The Federal Trade Commission Act (FTC Act) established the Federal Trade Commission (FTC or Commission) in 1914. Its creation was prompted by efforts to "bust the trusts," which were late 19 th century monopolistic corporations that frequently engaged in unethical commercial practices and stifled competition. The protection of consumers from anticompetitive, deceptive, or unfair business practices is at the core of the FTC's mission. As part of that mission, the FTC has been at the forefront of the federal government's efforts to protect sensitive consumer information from data breaches, and to regulate cybersecurity. Data breaches occur when there is a loss or theft of, or other unauthorized access to, sensitive personally identifiable information (PII) that could result in the potential compromise of the confidentiality or integrity of data. As the number of data breaches continues to soar, so too do the number of FTC investigations into lax data security. Data breaches have become almost ubiquitous in every sector of the economy. Businesses, financial and insurance services, retailers and merchants, educational institutions, government and military agencies, healthcare entities, and non-profit organizations have suffered cyber intrusions into their computer networks. Cybercriminals have targeted the payment systems of several of the nation's largest retailers in order to obtain credit and debit card information to conduct fraudulent transactions. In the last year alone, large scale hacks were disclosed by Target, Neiman Marcus, Michaels, and Home Depot. Since 2002, the FTC has investigated the data security practices of many companies, and brought enforcement actions against 50 companies that have engaged in "unfair or deceptive" practices that put consumers' personal data at unreasonable risk in violation of the FTC Act. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices. The FTC's authority to regulate data security under Section 5 of FTC Act is being challenged in two pending cases. In FTC v. Wyndham Worldwide Corp. , a federal district court judge denied a motion to dismiss, thereby effectively lending support to the FTC's position that it possesses jurisdiction to regulate data security under its unfair or deceptive practices authority. In another data security case, In the Matter of LabMD , the commission rejected a motion to dismiss in an administrative enforcement action brought against a medical diagnostics laboratory. Both decisions are currently being appealed. The Wyndham district court granted the hotel chain's motion for immediate appeal of the ruling to the U.S. Court of Appeals for the Third Circuit (Third Circuit) to consider the commission's authority to bring data security cases. The FTC's administrative action against LabMD was stayed by the commission pending a congressional hearing investigating the firm, Triversa, a key player in the FTC's case. Separately, LabMD has asked the U.S. Court of Appeals for the Eleventh Circuit (Eleventh Circuit) for the third time to dismiss the administrative action. Both cases are the subject of a great deal of interest from Congress, businesses, trade groups, corporate law firms, and legal scholars. Outside of government, there has been an academic debate over the scope of the FTC's authority respecting data security. Some scholars have argued that specific legislation is needed to give the FTC express authority to take action, under well-defined regulations against companies that experience data security breaches. Other information privacy law scholars counter that the "FTC enforcement has certainly changed over the course of the past fifteen years, but the trajectory of development has followed a predictable set of patterns. These patterns are those of common law development." This report will discuss the FTC's legal authority under Section 5 of the FTC Act in relation to data security, and the two aforementioned cases. The FTC first became involved with consumer privacy issues in 1995. Initially, the FTC promoted industry self-regulation as the preferred approach to protecting consumer privacy. After assessing its effectiveness, however, the FTC reported to Congress that self-regulation was not working. Thereupon, the FTC began taking legal action against entities that violated their own privacy policies, asserting that such actions constituted "deceptive trade practices" under Section 5(a) of the FTC Act which prohibits unfair or deceptive acts or practices. The FTC acknowledged that, although it had the power under Section 5 of the FTC Act to pursue deceptive practices, such as a website's failure to abide by a stated privacy policy, the agency could not require companies to adopt privacy policies. To remedy this, the FTC proposed legislation that would provide it with the authority to issue and enforce specific privacy regulations. In 2001, a change in presidential administrations and in FTC leadership caused the agency to shift its priorities from seeking new privacy legislation to expanding enforcement of consumer protection laws in order to target companies that had inadequate data security practices. The FTC's new focus resulted in the filing of numerous investigations, based on its Section 5 unfairness authority