The FTC will require Global Tel-Link, a provider of inmate communications services, and two of its subsidiaries to notify consumers of any future data breaches “as part of a proposed settlement over charges they failed to secure sensitive data of hundreds of thousands of users stored in a cloud environment,” said the agency Thursday. The commission also alleges that GTL and the subsidiaries “failed to alert all those affected by the incident.” The FTC’s complaint alleges GTL and the subsidiaries “failed to implement adequate security safeguards to protect personal information they collect from users of its services,” it said. That enabled bad actors “to gain access to unencrypted personal information stored in the cloud and used for testing,” it said. The complaint alleges GTL and the subsidiaries violated Section 5(a) of the FTC Act when they made numerous false and deceptive promises to protect the sensitive personally identifiable information that they collect in connection with offering their products and services. The companies then failed to provide timely notice to affected consumers so that they could take steps to protect themselves from identity theft, the FTC said. They also made multiple misleading representations about the data security incident. As part of a proposed order with the FTC, GTL and the subsidiaries will be required to implement a “comprehensive data security program” to prevent future breaches, said the agency. The companies also will need to notify users of its products affected by the data breach who didn’t previously receive notice, and provide them with credit monitoring and identity protection products, it said.

West Caldwell, New Jersey, resident Dennis DePalma became a victim of cryptocurrency fraud March 21 when a John Doe “scammer” stole nearly $34,000 from his Coinbase account through a SIM swap at a Verizon store in Woodbury, Minnesota, that Verizon should have prevented, alleged his complaint against Verizon Monday (docket 2:23-cv-22318) in U.S. District Court for New Jersey in Newark. A SIM swap “allows scammers to circumvent multi-factor authentication for websites or accounts that use text messages to seek approval,” said the complaint. Scammers “switch the assigned phone number from the victim’s SIM card to a new one they purchase from the cellphone provider,” it said. DePalma alleges that a manager at the Woodbury location, known only by his first name, Joshua, “allowed himself to sign off” on the scammer who identified himself as DePalma “with no sort of verification,” said the complaint. SIM swaps shouldn’t be completed “without customer verification,” it said. The employee must get a PIN, a photo ID or email confirmation to complete a SIM swap, but Joshua didn’t do “his due diligence in this circumstance,” it said. Verizon is liable for a violation of Sections 217 and 222 of the Federal Communications Act because its employee, Joshua, “was acting within the scope of his employment” when he transferred DePalma’s cellphone number to a new SIM card for the scammer, it said. Verizon also “owed a duty” to DePalma “to exercise reasonable care” to protect his personal information “and prevent it from being compromised,” it said. That duty “required Verizon to design, maintain, and test its security measures to ensure the safety and protection” of customers’ personal information, it said. Verizon also had a duty to use “verification protocol” and ensure that its employees “adhere to it,” it said. The complaint seeks compensatory and punitive damages, plus attorneys’ fees and court costs.

SiriusXM seeks oral argument on its Aug. 18 motion to dismiss the class action fraud complaint filed June 5 by plaintiffs Christopher Carovillano and Steven Brandt (see 2306060004), SiriusXM counsel Eric Stephens of Jones Day wrote U.S. District Judge Paul Engelmayer for Southern New York in Manhattan in a letter Monday (docket 1:23-cv-04723). In one of a multitude of similar class actions filed earlier this year, Carovillano and Brandt allege that SiriusXM engages in a “false advertising and deceptive pricing scheme” when it markets and promotes its music plans “at lower prices than it actually charges.”

Basket Entertainment, a developer of online games and mobile apps for the Roblox platform, hired John Cannata as a vice president and added him to its board in July to identify acquisition targets to grow its user base, but Cannata almost immediately “engaged in an outrageous campaign of double-dealing,” alleged Basket’s complaint Monday (docket 2:23-cv-01028) in U.S. District Court for Middle Florida in Fort Myers. Basket alleges Cannata went behind the company’s back and acquired ownership interests in at least two online games for himself “without ever presenting them as opportunities” to his employer, said the complaint. The “usurped games” continue to generate millions of dollars in monthly revenue for Cannata, who “actively concealed his misconduct,” and later “misrepresented his prior and ongoing negotiations and transactions” with the games’ creators, it said. Cannata also “surreptitiously acquired an interest in derivative games that directly compete” with Basket’s titles, it said. In so doing, Cannata “flagrantly breached the most basic fiduciary duties a director and officer owes to a corporation,” said the complaint. Cannata “usurped these lucrative corporate opportunities while Basket was in the middle of a capital raise, causing Basket reputational harm and disrupting cash flow that could have been used to acquire games,” it said. The 12-count complaint seeks compensatory damages and disgorgement of the profits Cannata earned, plus punitive damages “to the extent allowed by law to punish Cannata for the intentional wrongful acts.” Efforts to reach Cannata for comment Tuesday were unsuccessful.

Plaintiff Waleed Lashin is voluntarily dismissing without prejudice all his claims against T-Mobile arising from a data breach that began Feb. 24 (see 2306090049), said his notice of dismissal Monday (docket 4:23-cv-00393). Lashin’s June 8 complaint alleged that T-Mobile downplayed the severity of the breach and that it didn’t notify customers whose personally identifiable information was exposed until April 28, more than two months after the breach began. T-Mobile hasn’t filed an answer to the complaint or a motion for summary judgment, and the case isn’t governed “by any federal statute that requires a court order for dismissal,” said Lashin’s notice.

