Court Invalidates FTC Enforcement Action Related To Alleged Unfair Data Security Practices

On June 6, the US Court of Appeals for the Eleventh Circuit vacated a cease-and-desist order by the Federal Trade Commission (FTC) issued against LabMD, Inc. (LabMD) arising from an FTC enforcement action alleging that LabMD's data security program was unreasonable and therefore constituted an unfair act or practice under the section 5 of the FTC Act, 15 U.S.C. § 45(a). The court held that the FTC's order had to be invalidated because it failed to direct LabMD to cease committing any specific unfair acts or practices and instead imposed only the general requirement that LabMD maintain a "comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers." The court accepted, for purposes of its analysis, that "LabMD's negligent failure to design and maintain a reasonable data-security program invaded consumers' right of privacy and thus constituted an