New Decision Raises The Bar For FTC Enforcement Actions Over Data Security Practices

A decision on November 13, 2015 has raised the bar for Federal Trade Commission ("FTC") enforcement actions over data security practices. (In re LabMD, Inc., F.T.C. ALJ, No. 9357, (11/13/15)). In order for the FTC to maintain an enforcement action under Section 5 of the Federal Trade Commission Act ("FTCA"), it must show that consumer harm is not only possible, but that it is probable or actual. It is not enough merely to show that a practice led to "significant risk" of harm to consumers; rather, the FTC must show that direct harm to consumers is likely to actually occur or, in fact, has occurred.

Section 5 of the FTCA prohibits "unfair or deceptive acts or practices in or affecting commerce." (15 U.S.C. § 45(a)(1)). The Third Circuit's recent Wyndham decision affirmed the FTC's authority under Section 5 of the FTCA to regulate and enforce data security practices (FTC v. Wyndham Worldwide Corps., No. 14-3514, -- F.3d—(3d Cir. Aug. 24, 2015)), meaning that the FTC