Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC approach to enforcing data security prompts debate, (Sep 13, 2013)

By Brian Hammond,TR Daily

The Federal Trade Commission’s approach to enforcing data security requirements was the subject of debate at a September 12 event in Washington, with several panel members calling for the FTC to provide more specific guidance about what it sees as reasonable data security practices.

At an event sponsored by TechFreedom, the issues were set up by Mike Daugherty, founder of LabMD, an Atlanta-based cancer diagnostic lab, whose company is defending itself against an FTC complaint, stemming from a file with patient information that was accessed from a computer on LabMD’s network through the Limewire filesharing program.

Mr. Daugherty detailed his company’s difficulties in dealing with the FTC’s lengthy investigation, which resulted in the FTC presenting the company with a consent decree requiring 20 years of biannual audits at the company’s expense. “We have no evidence this [file] is even out,” he said. “We have no evidence of patient data vulnerability.”

Mr. Daugherty said his main complaint is that there is no standard for the steps a company is supposed to take. “I’m more than willing to work and improve and be compliant, but I need to know what the rules and boundaries are,” he said. But after the investigation, the “credibility of the FTC at that point” was “zero,” he said. “We wanted to get to the judicial system and get out of this kangaroo court.”

During a panel discussion on the issue, several panelists said the FTC’s authority is extremely broad and generally agreed that more specific standards would be helpful.

Section 5 of the FTC Act is “incredibly broad,” said Gerry Stegmeier of the law firm Wilson Sonsini Goodrich & Rosati and the George Mason University School of Law. The challenge has been “how do we know what is an unfair and deceptive trade practice,” according to Stegmeier.

Reed Rubinstein of Cause of Action said there is little guidance on what the FTC sees as reasonable action aside from what is in its consent decrees. “The real problem here, the systemic harm and danger that needs to be addressed, is a government that essentially is unaccountable and not transparent because the shoulders or the limits of its authority are not clear,” he said. “This is an old problem.”

Tom Sydnor of the Association for Competitive Technology blasted the FTC for its handling of the issue of inadvertent file sharing. The FTC was first asked to investigate the issue in 2004, including Limewire, but did a “remarkably bad job,” he said. Features added to Limewire—after it had signed a code of conduct saying it would not add those features—made it too easy to inadvertently share files, he said.

The FTC was “aware of that problem well before LabMD was,” Mr. Sydnor said. “It had multiple chances to stop it … and it didn’t.” Companies like LabMD shouldn’t be held liable for inadvertently sharing a file when they did not know at the time the potential risks, he said.

But Justin Brookman of the Center for Democracy & Technology said it was understandable that the FTC would target identity theft and data security in this way. “The number one complaint they get is identity theft,” he said. “Who do they go after? Should they use civil authority to go after a hacker in Estonia or do they use their civil authority to go after companies here in the United States?”

From a consumer protection point of view, the FTC’s choice to go after companies in the U.S. has been “incredibly effective,” Mr. Brookman said. “Companies have been greatly incentivized” to take steps to protect customer data, he said. “They were looking for an impact case. They wanted to make an example of someone.”

Mr. Brookman acknowledged the problems in laying out standards through a series of consent decrees. “I don’t know what the alternative is, though,” he said. “There are FTC policy statements on this issue, but I’m struggling on what more they could do.”

Berin Szoka of TechFreedom said that, at a minimum, the “complaints the FTC brings today are not adequate … to understand what exactly is the practice that is unreasonable here.”

Companies: LabMD, Inc.

News: Privacy ConsumerProtection FederalTradeCommissionNews