Outsourcing Data Security To A Third Party Not A Shield From Liability

In October, at the Privacy & Security Forum at George Washington University, Federal Trade Commissioner Terrell McSweeny emphasized that companies that outsource data security to third parties can still be liable in an FTC enforcement action.  This position follows what we have heard previously from the Office of Civil Rights, the agency charged with enforcement of HIPAA. 

The FTC has authority under Section 5 of the FTC Act to prosecute companies for unfair business practices, which includes "unreasonable" data security practices.  What is "unreasonable" can cause uncertainty, and the FTC has provided little guidance as to what constitutes a reasonable procedure other than what may be gleaned from its prior enforcement actions.  Rather, the Commissioner said that a company should look at its data security from an expert's perspective and determine whether its practices fall inside or outside the box of what is reasonable.  Hopefully, following the recent