Courts and legislatures have differed as to whether a person can bring a lawsuit when their personal data is stolen, but the data has not been used to harm the person.
What happened in this administrative law case? The FTC has been trying to enforce sanctions against a health care company for a data breach.
The FTC legalese is that the health care company’s ” purported failure to institute reasonable data security constituted an unfair trade practice under section 5 of the FTC Act, because the conduct caused or is likely to cause substantial injury to consumers.”
Wait, I thought it was the FCC that did data security regulatory enforcement? Several federal agencies have regulatory authority. The FCC, the FCC, HHS and the SEC have all been involved.
What did the ALJ order in this case? That since there was no proven injury from the data security breach at the health care company, and the only measure of injury was through speculation; therefore FTC you lose.