The recent ruling by an administrative judge that the Federal
Trade Commission (FTC) must testify about the data security
standards it uses to pursue an enforcement action against LabMD,
Inc. (LabMD) generated intense interest among data security
professionals. Although human resources professionals and in-house
employment counsel typically are not close followers of the
FTC's activities, they should take note, too. The FTC's
standards for "reasonable" data security offer employers
valuable guidance in navigating their obligations to safeguard
employee data.
The FTC has asserted, and one federal district court recently
held, that the standard for fair data security practices under the
FTC Act is reasonableness, which is also the standard that
employers generally must meet when safeguarding sensitive personnel
information. For example, the Health Insurance Portability
and Accountability Act (HIPAA) requires that employers implement
"reasonable and appropriate"
