H&R Block has settled several consumer protection-related lawsuits over the years, including a $1.6 million settlement in January with the City of Los Angeles. But its most recent showdown comes from the top: the Federal Trade Commission.
The FTC raised the flag earlier this year after consumers complained about H&R Block’s seemingly free tax preparation plan and confusing process to downgrade purchased plans. The FTCs’ readiness toward legal action against companies over personal data collection and use shows an effective records and information management program is crucial to safeguarding corporate financial health and sustainability.
Allegations of Data-Deletion Practices Against H&R Block
In late February 2024, the FTC filed an administrative complaint against the well-known tax filing company alleging two of its policies were unfair and violated antitrust laws. H&R Block advertised a free and simple tax plan to consumers, but according to the FTC, using the plan was anything but.
According to the complaint, H&R Block provided multiple tax plans, including the free plan. The FTC alleges when consumers went to obtain the free plan, H&R Block coerced them into purchasing a plan with more options. The FTC alleges throughout the online registration process, H&R Block upsold consumers more expensive services and failed to provide a clear breakdown of costs. And while H&R Block allowed consumers to obtain and upgrade services online, downgrading was not as simple. Consumers who easily signed up for a more expensive service online needed to personally contact H&R Block’s customer service department to downgrade, which often resulted in a lengthy exchange with the company.
The FTC has also alleged when consumers requested a downgrade, H&R Block gave them an unfair choice: pay for a more expensive plan they did not want, or downgrade and lose all their previously entered information. The FTC says these practices cost unwitting consumers time and money.
The FTC’s Legal Basis Against Wrongful Deletion
The Fair Information Practice Principles (“FIPPs”) are a collection of principles long used to evaluate information systems and activities that affect individual privacy. For many years, the FIPPs have informed data privacy laws around the globe on how governments and commercial actors alike should approach collecting and processing information about people.
While the U.S. currently has no comprehensive data privacy law, the FTC has broad enforcement authority to regulate unfair and deceptive commercial practices under Section 5 of the FTC Act. The main purpose of the FTC Act is to protect consumers and foster a competitive and transparent business environment.1
In the case against H&R Block—and in others—the FTC’s broad enforcement authority has allowed it to enforce the spirit of the Fair Information Practice Principles (“FIPPs”). For example, H&R Blocks’ alleged conduct, if proven, would violate two of the FIPPs: the Purpose specification and use limitation principles. Under these principles, anyone collecting personal information must provide notice of their specific purpose for collection, which should be provided no later than the time of collection. After that, the collected information may only be used for the purpose explained in the notice. Further, personal data collectors must ensure their use is compatible with the specified purpose, or that it is otherwise legally authorized.
As the H&R Block case demonstrates, collecting consumer data without express notice and for a purpose other than described may lead to legal consequences. Here, H&R Block’s services depended on consumers ability to enter their tax information. But under H&R Block’s alleged practices, there would be little point in receiving consumers’ personal information if not retained in their online database for later use. Therefore, deleting a person’s tax information when they chose to downgrade plans could be considered incompatible with the purpose for which it was collected.
Consumers who were not informed their information would be deleted upon downgrading were therefore surprised by the forced step backward, rendering the initial collection of the information a waste of time and money at the consumer’s expense. The subsequent use of the information which H&R Block purported to need was then not properly utilized and the purpose of collection not fulfilled. Hence, the alleged coercion becomes a choice between purchasing the more expensive product that the consumer did not want, or downgrade and lose all the information that they have already typed in and would have reasonably expected to be retained.
FIPP’s As the Law of the Land for Information Governance
As of this writing, H&R Block has not indicated whether it intends to settle or litigate the FTC’s complaint. Regardless, FTC targeting conduct like that alleged against H&R Block has long been viewed as making U.S. company’s adherence to FIPPs the law of the land. This shows that even without a comprehensive data privacy law and dedicated privacy enforcement agency companies are not free to do whatever they would like with consumer personal information.
The FTC’s action against H&R Block should be a lesson to the information management and information governance industry: carefully consider your treatment and retention—or non-retention—of consumer information. There may be consequences if you don’t.
Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.