrences that are the subject of 

the FTC complaint. Part IX requires 

dissemination of the order now and in 

the future to persons with 

responsibilities relating to the subject 

matter of the order. Part X ensures 

notification to the FTC of changes in 

corporate status. Part XI mandates that 

Upromise submit a compliance report to 

the FTC within 60 days, and 

periodically thereafter as requested. Part 

XII provides that the order will 

terminate after twenty (20) years, with 

certain exceptions. 

The purpose of this analysis is to 

facilitate public comment on the 

proposed order. It is not intended to 

constitute an official interpretation of 

the proposed order or to modify its 

terms in any way. 

By direction of the Commission. 

Richard C. Donohue, 

Acting Secretary. 

[FR Doc. 2012–750 Filed 1–17–12; 8:45 am] 

BILLING CODE 6750–01–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Designation of a Class of Employees 

for Addition to the Special Exposure 

Cohort 

AGENCY: National Institute for 

Occupational Safety and Health 

(NIOSH), Department of Health and 

Human Services (HHS). 

ACTION: Notice. 

SUMMARY: HHS gives notice of a 

decision to designate a class of 

employees from the Pantex Plant in 

Amarillo, Texas, as an addition to the 

Special Exposure Cohort (SEC) under 

the Energy Employees Occupational 

Illness Compensation Program Act of 

2000. On December 21, 2011, the 

Secretary of HHS designated the 

following class of employees as an 

addition to the SEC: 

All employees of the Department of 

Energy, its predecessor agencies, and their 

contractors and subcontractors who worked 

at the Pantex Plant in Amarillo, Texas, 

during the period from January 1, 1958 

through December 31, 1983, for a number of 

work days aggregating at least 250 work days, 

occurring either solely under this 

employment or in combination with work 

days within the parameters established for 

one or more other classes of employees 

included in the SEC. 

This designation will become 

effective on January 20, 2012 unless 

Congress provides otherwise prior to the 

effective date. After this effective date, 

HHS will publish a notice in the 

Federal Register reporting the addition 

of this class to the SEC or the result of 

any provision by Congress regarding the 

decision by HHS to add the class to the 

SEC. 

FOR FURTHER INFORMATION CONTACT: 

Stuart L. Hinnefeld, Director, Division 

of Compensation Analysis and Support, 

NIOSH, 4676 Columbia Parkway, MS C– 

46, Cincinnati, OH 45226, Telephone 1– 

(877) 222–7570. Information requests 

can also be submitted by email to 

DCAS@CDC.GOV. 

John Howard, 

Director, National Institute for Occupational 

Safety and Health. 

[FR Doc. 2012–850 Filed 1–17–12; 8:45 am] 

BILLING CODE 4163–19–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Announcement of the Requirements 

and Registration for the Healthy New 

Year Challenge 

AGENCY: Office of the National 

Coordinator for Health Information 

Technology, HHS. 

Award Approving Official: Erin 

Poetter, Consumer e-Health Policy 

Analyst. 

ACTION: Notice. 

SUMMARY: The Office of the National 

Coordinator for Health Information 

Technology (ONC), part of the 

Department of Health and Human 

Services (HHS), is announcing the 

launch of the Healthy New Year 

Challenge. This challenge is an open 

call for people nationwide to create and 

submit short videos that capture New 

Year’s resolutions geared towards 

improving their health or the health of 

a loved one through the use of 

technology. The Healthy New Year 

Challenge is the first in a series of video 

contests for the public to share their 

personal stories about how they use 

health information technology (health 

IT) or consumer e-health tools to impact 

their health or the health of a loved one. 

The goal of this video contest series is 

to generate winning videos that will be 

used to motivate and inspire others and 

their loved ones to use health 

information technology to be more 

engaged partners in improving health 

and health care. Each challenge will be 

a call to action for members of the 

public to create a short video clip [2 

minutes or less] on a particular theme, 

and will award cash prizes to winners 

in several categories. 

DATES: Important date(s) for this 

challenge are: 

Submission Period: today–February 

16, 2012. 

Public Voting: today–March 8, 2012. 

Judging: February 23–March 8, 2012. 

Winners Announced: Mid-March 

2012. 

FOR FURTHER INFORMATION CONTACT: Erin 

Poetter, Consumer e-Health Policy 

Analyst, ONC, HHS, 

erin.poetter@hhs.gov or (202) 205–3310. 

SUPPLEMENTARY INFORMATION: 

Subject of Challenge Competition: 

Entrants are asked to create a short, 

compelling video (up to 2 minutes in 

length) sharing one New Year’s 

resolution for improving your health or 

the health of a loved one, and how you 

will use technology to achieve your 

resolution. Videos should be creative, 

inspiring and instructive—share a new 


tkelley on DSK3SPTVN1PROD with NOTICES