This post is a follow up to our first post on evidence-based privacy, which can be found here.
This Friday, November 13, 2015 the FTC learned that they lost their data security case against LabMD, a clinical testing laboratory. In a complaint filed in 2013, the FTC staff had alleged before the FTC Administrative Law Judge Chappell that LabMD violated the unfairness prong of the FTC Act by failing to keep secure sensitive health information stored by the company. Under the FTC Act, in order to show unfairness, the FTC must show that an act or practice:
-
Causes or is likely to cause substantial injury to consumers;
- Is not reasonably avoidable by consumers themselves; and
- Is not outweighed by countervailing benefits to consumers or to competition.
After a full trial before the ALJ, Judge Chappell found that this standard had not been met and he dismissed the complaint against LabMD.
The case is of interest to the Internet Association because the ALJ’s opinion goes to some lengths to analyze and provide guidance on the standard of evidence needed to show harm to consumers in bringing data privacy and security cases. Specifically, the opinion concluded that “[a]t best, [FTC staff] has proven the “possibility” of harm, but not any “probability” or likelihood of harm. Fundamental fairness dictates that demonstrating actual or likely substantial consumer injury under [the FTC Act] requires proof of more than the hypothetical or theoretical harm that has been submitted by the government in this case.” It seems that the judge was looking for more evidence of harm than an argument that a breach of LabMD’s data could have resulted in identity theft or embarrassment or similar emotional harm, both of which the judge described as “subjective” harms.
The LabMD opinion suggest that Judge Chappell shares the views of Commissioner Ohlhausen and former Commissioner Wright expressed earlier this year in the Nomi case that the agency needs to step up its game when bringing privacy cases. We blogged about the Nomi case at the time and suggested that the dissenting statements from Commissioners Ohlhausen and Wright in Nomi marked part of a wider chorus calling for more objective evidence of tangible injury and consumer harm in these cases. It seems that Judge Chappell has now joined this chorus.
Indeed, former Commissioner Wright took to Twitter on Friday to share his views on Chappell’s LabMD opinion. According to Wright, the LabMD case underscores the need for increased use of economic evidence to demonstrate consumer harm in privacy and security cases. As Wright tweeted on Friday, “privacy regulators resistance to economics is harming consumers. Failure to engage w. economic analysis leads to serious policy errors.” Of course, increased use of economic evidence would also align the privacy cases more closely with the FTC’s antitrust cases, which rely heavily on econometric evidence and the input of the FTC’s internal staff economists.
The LabMD case will likely go on appeal to the full Federal Trade Commission with the possibility of a further appeal from that decision to a Circuit court of LabMD’s choosing. It will be very interesting to see how the full Commission tackles the standard of proof issues identified by Chappell and others in its opinion. In other words, watch this space.
