FTC Charged Medical Lab in Peer-To-Peer Data Breaches

On August 29, 2013, the Federal Trade Commission (“FTC”) filed a complaint against a cancer detection facility for allegedly failing to reasonably protect the security of consumers’ personal data, including medical information. The complaint alleges that in two separate incidents, Atlanta based LabMD collectively exposed the personal information of approximately 10,000 consumers. Although the complaint has not been published because LabMD claims, the FTC is charging the data security breach violations under Sec 5 of the FTC Act. LabMD initially challenged the FTC’s authority to use the “unfairness” clause of the FTC Act as a basis of enforcement in data breach cases, but the agency’s authority was held up in a district court.