FTC Toughening Stance On Data Security – Five Key Takeaways From Recent Consent Orders

The Federal Trade Commission is putting more teeth into the multiyear compliance obligations of consent orders it enters into with companies to settle enforcement actions related to data breaches. The FTC recently issued a pair of consent orders mandating the adoption and implementation of comprehensive information security programs and annual assessments for two companies that allegedly failed to take reasonable steps to protect their consumers' data. In an accompanying statement, the FTC said the orders "include new requirements" to "provide greater assurances that consumers' data will be protected going forward." The FTC is "particularly committed to strengthening the...provisions regarding data security assessments of companies by third parties" in future consent orders.