against companies that experienced data security breaches resulting in a loss or theft of, or other unauthorized access to, sensitive personal information. In general, the FTC's most recent unfair practices complaints allege that a company's failure to maintain reasonable and appropriate data security for consumers' sensitive personal information caused, or was likely to cause, substantial injury to consumers; that consumers cannot reasonably avoid such injury; and the company's failure in this regard is not outweighed by countervailing benefits to consumers or competition. Such failures are alleged to be in violation of Section 5 of the FTC Act. In March 2012, the FTC issued a Privacy Report which articulated "best practices" for companies collecting and using data that can be reasonably linked to a consumer, computer, or device. Entities that collect only non-sensitive data from fewer than 5,000 consumers per year and that do not share the data with third parties would not have to adhere to the practices. In 2014, in tandem with the announcement of its fiftieth settlement in a data security case, the FTC issued a statement outlining, among other things, its approach to data security: The touchstone of the Commission's approach to data security is reasonableness: a company's data security measures must be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Through its settlements, testimony, and public statements, the Commission has made clear that it does not require perfect security; reasonable and appropriate security is a continuous process of assessing and addressing risks; there is no one-size-fits-all data security program; and the mere fact that a breach occurred does not mean that a company has violated the law. In addition, the commission provides educational materials to industry and the public about what "reasonable" data security generally entails. The FTC's approach to reasonable data security is based on broad principles. According to the FTC, the basic principles of a reasonable data security program are that companies should (1) know what consumer information they have and what employees or third parties have access to it; (2) limit the information they collect and retain based on their legitimate business needs; (3) protect the information they maintain by assessing risks and implementing protections in certain key areas—physical security, electronic security, employee training, and oversight of service providers; (4) properly dispose of information that they no longer need; and (5) have a plan in place to respond to security incidents, should they occur. The FTC has not been delegated explicit authority to regulate data security. Rather, the FTC has broad authority under Section 5 of the Federal Trade Commission Act to prohibit "unfair or deceptive acts or practices in or affecting commerce.... " Under Section 5 of the FTC Act, an act or practice is unfair if the act or practice (1) "causes or is likely to cause substantial injury to consumers," (2) "which is not reasonably avoidable by consumers themselves," and (3) "not outweighed by countervailing benefits to consumers or to competition." Indeed, it is widely acknowledged that "[t]he Commission and the Federal courts have been applying these three "unfairness" factors for decades and, on that basis, have found a wide range of acts or practices that satisfy the applicable criteria to be "unfair," even though—like the data security practices alleged in this case—"there is nothing in Section 5 explicitly authorizing the FTC to directly regulate" such practices." Congress chose not to enumerate the types of acts or practices that would constitute unfairness. As explained in the conference report accompanying the FTC Act's passage in 1914, It is impossible to frame definitions which embrace all unfair practices. There is no limit to human inventiveness in this field. Even if all known unfair practices were specifically defined and prohibited, it would be at once necessary to begin over again. If Congress were to adopt the method of definition, it would undertake an endless task. Failure to protect consumers' personal information is considered by the FTC to be an unfair or deceptive act or practice. The FTC is generally authorized by the FTC Act to "gather and compile information concerning, and to investigate from time to time the organization, business, conduct, practices, and management of any person, partnership, or corporation engaged in or whose business affects commerce.... " The FTC conducts data security investigations on a case-by-case basis to examine whether a company has "reasonable and appropriate security measures" to protect consumers' personal information. Following an investigation, the commission may initiate an enforcement action through administrative or judicial processes if it has "reason to believe" that the law is being or has been violated. The FTC Act authorizes the FTC to seek injunctive and other equitable relief, including consumer redress, for violations. The FTC does not possess explicit authority to issue civil penalties for data security violations of the FTC Act and is limited to fining companies for violating a settlement order. Fines issued by the FTC must reflect the amount of consumer loss.