Takeaways From The 11th Circuit's Reversal Of The FTC's Data Security Order Against LabMD

The U.S. Court of Appeals for the Eleventh Circuit on June 6 issued its long-awaited decision in LabMD v. Federal Trade Commission, vacating a Federal Trade Commission cease and desist order directing LabMD to overhaul its data security program because the allegedly deficient program constituted an "unfair act or practice" under Section 5(a) of the Federal Trade Commission Act. The court found that the FTC's cease and desist order lacked the specificity necessary to be enforceable, which may constrain the FTC's ability in the future to impose sweeping privacy and security program requirements in its enforcement actions.

Background

LabMD is a now-defunct medical laboratory that conducted diagnostic testing. In 2005, a peer-to-peer file sharing application was installed on LabMD's network which permitted other users of the peer-to-peer service to browse shared files on the network, including a file with the personal information of over 9,300 patients. In 2008, a