FTC Enforcement

Subscribe to FTC Enforcement

LabMD’s lack of data security measures resulted in the FTC Commission overturning an Administrative Law Judge (“ALJ”) decision that previously dismissed charges against the company in November. LabMD performed laboratory medical testing for over 750,000 patients since 2001, before going out of business in 2014, partly due to fighting this case. The FTC brought the action under Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.” An act that causes or is likely to cause substantial injury to consumers that is neither reasonably avoidable by consumers nor outweighed by countervailing benefits to consumers or competition may be deemed unfair.

This month, the Federal Trade Commission (FTC) issued guidance on privacy and security best practices for health-related mobile apps, such as fitness apps connected with wearables, diet and weight loss apps, and health insurance portals.  At the same time, the FTC unveiled an interactive tool designed to direct health app developers to federal laws and regulations that may apply to their apps.  The Mobile Health Apps Interactive Tool, which is the product of collaboration among the FTC, Department of Health and Human Services’ Office of National Coordinator for Health Information Technology (ONC), Office for Civil Rights (OCR), and the Food and Drug Administration (FDA), seeks to unify guidance in a space governed by a complicated web of legal requirements.  It also signals the continued focus of regulators on the protection of consumer health information in this rapidly evolving space.

The Federal Communication Commission’s (the “FCC”) landmark decision last year to reclassify Internet service providers (“ISPs”) as common carriers under Title II of the Communications Act of 1934 implicates policy issues that extend well beyond net neutrality.  Perhaps chief among them is the treatment of customer proprietary network information (“CPNI”) by broadband access providers.  The CPNI rules, which were adopted as part of the Telecommunications Act of 1996, were originally implemented to facilitate competition in the context of a landline telephone network, rather than address privacy concerns for broadband providers.  Yet as part of the FCC’s Open Internet Order (which is currently under legal challenge), these rules apply to broadband as well.

Consumers can expect many benefits from their cars’ increased data collection programs, running the gamut from simple location services like GPS and OnStar to “networked” cars that can communicate their location with other cars on the road to prevent accidents. In the near-future, data collection will even allow cars to care for themselves: technologies currently exist that can spot and diagnose internal mechanical problems long before such problems would have become apparent to a cars’ owner, and cars are increasingly able to download patches directly from their automaker without ever needing to be taken to a mechanic.

As is usually the case when it comes to big data however, the benefits that come from increased collection also bring dangers. Speaking on a panel at the Washington Auto Show last Wednesday, Federal Trade Commissioner Maureen K. Olhausen advised the crowd that as the collection and disseminated of data by cars continues to increase, the automotive industry will need take reasonable steps to secure car owner and driver information or face the possibility of federal enforcement actions.

Customer information has become an increasingly valuable business asset.  And, the volume and detail of other available information about consumers has increased along with it, well beyond mere customer names and addresses to preferences, purchasing history, and online activity.  This means that when a business is sold, customer information is often sold along with it.  But careful diligence is required in handling this intangible asset, and the recent settlement in the RadioShack bankruptcy case is instructive.

On January 27, 2015 the Federal Trade Commission (the “FTC”) issued a report detailing best practices and recommendations that businesses engaged in the Internet of Things (“IoT”) can follow to protect consumer privacy and security. The IoT refers to the connection of everyday objects to the Internet and the transmission of data between those devices. According to Gartner estimates the IoT services spending will reach $69.5 billion in 2015. The potential benefits of IoT growth include enhanced healthcare through connected medical devices, convenience and cost savings through home automation and improved safety and convenience through connected cars.