The FTC claims its data security authority under Section 5 of the Federal Trade Commission Act,
1 which declares illegal “unfair or deceptive acts or practices in or affecting commerce.”
2 The statute does not explicitly mention data security.
In 1983, the FTC released a policy statement that elaborates on the elements necessary for it to bring a case against a company for violating the “deception” prong of Section 5. These factors are general and not unique to data security actions:
First, there must be a representation, omission or practice that is likely to mislead the consumer. Practices that have been found misleading or deceptive in specific cases include false oral or written representations, misleading price claims, sales of hazardous or systematically defective products or services without adequate disclosures, failure to disclose information regarding pyramid sales, use of bait and switch techniques, failure to perform promised services, and failure to meet warranty obligations.
Second, we examine the practice from the perspective of a consumer acting reasonably in the circumstances. If the representation or practice affects or is directed primarily to a particular group, the Commission examines reasonableness from the perspective of that group.
Third, the representation, omission, or practice must be a “material” one. The basic question is whether the act or practice is likely to affect the consumer's conduct or decision with regard to a product or service. If so, the practice is material, and consumer injury is likely, because consumers are likely to have chosen differently but for the deception. In many instances, materiality, and hence injury, can be presumed from the nature of the practice. In other instances, evidence of materiality may be necessary.
3 The FTC will bring data security‐related claims against companies under the “deception” prong if they have misrepresented their security practices.
4 For instance, if a company were to state in its privacy policy that “we guarantee absolute security of your data and we promise we will never have a data breach,” and that company subsequently experienced a breach, the FTC might assert that the privacy policy was deceptive.
The FTC also has increasingly claimed authority for data security enforcement actions under the “unfairness” prong of Section 5.
5 Throughout the 1960s and 1970s, the FTC was criticized for arbitrarily issuing unfairness rulings when determining whether a practice is unfair. The Commission considered:
(1) whether the practice, without necessarily having been previously considered unlawful, offends public policy as it has been
established by statutes, the common law, or otherwise—whether, in other words, it is within at least the penumbra of some common‐law, statutory, or other established concept of unfairness; (2) whether it is immoral, unethical, oppressive, or unscrupulous; (3) whether it causes substantial injury to consumers (or competitors or other businessmen).
6 This three‐part test became known as the Cigarette Rule because the Commission articulated the rule as it was considering how to regulate cigarette advertising. Although the FTC did not frequently use this authority, the United States Supreme Court quoted it in 1972, describing the three prongs as “the factors [the FTC] considers in determining whether a practice that is neither in violation of the antitrust laws nor deceptive is nonetheless unfair.”
7 The FTC recognized the need to clarify the Cigarette Rule to focus more specifically on the injury to customers and benefits to society, rather than judgments about whether the practice “offends public policy,” is immoral, or is unscrupulous. In 1980, the Commission issued the Unfairness Policy Statement, which the Commission claimed provides a “more detailed sense of both the definition and the limits of these criteria.”
8 The statement articulates a three‐part test for unfairness claims: (1) “the injury must be substantial,” (2) “the injury must not be outweighed by any offsetting consumer or competitive benefits that the sales practice also produces,” and (3) “the injury must be one which consumers could not reasonably have avoided.”
9 In 1994, Congress amended the FTC Act to codify the 1980 Unfairness Policy Statement into law, becoming Section 5(n) of the FTC Act. The statute states tha...
