1. Section 5 of The FTC Act: 15 U.S.C. 45(a), 45(n) 2. Selected State UDAP Laws New York, N.Y. Gen. Bus. Law, 349 California, Cal. Bus. & Prof. Code, 17200 Massachusetts, Mass. G.L., 93A 3. Federal Trade Commission, "A Brief Overview of the Federal Trade Commission's Investigative, Law Enforcement, and Rulemaking Authority," (Last Revised May 2021) 4. Daniel Solove and Woodrow Hartzog, "The FTC and Privacy Common Law," 114 Columbia Law Review 583 (2014) (excerpted for brevity) 5. Examples of recent FTC Cases FTC Press Release, "ASUS settles FTC Charges That Insecure Home Routers and "Cloud" Services Put Consumers' Privacy at Risk FTC Press Release, "Operators of AshleyMadison.com Settle FTC, State Charges Resulting From 2015 Data Breach that Exposed 36 Million Users' Profile Information," December 14, 2016 6. Paige Bosh ell, "The LabMD Case and the Evolving Concept of Reasonable Security," American Bar Association, Business Law Today, July 2018

1: What is the FTC's role with respect to privacy and security regulation? 2: What are unfair and deceptive acts and practices (UDAP) laws and how do they relate to privacy and security cases? 3: How do FTC investigations proceed? What are the different pathways the FTC might take? How are cases typically resolved? 4: What constitutes reasonable security practices? Where might a company look for guidance to determine what actions they should take to avoid FTC scrutiny? 5: How have companies attempted to challenge the FTC's authority to regulate data security and privacy? What has been the result of these challenges, and what do these results mean for the future of the FTC's authority, as best we can tell?