Synopsis: On January 6, 2020, Andrew Smith,
director of the Federal Trade Commission’s Bureau of Consumer
Protection, outlined in a blog post the agency’s new
approach to data security orders. The agency implemented this
approach in 2019 following a December 2018 hearing it held on the
topic and an 11th Circuit decision that struck down a data
security order as unenforceably vague. Elevating data security
considerations to the C-Suite and Board level and increasing
third-party assessor accountability are key features of its new
approach, which Smith described as resulting in “significant
improvements.”
The FTC’s “improvements” fall into the
following three categories:
Elevated data security considerations to the C-Suite and
board level. Companies must now present their boards with
a written information security program annually. Senior officers
then must provide annual certifications of compliance to the FTC
with an order’s provisions. As support for the
