DQ 5.2: LabMD was one of the most polarizing privacy and security cases brought by the FTC. It was a small company - 30 employees, $4M annual revenue - and, in choosing to fight the FTC, LabMD had to declare bankruptcy and shut down. In addition, the FTC's case lacked a critical detail. The case was based on some files containing personal information that were inadvertently shared on Limewire from a workstation computer owned by LabMD. There was no evidence that anyone with malicious intent had viewed or downloaded the personal information. Are enforcement actions like this fair to companies? Should the FTC have the ability to put a company out of business for a UDAP privacy or security violation? Should the FTC have the authority to investigate and enforce UDAP violations in cases where harm has not obviously occurred? Explain your reasoning from a public policy perspective.

1. Section 5 of The FTC Act: 15 U.S.C. 45(a), 45(n) 2. Selected State UDAP Laws New York, N.Y. Gen. Bus. Law, 349 California, Cal. Bus. & Prof. Code, 17200 Massachusetts, Mass. G.L., 93A 3. Federal Trade Commission, "A Brief Overview of the Federal Trade Commission's Investigative, Law Enforcement, and Rulemaking Authority," (Last Revised May 2021) 4. Daniel Solove and Woodrow Hartzog, "The FTC and Privacy Common Law," 114 Columbia Law Review 583 (2014) (excerpted for brevity) 5. Examples of recent FTC Cases FTC Press Release, "ASUS settles FTC Charges That Insecure Home Routers and "Cloud" Services Put Consumers' Privacy at Risk FTC Press Release, "Operators of AshleyMadison.com Settle FTC, State Charges Resulting From 2015 Data Breach that Exposed 36 Million Users' Profile Information," December 14, 2016 6. Paige Bosh ell, "The LabMD Case and the Evolving Concept of Reasonable Security," American Bar Association, Business Law Today, July 2018