From: Inside Counsel
Does the FTC even have authority to embark on this regulation, and what exactly does the agency require?
By John Barlament, Jennifer L. Rathburn
Many companies are familiar with several well-known, national privacy and security laws. Those laws are very specific to certain well-defined industries. For example, the Health Insurance Portability and Accountability Act (HIPAA) generally applies to individually identifiable health information. The Gramm-Leach-Bliley Act (GLBA) generally applies to certain financial institutions. If a company is not subjected to one of these very specific laws, can it assume that there are no federal privacy and security laws that apply to it?
Probably not. One of the most rapidly developing concerns in data privacy and security law is how the Federal Trade Commission (FTC) has been regulating a wide variety of companies, across many industries, in this space—and whether the FTC even has authority to embark on this regulation. Assuming the FTC has authority to regulate data privacy and security, what exactly does the agency require? This article will explore these two questions. However, be prepared for some ambiguity and murky answers.
Overview of FTC authority
Leave a Reply