The Federal Trade Commission’s Regulation of Data Security Under Its Unfair or Deceptive Acts or Practices (UDAP) Authority
Released: 2014-09-11T00:00:00

The Federal Trade Commission's Regulation of Data Security Under Its Unfair or Deceptive Acts or Practices (UDAP) Authority

The Federal Trade Commission Act (FTC Act) established the Federal Trade Commission (FTC or Commission) in 1914. Its creation was prompted by efforts to "bust the trusts," which were late 19 th century monopolistic corporations that frequently engaged in unethical commercial practices and stifled competition. The protection of consumers from anticompetitive, deceptive, or unfair business practices is at the core of the FTC's mission. As part of that mission, the FTC has been at the forefront of the federal government's efforts to protect sensitive consumer information from data breaches, and to regulate cybersecurity. Data breaches occur when there is a loss or theft of, or other unauthorized access to, sensitive personally identifiable information (PII) that could result in the potential compromise of the confidentiality or integrity of data. As the number of data breaches continues to soar, so too do the number of FTC investigations into lax data security.

Data breaches have become almost ubiquitous in every sector of the economy. Businesses, financial and insurance services, retailers and merchants, educational institutions, government and military agencies, healthcare entities, and non-profit organizations have suffered cyber intrusions into their computer networks. Cybercriminals have targeted the payment systems of several of the nation's largest retailers in order to obtain credit and debit card information to conduct fraudulent transactions. In the last year alone, large scale hacks were disclosed by Target, Neiman Marcus, Michaels, and Home Depot.

Since 2002, the FTC has investigated the data security practices of many companies, and brought enforcement actions against 50 companies that have engaged in "unfair or deceptive" practices that put consumers' personal data at unreasonable risk in violation of the FTC Act. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices.

The FTC's authority to regulate data security under Section 5 of FTC Act is being challenged in two pending cases. In FTC v. Wyndham Worldwide Corp. , a federal district court judge denied a motion to dismiss, thereby effectively lending support to the FTC's position that it possesses jurisdiction to regulate data security under its unfair or deceptive practices authority. In another data security case, In the Matter of LabMD , the commission rejected a motion to dismiss in an administrative enforcement action brought against a medical diagnostics laboratory. Both decisions are currently being appealed. The Wyndham district court granted the hotel chain's motion for immediate appeal of the ruling to the U.S. Court of Appeals for the Third Circuit (Third Circuit) to consider the commission's authority to bring data security cases. The FTC's administrative action against LabMD was stayed by the commission pending a congressional hearing investigating the firm, Triversa, a key player in the FTC's case. Separately, LabMD has asked the U.S. Court of Appeals for the Eleventh Circuit (Eleventh Circuit) for the third time to dismiss the administrative action.

Both cases are the subject of a great deal of interest from Congress, businesses, trade groups, corporate law firms, and legal scholars. Outside of government, there has been an academic debate over the scope of the FTC's authority respecting data security. Some scholars have argued that specific legislation is needed to give the FTC express authority to take action, under well-defined regulations against companies that experience data security breaches. Other information privacy law scholars counter that the "FTC enforcement has certainly changed over the course of the past fifteen years, but the trajectory of development has followed a predictable set of patterns. These patterns are those of common law development." This report will discuss the FTC's legal authority under Section 5 of the FTC Act in relation to data security, and the two aforementioned cases.

Background

The FTC first became involved with consumer privacy issues in 1995. Initially, the FTC promoted industry self-regulation as the preferred approach to protecting consumer privacy. After assessing its effectiveness, however, the FTC reported to Congress that self-regulation was not working. Thereupon, the FTC began taking legal action against entities that violated their own privacy policies, asserting that such actions constituted "deceptive trade practices" under Section 5(a) of the FTC Act which prohibits unfair or deceptive acts or practices. The FTC acknowledged that, although it had the power under Section 5 of the FTC Act to pursue deceptive practices, such as a website's failure to abide by a stated privacy policy, the agency could not require companies to adopt privacy policies. To remedy this, the FTC proposed legislation that would provide it with the authority to issue and enforce specific privacy regulations.

