The Federal Trade Commission (“FTC” or “Commission”) recently announced a settlement in a privacy enforcement action that sets new precedents and sends new signals to privacy professionals about current FTC expectations. The case against Google for its Google Buzz social medial service rollout is the Commission’s first case alleging substantive violations of the U.S.-EU Safe Harbor provisions and its first settlement requiring the implementation of a comprehensive “privacy by design” program for all future products and services and also requiring biannual, independent privacy audits for twenty years. The settlement also requires Google to get opt-in consent for secondary uses or disclosures of data.

The settlement is now open for public comment, which the FTC will receive until May 2, after which it will determine whether to make the settlement final or alter its requirements.