5.1: Should privacy policies be mandatory? How specific should they be, and why? Does it matter that few people, according to behavioral studies, actually read privacy policies? Is there are better way to provide individuals with this information, or is this as good as it gets? Do privacy policies fulfil any additional purposes?

5.2: LabMD was one of the most polarizing privacy and security cases brought by the FTC. It was a small company - 30 employees, $4M annual revenue - and, in choosing to fight the FTC, LabMD had to declare bankruptcy and shut down. In addition, the FTC's case lacked a critical detail. The case was based on some files containing personal information that were inadvertently shared on Limewire from a workstation computer owned by LabMD. There was no evidence that anyone with malicious intent had viewed or downloaded the personal information. Are enforcement actions like this fair to companies? Should the FTC have the ability to put a company out of business for a UDAP privacy or security violation? Should the FTC have the authority to investigate and enforce UDAP violations in cases where harm has not obviously occurred? Explain your reasoning from a public policy perspective.