In 2001, a change in presidential administrations and in FTC leadership caused the agency to shift its priorities from seeking new privacy legislation to expanding enforcement of consumer protection laws in order to target companies that had inadequate data security practices. The FTC's new focus resulted in the filing of numerous investigations, based on its Section 5 unfairness authority against companies that experienced data security breaches resulting in a loss or theft of, or other unauthorized access to, sensitive personal information. In general, the FTC's most recent unfair practices complaints allege that a company's failure to maintain reasonable and appropriate data security for consumers' sensitive personal information caused, or was likely to cause, substantial injury to consumers; that consumers cannot reasonably avoid such injury; and the company's failure in this regard is not outweighed by countervailing benefits to consumers or competition. Such failures are alleged to be in violation of Section 5 of the FTC Act.

In March 2012, the FTC issued a Privacy Report which articulated "best practices" for companies collecting and using data that can be reasonably linked to a consumer, computer, or device. Entities that collect only non-sensitive data from fewer than 5,000 consumers per year and that do not share the data with third parties would not have to adhere to the practices.

In 2014, in tandem with the announcement of its fiftieth settlement in a data security case, the FTC issued a statement outlining, among other things, its approach to data security:

The touchstone of the Commission's approach to data security is reasonableness: a company's data security measures must be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Through its settlements, testimony, and public statements, the Commission has made clear that it does not require perfect security; reasonable and appropriate security is a continuous process of assessing and addressing risks; there is no one-size-fits-all data security program; and the mere fact that a breach occurred does not mean that a company has violated the law.

In addition, the commission provides educational materials to industry and the public about what "reasonable" data security generally entails. The FTC's approach to reasonable data security is based on broad principles. According to the FTC, the basic principles of a reasonable data security program are that companies should (1) know what consumer information they have and what employees or third parties have access to it; (2) limit the information they collect and retain based on their legitimate business needs; (3) protect the information they maintain by assessing risks and implementing protections in certain key areas—physical security, electronic security, employee training, and oversight of service providers; (4) properly dispose of information that they no longer need; and (5) have a plan in place to respond to security incidents, should they occur.

Section 5 of the Federal Trade Commission Act

The FTC has not been delegated explicit authority to regulate data security. Rather, the FTC has broad authority under Section 5 of the Federal Trade Commission Act to prohibit "unfair or deceptive acts or practices in or affecting commerce.... " Under Section 5 of the FTC Act, an act or practice is unfair if the act or practice (1) "causes or is likely to cause substantial injury to consumers," (2) "which is not reasonably avoidable by consumers themselves," and (3) "not outweighed by countervailing benefits to consumers or to competition."

Indeed, it is widely acknowledged that "[t]he Commission and the Federal courts have been applying these three "unfairness" factors for decades and, on that basis, have found a wide range of acts or practices that satisfy the applicable criteria to be "unfair," even though—like the data security practices alleged in this case—"there is nothing in Section 5 explicitly authorizing the FTC to directly regulate" such practices."

Congress chose not to enumerate the types of acts or practices that would constitute unfairness. As explained in the conference report accompanying the FTC Act's passage in 1914,

It is impossible to frame definitions which embrace all unfair practices. There is no limit to human inventiveness in this field. Even if all known unfair practices were specifically defined and prohibited, it would be at once necessary to begin over again. If Congress were to adopt the method of definition, it would undertake an endless task.

Failure to protect consumers' personal information is considered by the FTC to be an unfair or deceptive act or practice.

Investigations

The FTC is generally authorized by the FTC Act to "gather and compile information concerning, and to investigate from time to time the organization, business, conduct, practices, and management of any person, partnership, or corporation engaged in or whose business affects commerce.... " The FTC conducts data security investigations on a case-by-case basis to examine whether a company has "reasonable and appropriate security measures" to protect consumers' personal information. Following an investigation, the commission may initiate an enforcement action through administrative or judicial processes if it has "reason to believe" that the law is being or has been violated. The FTC Act authorizes the FTC to seek injunctive and other equitable relief, including consumer redress, for violations. The FTC does not possess explicit authority to issue civil penalties for data security violations of the FTC Act and is limited to fining companies for violating a settlement order. Fines issued by the FTC must reflect the amount of consumer loss. If the respondent elects to settle the charges, it may sign a consent agreement (without admitting liability), consent to entry of a final order, and waive all right to judicial review. If the FTC accepts such a proposed consent agreement, it places the order on the record for public comment. If the respondent contests the charges, an Administrative Law Judge (ALJ) issues an "initial decision" recommending either entry of an order to cease and desist or dismissal of the complaint. Either party, or both, may appeal the initial decision to the full FTC. The respondent may file a petition for review of the full FTC decision with any court of appeals. If the court of appeals affirms the commission's order, it enters an order of enforcement. The losing party may seek Supreme Court review.

