	The Federal Trade Commission's Regulation of Data Security Under Its Unfair or Deceptive Acts or Practices (UDAP) Authority

The Federal Trade Commission Act (FTC Act) established the Federal Trade Commission (FTC or Commission) in 1914. The protection of consumers from anticompetitive, deceptive, or unfair business practices is at the core of the FTC's mission. As part of that mission, the FTC has been at the forefront of the federal government's efforts to protect sensitive consumer information from data breaches, and to regulate cybersecurity. As the number of data breaches continues to soar, so too do the number of FTC investigations into lax data security. In FTC v. Wyndham Worldwide Corp. , a federal district court judge denied a motion to dismiss, thereby effectively lending support to the FTC's position that it possesses jurisdiction to regulate data security under its unfair or deceptive practices authority. In another data security case, In the Matter of LabMD , the commission rejected a motion to dismiss in an administrative enforcement action brought against a medical diagnostics laboratory. Both decisions are currently being appealed. Separately, LabMD has asked the U.S. Court of Appeals for the Eleventh Circuit (Eleventh Circuit) for the third time to dismiss the administrative action. Both cases are the subject of a great deal of interest from Congress, businesses, trade groups, corporate law firms, and legal scholars. This report will discuss the FTC's legal authority under Section 5 of the FTC Act in relation to data security, and the two aforementioned cases. Background

The FTC first became involved with consumer privacy issues in 1995. Initially, the FTC promoted industry self-regulation as the preferred approach to protecting consumer privacy. After assessing its effectiveness, however, the FTC reported to Congress that self-regulation was not working. Thereupon, the FTC began taking legal action against entities that violated their own privacy policies, asserting that such actions constituted "deceptive trade practices" under Section 5(a) of the FTC Act which prohibits unfair or deceptive acts or practices. Rather, the FTC has broad authority under Section 5 of the Federal Trade Commission Act to prohibit "unfair or deceptive acts or practices in or affecting commerce.... " Under Section 5 of the FTC Act, an act or practice is unfair if the act or practice (1) "causes or is likely to cause substantial injury to consumers," (2) "which is not reasonably avoidable by consumers themselves," and (3) "not outweighed by countervailing benefits to consumers or to competition." According to recent testimony by FTC Chairwoman Edith Ramirez, using the deceptive prong of its statute, the FTC has settled more than 30 matters challenging companies' express and implied claims about the security they provide for consumers' personal data, and the FTC has also settled more than 20 cases alleging that a company's failure to reasonably safeguard consumer data was an unfair practice. Because most of the FTC's privacy and data security cases, and almost all of its COPPA and GLBA cases, were resolved with settlements or abandoned, there are few judicial decisions addressing the FTC's authority to regulate the data security practices of companies which have suffered a data breach. FTC v. Wyndham Worldwide Corp.

FTC v. Wyndham Worldwide Corp . is widely viewed as an important case to test the authority of the FTC to respond to data breaches, and it could have far-reaching implications for the liability of companies whose computer systems suffer a data breach. Proposed Legislation

As part of efforts to enact cyber and data security legislation , several bills before Congress include provisions that would provide the FTC with enhanced enforcement authority by, for example, explicitly authorizing the FTC to promulgate rules to implement data security standards and to assess civil penalties. In recent FTC testimony before Congress, the agency has called for federal legislation that would (1) strengthen its existing authority governing data security standards on companies and (2) require companies to provide notification to consumers where there is a data security breach.
The Federal Trade Commission Act established the Federal Trade Commission (FTC or Commission) in 1914. The protection of consumers from anticompetitive, deceptive, or unfair business practices is at the core of the FTC's mission. As part of that mission, the FTC has been at the forefront of the federal government's efforts to protect sensitive consumer information from data breaches and regulate cybersecurity. As the number of data breaches has soared, so too have FTC investigations into lax data security practices. The FTC has not been delegated specific authority to regulate data security. Rather, the FTC has broad authority under Section 5 of the Federal Trade Commission Act (FTC Act) to prohibit unfair and deceptive acts or practices.
In 1995, the FTC first became involved with consumer privacy issues. Initially, the FTC promoted industry self-regulation as the preferred approach to combatting threats to consumer privacy. After assessing its effectiveness, however, the FTC reported to Congress that self-regulation was not working. Thereupon, the FTC began taking legal action under Section 5 of the FTC Act. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices. Since 2002, the FTC has pursued numerous investigations under Section 5 of the FTC Act against companies for failures to abide by stated privacy policies or engage in reasonable data security practices. It has monitored compliance with consent orders issued to companies for such failures. Using the deception prong of its statute, the FTC has settled more than 30 matters challenging companies' claims about the security they provide for consumers' personal data and more than 20 cases alleging that a company's failure to reasonably safeguard consumer data was an unfair practice. Because most of the FTC's privacy and data security cases were resolved with settlements or abandoned, there have been few judicial decisions. Against this backdrop, there are now two pending cases testing the FTC's unfairness authority under Section 5 of FTC Act as a means to respond to data breaches. These cases could have far-reaching implications for the liability of companies whose computer systems suffer a data breach. Both cases are the subject of a great deal of interest from Congress, businesses, trade groups, corporate law firms, and legal scholars.
In April 2014, in FTC v. Wyndham Worldwide Corp., a federal district court denied a motion to dismiss, thereby effectively lending support to the FTC's position that it possesses jurisdiction to regulate data security practices under its authority to bring enforcement actions against unfair or deceptive practices. In another case, In the Matter of LabMD—an administrative enforcement action brought against a medical diagnostics laboratory—the commission rejected a motion to dismiss that challenged the FTC's authority to impose sanctions under the FTC Act. Both decisions are currently being appealed. Wyndham is on appeal to the Third Circuit, and LabMD has asked the Eleventh Circuit for the third time to intervene. The FTC's administrative action against LabMD was stayed this summer pending a related congressional hearing.
Several cyber and data security bills before Congress include provisions that would explicitly authorize the FTC to issue rules to implement data security standards and assess civil penalties. The FTC has called for federal legislation that would strengthen its existing authority governing data security standards and require companies to provide breach notification to consumers. This report provides background on the FTC and its legal authorities in the context of data security, and discusses the two aforementioned cases.