FTC v. LabMD: FTC Jurisdiction over Information Privacy Is Plausible, But How Far Can It Go

INTRODUCTIONCompanies in nearly every industry collect, store, and use personal information from consumers. Recently, company databases have become the target of increasingly sophisticated attacks aimed at stealing this information. Data breaches occur with such regularity that the Federal Bureau of Investigation (FBI) has separated companies into two categories: "those that have been hacked, and those that will be."1 The Federal Trade Commission (FTC) plays a large role in the cybersecurity world by enforcing specific statutes and, more generally, utilizing its authority under the Federal Trade Commission Act2 (FTC Act) to penalize companies that allow data breaches.Recently, however, businesses have begun to push back, contesting the FTC's authority to police information security. In FTC v. LabMD, Inc.,3 a company under FTC investigation for an alleged data breach challenged the FTC's ability to issue an administrative subpoena.4 LabMD indirectly disputed the FTC's role in information security and its use of the unfairness category of the FTC Act as a basis of enforcement in data breach cases.5 The district court ultimately found that the FTC made a plausible case for its authority, but based its holding on the weight of precedent surrounding the FTC's general use of the FTC Act in information security cases.6 Thus, the FTC's reliance on the FTC Act is currently permitted, but could be challenged in the future.LabMD's challenge of the FTC's authority was significant however, because there is no legislative or executive action on privacy, so the FTC's guidance, best practices, and enforcement set the de facto "privacy law."7 As the FTC casts an increasingly wider net with or without congressional or executive action on data security, the future of the FTC Act's scope in this area is uncertain.I. BACKGROUNDThe FTC Act declares "unfair or deceptive acts or practices in or affecting commerce" to be unlawful.8 The FTC has used both the "deceptive" and "unfair" categories of the FTC Act in data security cases.9 These cases typically involve settlement discussions in which the company enters into a consent order with the FTC.10 The consent orders are published for public comment, and, if acceptable, are approved by the FTC.11 In the settlement, the FTC typically sets a privacy framework and retains the ability to review the company. For example, in a consent order with Google, Inc.,12 the FTC included the enactment of a comprehensive privacy program as a term in the settlement of the action.13 The FTC went further in a consent order with Facebook, Inc.14 when it required Facebook to follow the U.S.-EU Safe Harbor Principles15 in addition to enacting a privacy program.16 These settlement and enforcement mechanisms can be controversial based on the FTC's broad exercise of power over information privacy and the relevant law.A. DeceptionThe FTC Act lists deceptive practices that are unlawful.17 The deception category is intended to combat statements and published policies breached or disregarded by the companies that published them.18 The unauthorized collection of information, or collection that extends beyond limits set by a company's stated privacy policy, is fertile ground for enforcement actions under the deception category.Establishing a violation of the FTC Act's prohibition of deceptive practices requires a showing of a material representation or practice that is "likely to mislead consumers acting reasonably under the circumstances."19 Additionally, the FTC Act imposes a heightened pleading requirement to prove a violation based on deceptive practices.20The FTC has a relatively easy argument when it can show that a company has made promises to consumers that it has not kept. For example, the FTC leveraged a section 5 complaint into a consent decree with Google.21 There, the FTC charged that Google's roll-out of "Google Buzz"-a social-media feature of Google's e-mail service, Gmail-allowed consumers to choose whether they took part in Google Buzz. …