Federal Trade Commission Holds Workshop On "Informational Injury"

For years, the Federal Trade Commission, the primary consumer protection agency in the United States, has been bringing enforcement actions against companies on the basis that their alleged failure to use specified privacy and data security measures was purportedly an "unfair" business practice prohibited by Section 5 of the Federal Trade Commission Act. But the FTC in fact has no authority under Section 5 to declare a practice "unfair" unless, among other things, it causes or is likely to cause substantial, unavoidable injury to consumers that is not outweighed by countervailing benefits. What (if anything), then, is a "substantial" injury in the privacy and data security context, how should its likelihood be measured, and how should one measure the benefits and costs of particular practices?