Victoria’s Secret to improve online privacy in settlement with New York

Victoria’s Secret will improve its methods of securing online customer data and hire an outside auditor to annually monitor its security system under a settlement with the New York State Attorney General’s Office announced today. The settlement is the result of an investigation by New York into VictoriasSecret.com’s policy of guarding consumer data following a customer’s revelation last year that he was able to access information on what several hundred customers had ordered online. The settlement also requires the retailer to pay $50,000 in legal fees.

"A business that obtains consumers` personal information has a legal duty to ensure that the use and handling of that data complies in all respects with representations made about the company`s information security and privacy practices," Attorney General Eliot Spitzer said. He said the security breach directly conflicted with the retailer’s policy, published on its web site, under which Victoria’s Secret promises: "Any information you provide to us at this site when you establish or update an account, enter a contest, shop online or request information . . . is maintained in private files on our secure web server and internal systems."

IRCE 2008 Conference Multi-Media CD-ROM

Although a published report yesterday indicated that information may have been exposed on 560 VictoriasSecret.com customers, a spokesman for Spitzer said the Attorney General’s office figured the actual number to be higher but was unable to elaborate.

Victoria’s Secret and its parent, Limited Brands, declined to comment directly on the settlement. But a spokesman for Limited acknowledged that Victoria’s Secret had experienced a security problem and had taken measures to fix it. "We take issues of maintaining our customers’ privacy very seriously," he says. "When we became aware of the matter we addressed it."

Under the terms of the settlement, Victoria’s Secret agreed to the following, according to Spitzer’s office:
-- Establish and maintain an information security program to protect personal information;
-- Establish management oversight and employee training programs;>br> -- Hire an external auditor to annually monitor compliance with the security program;
-- Provide refunds or credits to all affected New York consumers.