A November 13, 2015, decision raised the bar for FTC enforcement
actions over data security practices. In order for the FTC to
maintain an enforcement action under Section 5 of the FTCA, it must
show that consumer harm is not only possible, but that it is
probable or actual. It is not enough merely to show that a practice
led to "significant risk" of harm to consumers; rather,
the FTC must show that direct harm to consumers is likely to
actually occur or, in fact, has occurred. For further
discussion on the revised DFARS interim rule, see the Jones Day Alert.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
