The LabMD Case: Further Defining The FTC's Enforcement Powers

The scaffolding of the FTC's powers in the realm of cybersecurity continues to be built.  On Monday, the FTC's Chief Administrative Law Judge D. Michael Chappell issued an initial decision in the FTC's closely watched enforcement action against LabMD.  The case involves a 2008 incident in which a data security company (Tiversa Holding Co.) discovered a LabMD document containing personal information of 9,300 patients was available on a P2P file sharing network.  (Some evidence regarding alleged security breaches was later found to be falsified.)  The FTC brought an administrative enforcement action in 2013 regarding the breaches.  In Monday's decision, the ALJ dismissed the FTC's complaint, finding (among other things) that the FTC failed to meet its burden to prove that LabMD's alleged unreasonable data security practices caused or were likely to cause substantial consumer injury.