Cybersecurity News And Notes – August 1

In Case You Missed It:  The Federal Trade Commission issued an opinion in the LabMD case, overturning an ALJ's November 2015 decision holding that the FTC failed to meet its burden to prove that LabMD's data security practices caused or were likely to cause substantial consumer injury.  (See this blog's previous coverage of that decision here.)  The FTC's complaint against the company concerned two different data privacy incidents that allegedly affected over 10,000 consumers.  Notably, in overturning the ALJ's decision, the Commissioners were clear in their view that the FTC's power to enforce its Section 5 authority (over "unfair or deceptive acts or practices in or affecting commerce") in data privacy and cybersecurity cases is broad.  In the LabMD case, the Commissioners wrote that there was both actual harm affecting consumers in what it termed "privacy harm" — that is, the mere act of the disclosure of certain private information — and the substantial risk of