Unanimous FTC Finds LabMD's Data Security Practices Violated Section 5 Of The FTC Act

On July 29, 2016, a unanimous Federal Trade Commission ("FTC" or "Commission") issued its Opinion and Final Order reversing the decision of an administrative law judge ("ALJ") and holding that LabMD engaged in "unfair" practices in violation of Section 5 of the FTC Act because it failed to provide reasonable and appropriate security for personal information stored on its computer network. The FTC's conclusion is significant because companies may face enforcement action for inadequate data security in connection with incidents in which there is no evidence that consumer information was accessed by unauthorized persons who likely intended to misuse the information.

Background

As we previously reported, the FTC first began investigating LabMD's data security practices in 2010, when Tiversa Holding Company, a cybersecurity consulting firm, informed the FTC that sensitive personal information held by LabMD may have been publicly disclosed on a peer-to-peer ("P2P")