The FTC also enforces several other statutes that impose obligations upon businesses to protect consumer data. The FTC's Safeguards Rule implements the Gramm-Leach-Bliley Act's (GLBA) data security requirements for non-bank financial institutions. The Fair Credit Reporting Act (FCRA) requires consumer reporting agencies to use reasonable procedures to ensure that the entities that disclose sensitive consumer information have a permissible purpose for receiving that information. The Children's Online Privacy Protection Act (COPPA) requires website operators and online services to maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. The FTC also oversees the EU-U.S. Safe Harbor Agreement.

Enforcement Actions

Since 2002, under its unfair and deceptive practices authority, the FTC has brought and settled 50 data security enforcement actions against companies for failure to adequately safeguard customers' sensitive personal information. According to recent testimony by FTC Chairwoman Edith Ramirez, using the deceptive prong of its statute, the FTC has settled more than 30 matters challenging companies' express and implied claims about the security they provide for consumers' personal data, and the FTC has also settled more than 20 cases alleging that a company's failure to reasonably safeguard consumer data was an unfair practice. Because most of the FTC's privacy and data security cases, and almost all of its COPPA and GLBA cases, were resolved with settlements or abandoned, there are few judicial decisions addressing the FTC's authority to regulate the data security practices of companies which have suffered a data breach.

In 2006, The FTC brought its first data security enforcement action against the data broker ChoicePoint after ChoicePoint disclosed a data breach involving the personal information of 163,000 persons. ChoicePoint ultimately agreed to pay $10 million in civil penalties and $5 million in consumer redress to settle the FTC's charges. The FTC settlement required ChoicePoint to implement new procedures to ensure that it provides consumer reports only to legitimate businesses for lawful purposes, to maintain a comprehensive information security program, and to obtain audits by an independent third-party security professional every other year for twenty years. These measures are typical of the measures required of companies in the FTC's consent agreements to remedy failures to provide reasonable security protections.

In 2014, the FTC pursued its 50 th data security enforcement action. The complaint against GMR Transcription Services—an audio file transcription service that relies on service providers and independent typists to transcribe files for their clients, which include healthcare providers. The FTC alleged that as a result of GMR's failure to implement reasonable security measures and oversee its service providers, at least 15,000 files containing sensitive personal information—including consumers' names, birth dates, and medical histories—were available to anyone on the Internet. Under the terms of the FTC'S consent order with GMR, the company and its owners are prohibited from misrepresenting the extent to which they maintain the privacy and security of consumers' personal information; must establish an information security program that will protect consumers' sensitive personal information; and must have the program evaluated every two years by a certified third party. The settlement will be in force for 20 years.

Many other companies have been subjected to FTC data security enforcement actions under its Section 5 authority. Recently, the FTC announced that it is also investigating the Target data breach .

FTC v. Wyndham Worldwide Corp.

FTC v. Wyndham Worldwide Corp . is widely viewed as an important case to test the authority of the FTC to respond to data breaches, and it could have far-reaching implications for the liability of companies whose computer systems suffer a data breach. After a data breach occurred involving the personal information of Wyndham Hotels and Resorts' customers in 2012, the FTC filed suit against the hotel chain and three of its subsidiaries, alleging that Wyndham's privacy policy misrepresented the security of customer information and that its failure to safeguard personal information caused substantial consumer injury. Specifically, the FTC alleged that wrongly configured software, weak passwords, and insecure computer servers led to three data breaches by at Wyndham hotels from 2008 to 2010, compromising more than 619,000 payment card accounts and transfer of customers' payment card account numbers to Russia. The FTC alleged that the computer intrusions led to more than $10.6 million in fraud losses. The agency ultimately alleged that Wyndham's security practices were "unfair and deceptive" in violation of Section 5 of the FTC Act.

