ALJ Dismisses FTC's LabMD Complaint For Lack Of Actual Or Probable Consumer Harm From Cybersecurity Incidents

On Friday, November 13, Federal Trade Commission ("FTC" or the "Commission") Chief Administrative Law Judge ("ALJ") D. Michael Chappell issued an Initial Decision in In the Matter of LabMD, Inc. (FTC Docket No. 9357), dismissing the Commission's Complaint against LabMD, Inc. ("LabMD"), upon a finding that the FTC had failed to "demonstrate a likelihood that [LabMD's] computer network will be breached in the future and cause substantial computer injury."1 The ALJ held that showing consumer harm is merely possible is insufficient to prove unfairness under Section 5(n) of the FTC Act. Background The FTC's Administrative Complaint against LabMD alleged two "security incidents," which the Commission's Complaint blamed on LabMD's alleged failure to provide reasonable and appropriate security for personal information. The first alleged incident asserted in the complaint occurred in 2008, when data security company Tiversa Holding Company informed LabMD that one of LabMD's reports containing personal information was available through a peer-to-peer file-sharing application. The second alleged incident occurred in 2012, when documents containing personal information were found in the possession of individuals who subsequently pleaded "no contest" to identity theft charges. Opinion With respect to the first alleged incident, the ALJ found that the evidence introduced by Commission Counsel failed to prove that either (1) "the limited exposure of the [data] file has resulted, or is likely to result, in any identity-related harm" or (2) "embarrassment or similar emotional harm is likely to be suffered from the exposure." He determined that even if there were any harm, it would be subjective or emotional harm, which is insufficient to constitute "substantial injury," as required to meet the standard of proof in Section 5(n) of the FTC Act, in the absence of evidence of any tangible injury.2 Next, the ALJ concluded that the Commission Counsel had failed to prove a causal connection between the second alleged incident and any failure of LabMD to reasonably protect data on its computer networks, because the Commission Counsel had failed to show the documents at issue had actually been maintained on, or taken from, those networks. ALJ Chappell further found that Commission Counsel had "failed to prove that this exposure has caused, or is likely to cause, any consumer harm."3 Finally, the ALJ rejected Commission Counsel's "argument that identity theft-related...