This past Friday the 13th was not a lucky day for the Federal
Trade Commission (FTC). An Administrative Law Judge (ALJ) dismissed
the FTC's data security enforcement proceeding against LabMD on
the grounds that the FTC failed to demonstrate that LabMD's
allegedly lax security measures were likely to cause substantial
injury to consumers. A copy of the decision can be found here.
Impact to Businesses
Although the decision will likely be appealed, the ruling
provides ammunition to companies facing an actual or potential
enforcement action as a result of deficient, or allegedly
deficient, data security practices. LabMD became only the second
company (Wyndham Hotels being the other) not to settle with the FTC
when faced with a data security enforcement action. For years, the
conventional wisdom was that the FTC did not have to meet as high
of a standard with respect to demonstrating consumer harm as the
standard private litigants have had to meet in recent years.