Rather than settle the case as other companies facing FTC complaints have done, Wyndham contested the allegations and argued, among other things, that the FTC had exceeded its statutory authority to assert an unfairness claim in the data security context. Wyndham relied on the Supreme Court's ruling in Food and Drug Administration v. Brown & Williamson Tobacco Corp. , which held that the Food and Drug Administration (FDA) could not utilize its general authorities with respect to drugs to mandate disclaimers on tobacco packaging because of the lack of explicit legal authority over tobacco products. The Brown & Williamson Court reached such a conclusion because, among other reasons, (1) the agency had disclaimed authority over tobacco products in the past; (2) the FDA's authorizing statute did not clearly indicate the agency had such authority; (3) Congress had already passed tobacco-specific legislation in the past without giving the FDA such authority; and (4) it appeared unlikely that Congress would delegate a policy decision of such economic and political magnitude to the FDA through its general authority to regulate drugs. In Wyndham, the hotel chain, relying on Brown & Williamson, argued that just as Congress did not grant the FDA through its general authority to regulate drugs the specific authority to regulate tobacco products, Congress likewise did not give the FTC the necessary authority to regulate data security through the FTC's general authority to regulate unfair or deceptive trade practices. In making this argument, Wyndham noted the FTC's lack of clear statutory authority over data security; that the FTC had previously disclaimed its authority over data security; and, that Congress has enacted narrowly tailored data security legislation in FCRA, GLBA, and COPPA without providing the FTC with any broader authority. Moreover, Wyndham argued that it was unlikely that Congress would delegate a policy decision of such economic and political magnitude as setting data security standards through so general a delegation as the FTC's unfairness authority. In addition, Wyndham cited the Obama Administration's recent release of a cybersecurity framework by the National Institute of Standards and Technology (NIST) as evidence that Congress did not provide the FTC with authority to regulate data security.

The FTC, in response, made several arguments. First, the agency argued that Brown & Williamson was distinguishable because here the agency's assertion of authority would not result in any statutory inconsistencies. The agency explained that the FTC Act provided the agency with a baseline authority to act in unfairness cases where it can prove substantial harm to consumers and asserted that regulating data security was consistent with that broad authority. Second, the FTC contended that specific data security laws like FCRA or HIPPA do not displace the FTC's authority, but instead supplement the FTC's Section 5 authority; grant the FTC additional powers; and affirmatively compel the FTC to use its consumer protection authority in specified ways, unlike the FDA's earlier disclaimer of authority to regulate tobacco. The FTC also argued that it had never disclaimed its "unfairness" authority over data security. Finally, the FTC claimed that any question about the FTC's authority in the data security context was put to rest by the recent decision in the FTC's administrative action against LabMD (discussed below) .

On April 7, 2014, a federal district court judge in New Jersey, in FTC v. Wyndham Worldwide Corp., denied Wyndham's motion to dismiss the case, rejecting Wyndham's position that the FTC lacked statutory authority to regulate data security. Although the judicial opinion did not address the merits of whether Wyndham's security policies were inadequate, the judge did undertake, in a 42-page opinion, an in-depth analysis of the authority of the FTC to regulate data security. The district court in Wyndham began by noting that it was not ruling on a finding of liability, but only on the validity of FTC's legal theory of liability. The district court also cautioned that it was not handing the FTC a "blank check" to go after every company that suffers a data breach. As to Wyndham's claim that the FTC's unfairness authority does not include data security, the district court distinguished Wyndham from the Brown & Williamson reasoning. The court noted that in Brown & Williamson Congress had clearly intended to exclude tobacco products from FDA enforcement, whereas the case before it the court found no such congressional intent to create a data security carve out from the FTC's unfairness authority under Section 5 of the FTC Act. In fact, the court recognized that data security was a rapidly evolving area, and that nothing in Congress's several specific data security enactments (e.g., the FCRA, GLBA, and the COPPA) contradict or are otherwise incompatible with holding that the FTC possesses authority to enforce data security as an unfair trade practice under the FTC Act. Wyndham moved for and was granted permission to appeal the district court's ruling. It is uncertain when a decision from the Third Circuit can be expected.

In the Matter of LabMD

In the Matter of LabMD involves another challenge to the authority of the FTC to regulate data security breaches as unfair trade practices under the FTC Act . As was the case in Wyndham , the FTC's authority to bring enforcement actions for data security breaches was challenged, and in this instance, the commission found that the FTC had authority to bring such enforcement actions. However, unlike in Wyndham , the administrative hearing resulted in something sought by a defendant company: an order issued by the ALJ compelling the FTC to explicitly disclose what kinds of data security measures it expected the company to take and rejecting the agency ' s argument that its existing general guidance was sufficient .

