The Federal Trade Commission has allegedly given itself new authority to investigate and prosecute data-security issues, and a defunct clinical laboratory says the ramifications could be huge.
LabMD has called on the agency to hold off on enforcing its ruling that the company's data-security practices violated federal law, claiming it has been irreparably harmed by the FTC's "unconstitutional, unsupported by evidence and contrary to law" decision. But the effects of the decision could ripple beyond LabMD, the company claimed, which is why it should be stayed until a federal appeals court can review the order.
"Every U.S. business that uses computers has an interest in a full stay," LabMD said in its brief Thursday. "Absent this, FTC will have obtained that which Congress refused to give it by FTC's own admission through its administrative prosecution of LabMD: new data-security civil-penalty powers on a national scale."
In July, the FTC commissioners unanimously voted that LabMD's security practices didn't adequately protect consumers' personal and medical information. The move reversed an administrative law judge's ruling that the commission hadn't proven that consumers were harmed by the allegedly lax security.
LabMD maintains that the decision is unsupported and is a means for the FTC to punish the company's CEO, who criticized the agency. After the July decision, LabMD CEO Michael Daugherty said he would appeal the order and was relieved to get away from the FTC's "dirty system."
LabMD went out of business in 2014, and Daugherty attributed the move to the costs of fighting the agency.
Nevertheless, LabMD is fighting on because of the overarching concerns it sees with the decision. As it stands, LabMD claims the FTC hasn't made it clear what kind of data-security system the company would need to comply with the ruling—even though it's out of business. In addition, the FTC could use the LabMD decision as authority to investigate other U.S. businesses' data-security practices, the company alleged.
"This is not an overstatement," the brief said. "Without a stay, FTC will be able to use the commission opinion and order to threaten any U.S. business at any time (even without a breach, with or without evidence of actual harm) with massive civil penalties unless they do what FTC says."
LabMD maintained that Congress has refused to give the FTC this type of power, and the FTC acknowledged as much during administrative proceedings, the company said.
The FTC first went after LabMD with a complaint in 2013, alleging the company was hit by two data breaches because of its shoddy security policies. One alleged breach occurred in 2008 when personal information became available on a peer-to-peer file sharing network. The other alleged breach happened in 2012 when some of LabMD's data was found in the hands of individuals who pled no contest to identity theft.
The agency was alerted to the issues by an intelligence services company, Tiversa, which had offered its services to LabMD to fix any data-security issues after it found a LabMD report on a peer-to-peer file sharing network.
