TQ 5.1: What is the FTC's role with respect to privacy and security regulation? TQ 5.2: What are unfair and deceptive acts and practices (UDAP) laws and how do they relate to privacy and security cases? TQ 5.3: How do FTC investigations proceed? What are the different pathways the FTC might take? How are cases typically resolved? TQ 5.4: What constitutes reasonable security practices? Where might a company look for guidance to determine what actions they should take to avoid FTC scrutiny? TQ 5.5: How have companies attempted to challenge the FTC's authority to regulate data security and privacy? What has been the result of these challenges, and what do these results mean for the future of the FTC's authority, as best we can tell?