In the Matter of LabMD began in 2013 when the FTC filed a complaint, through its administrative process, against a Georgia medical cancer diagnostics company, LabMD, Inc. Under the FTC Act, the FTC is authorized to initiate enforcement action s either through administrative or judicial processes. The administrative complaint against LabMD alleged that the company failed to reasonably protect the security of 10,000 consumers' personal data, including medical information; that these practices harmed consumers; and that consequently LabMD engaged in unfair practices in violation of the FTC Act. LabMD argued in a motion to dismiss that the FTC has no authority to address private companies' data security practices as unfair practices because the lab is a Health Insurance Portability and Accountability Act (HIPAA) covered entity.

In January 2014, four commissioners, on behalf of the FTC, unanimously denied LabMD's motion to dismiss and concluded that the FTC Act's prohibition of unfair practices applies to a company's failure to implement reasonable and appropriate data security measures. According to the order denying LabMD's motion, the commission's authority to regulate data security practices to determine which practices are unfair was consistent with the FTC Act and its legislative history, other statutes, and extensive case law. The commission further asserted that legislative history of the FTC Act demonstrated that Congress decided to delegate broad authority to the commission to determine what practices were unfair. The commission likewise rejected LabMD's contention that Congress, by enacting more specific data security statutes, implicitly repealed the FTC's preexisting authority to enforce Section 5 of the FTC Act in the field of data security. The commission, noting that "[t] he cardinal rule is that repeals by implication are not favored," found nothing in HIPAA or any of the other cited statutes that reflected a "clear and manifest" intent of Congress to restrict the commission's authority over allegedly "unfair" data security practices.

The commission also rejected LabMD's argument that the FTC's decision to proceed through adjudication without first conducting a rulemaking violates LabMD's constitutional due process rights. According to the ruling, administrative agencies must enforce the statutes that Congress has directed them to implement regardless of whether they have issued regulations addressing the specific conduct. The FTC ultimately found the three-part statutory standard governing whether an act or practice is "unfair" sufficient to provide fair notice of what conduct is prohibited. In reaching that conclusion, the commission noted that given the difficulty of drafting generally applicable regulations in this rapidly changing area, questions relating to data security practices in an online environment are particularly well-suited to case-by-case development in enforcement proceedings.

After the FTC C ommissioners affirmed the agency ' s authority to sue , the case 's focus shifted to whether the FTC must disclose the data security standards it uses to determine whether a company's efforts to protect consumers' information could be considered reasonable. In the same proceeding, LabMD accused the FTC of holding the company to data security standards that do not exist officially at the federal level. In response, the FTC argued that it should not be required to disclose the standards it uses to determine whether a company's data security practices are unfair under the FTC Act because of legal privileges. In May 2014, the FTC's Chief Administrative Law Judge ruled that the FTC can be compelled to disclose the data security standards it uses to determine whether a company has reasonable security measures. The administrative law judge ultimately held that the company has the right to know what data security standards the commission uses when pursuing enforcement actions. The judge ordered the FTC to provide deposition testimony as to what data security standards, if any, have been published by the FTC which it intends to rely on at trial. The FTC's testimony will present companies with the first opportunity to obtain more specificity from the agency about the data security standards driving the FTC's data breach enforcement actions.

Proposed Legislation

As part of efforts to enact cyber and data security legislation , several bills before Congress include provisions that would provide the FTC with enhanced enforcement authority by, for example, explicitly authorizing the FTC to promulgate rules to implement data security standards and to assess civil penalties. In recent FTC testimony before Congress, the agency has called for federal legislation that would (1) strengthen its existing authority governing data security standards on companies and (2) require companies to provide notification to consumers where there is a data security breach. In both of those areas the FTC seeks the ability to impose civil penalties and the authority to issue administrative rules.

Several bills have been introduced in the Senate in the 113 th Congress that could, in varying ways, impact the FTC's powers. S. 1193 (Senator Toomey), S. 1897 (Senator Leahy), S. 1927 (Senator Carper and Senator Blunt), S. 1976 (Senator Rockefeller), and S. 1995 (Senator Blumenthal) would expressly give the FTC the power to levy civil penalties with respect to companies that fail to comply with certain data security standards. S. 1897 would permit the FTC to impose civil penalties for violations for failing to comply with federal cybersecurity standards. S. 1976 would provide the FTC with explicit authority to promulgate "information security" regulations that could extend to certain non-profits. The bill would further allow the FTC to enforce violations of these regulations with various civil penalties. Likewise, S. 1995 would give enforcement authority to the FTC.