FTC v. LabMD: FTC Jurisdiction Over Information Privacy Is 'Plausible,' but How Far Can It Go?

15 Pages Posted: 10 May 2013 Last revised: 13 May 2013

See all articles by Peter Frechette

Peter Frechette

American University - Washington College of Law

Date Written: May 9, 2013

Abstract

The Federal Trade Commission (FTC) plays a large role in the cybersecurity world by enforcing specific statutes, such as HIPPA, COPPA, and FCRA, and, more generally, utilizing its authority under the Federal Trade Commission Act to penalize companies that allow data breaches. Recently, however, businesses have begun to push back, contesting the FTC’s authority to police information security. In FTC v. LabMD, Inc., a company under FTC investigation for an alleged data breach challenged the FTC’s ability to issue an administrative subpoena. LabMD indirectly disputed the FTC’s role in information security and its use of the unfairness category of the FTC Act as a basis of enforcement in data breach cases. The district court ultimately found that the FTC made a plausible case for its authority, but based its holding on the weight of precedent surrounding the FTC’s general use of the FTC Act in information security cases. Thus, the FTC’s reliance on the FTC Act is currently permitted, but could be challenged in the future. LabMD’s challenge of the FTC’s authority was significant however, because there is no legislative or executive action on privacy, so the FTC’s guidance, best practices, and enforcement set the de facto “privacy law.” As the FTC casts an increasingly wider net with or without congressional or executive action on data security, the future of the FTC Act’s scope in this area is uncertain.

Keywords: FTC, Federal Trade Commission, cyber, cybersecurity, privacy, LabMD

JEL Classification: K

Suggested Citation

Frechette, Peter, FTC v. LabMD: FTC Jurisdiction Over Information Privacy Is 'Plausible,' but How Far Can It Go? (May 9, 2013). American University Law Review, Vol. 62, No. 5, 2013, Available at SSRN: https://ssrn.com/abstract=2262801 or http://dx.doi.org/10.2139/ssrn.2262801

Peter Frechette (Contact Author)

American University - Washington College of Law ( email )

4300 Nebraska Avenue, NW
Washington, DC 20016
United States

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
169
Abstract Views
1,092
Rank
362,568
PlumX Metrics