U.S. District Judge James Whitehead for Western Washington in Seattle ordered three lawsuits against Amazon over its return policies to be consolidated, said his signed order Monday (docket 2:23-cv-01372). Plaintiffs Laura Abbott, Sima Hernandez, Melissa Urbancic, and Jill Cappel filed a putative class action against Amazon, alleging e-tailer violated its refund and exchange policy by charging them for purchases they had returned. Plaintiff Sumeet Srivastava’s October complaint alleges Amazon keeps money owed to its customers who timely followed its return policies. The plaintiffs in the two cases filed a stipulated motion last month to consolidate cases, but they disagreed about whether they should file a joint complaint (see 2310250016). While their motions were pending, plaintiff Holly Clark filed another class action (docket 23-cv-01702) vs. Amazon, defining her class as customers who were charged by Amazon for failing to return a product that was timely returned in its original condition during the six years prior to the filing of the action. Amazon’s notice of related cases described a “complete overlap of the case,” said the order. Rule 42(a) of the Federal Rules of Civil Procedure allows district courts to consolidate actions that involve a common question of law or fact, but the cases “need not be identical as a prerequisite to consolidation,” noted Whitehead, saying district courts have “broad discretion under this rule to consolidate cases pending in the same district.” The Abbott and Srivastava parties believe consolidation is warranted because their cases involve the same defendant and overlapping factual and legal issues, and the court agreed. The Clark case also has the same defendant and overlapping factual and legal issues, Whitehead said. “To promote judicial economy, ensure consistent results, and to streamline matters overall,” he granted parties’ motion to consolidate and “consolidates the Clark case sua sponte,” the order said. Whitehead struck Amazon’s motion to dismiss Abbott et al. vs. Amazon without prejudice.

U.S. District Judge John Chun for Western Washington in Seattle granted four motions for leave to file amicus briefs in support of Amazon’s motion to dismiss the FTC’s Restore Online Shoppers’ Confidence Act's (ROSCA) claim that Amazon uses unfair competitive methods for enabling subscriptions and cancellations, said his signed order Monday (docket 2:23-cv-00932). In its Monday reply in support of its motion for leave to file an amicus brief, the U.S. Chamber of Commerce expressed concern that the FTC “intends to use a favorable decision here as a cudgel to intimidate other businesses into abandoning lawful and beneficial marketing practices.” A holding in the FTC’s favor in the case “would have wider ramifications beyond the parties, including by creating uncertainty and harming businesses (particularly small businesses), consumers, and innovation,” the Chamber said. Chun also granted the motions of The Computer & Communications Industry Association, NetChoice and Chamber of Progress; the Interactive Advertising Bureau; and the Association of Corporate Counsel, the order said.

Verizon reached a settlement in principle with 27 consumers in its 9th U.S. Circuit Court of Appeals challenge of the district court’s July 1 decision denying its motion to compel the consumers’ claims to arbitration (see 2303190001), said their joint notice of settlement Thursday (docket 22-16020). The appeal had been scheduled for Tuesday oral argument before the 9th Circuit (see 2309110041). Verizon and the plaintiffs ask that the case be removed from the argument calendar and “held in abeyance pending consummation of the settlement,” said the notice. The case originated from a November 2021 class action challenging Verizon’s alleged practice of padding consumers’ monthly wireless bills with a secretive “administrative charge” that kept climbing higher and higher above the flat monthly rates it was advertising.

U.S. District Judge Cristina Silva for Nevada in Las Vegas granted the motion of defendant Zuffa, 49.9% owner of Ultimate Fighting Championship, to consolidate three class actions that allege the company violated the California Automatic Renewal Law (ARL) for the manner in which it runs the UFC Fight Pass streaming service (see 2308100002), said the judge’s signed order Wednesday. The six plaintiffs in the three class actions failed to respond to Zuffa’s motion to consolidate, and the motion “may be granted on this reason alone,” said Silva’s order. The court also finds that “consolidation is appropriate because there are common questions of law and fact” among the three class actions, it said. The first-filed class action, Reza et al v. Zuffa (docket 2:23-cv-00802) will serve as the lead case, said the judge’s order. The plaintiffs are to file a consolidated amended complaint within 30 days of an order appointing interim class counsel, it said: “The consolidated complaint will be the operative complaint in the consolidated action and shall supersede all complaints filed in any action consolidated herein.” The plaintiffs allege they're improperly charged monthly or yearly fees for the UFC Fight Pass subscription steaming service without proper disclosures under the ARL that the service would automatically renew or how to cancel it.

Florida’s October fraud lawsuit (docket 8:23-cv-02412) against Meta and its Instagram platform has been transferred to In Re: Social Media Adolescent Addiction/Personal Injury Products Liability Litigation, said conditional transfer order 21 (docket 3047) before the U.S. Judicial Panel on Multidistrict Litigation Wednesday. The complaint asserts Meta and Instagram violated the Children's Online Privacy Protection and Florida Deceptive and Unfair Trade Practices acts. Since Oct. 6, 2022, when 20 actions were transferred to U.S. District Court for Northern California under U.S. District Judge Yvonne Gonzalez Rogers, 110 additional actions have been transferred to the court, said the order. The Florida attorney general’s lawsuit alleges Facebook and Instagram social media platforms “cause serious harm to children, parents, and the community at large by deploying algorithms and other features designed to hijack the attention of its users, barrage them with advertisements, and relentlessly mine their interactions for monetizable data.” Transmittal of the order is stayed for seven days, pending a notice of opposition, it said.