Circuit ruling against FTC in LabMD case prompts questions about data-security requirements

The U.S. appellate court ruling last week rejecting the Federal Trade Commission's enforcement order against now-defunct LabMD is raising questions among privacy professionals about what constitutes adequate data security and privacy requirements.

The appeals court concluded the FTC order lacked “specificity” and thus was “unenforceable,” a move that highlights shortcomings in the agency's use of enforcement actions as guidance for other companies on baseline privacy and security for consumer data, according to privacy professionals.

The court decision's blow to the...