Increasingly Active FTC Pursues Steep Penalties For Data Security And Privacy Practices

As new appointments to the Federal Trade Commission (FTC) have shifted the control and priorities of the Commission, we have seen an emboldened FTC dedicated to strategically leveraging enforcement actions and settlements against companies for their cybersecurity compliance. Beyond pursuing aggressive "unfairness" enforcement actions and embarking on a targeted removal of dark patterns (to the tune of $100 million fines), ¹ the FTC has also honed in on companies engaging in lax or misleading data security and privacy practices. This builds upon the FTC's focus the previous year on how organizations characterize and describe their data breach incidents. ² And as the FTC eyes an even more aggressive 2023 term, we reflect on two of their more aggressive 2022 actions that expose warning signs for M&A, corporate executives, and compliance officers alike.