## Facts

- LabMD, Inc., a clinical laboratory, maintained sensitive patient information on its computer systems.
- In 2005, an employee installed the peer-to-peer application LimeWire on a work computer for personal use and placed the computer’s “My Documents” folder in a shared directory.
- A file containing sensitive personal data for roughly 9,300 patients became accessible over the peer-to-peer network.
- In 2008, a data-security firm obtained the file, notified LabMD, and later provided the file to the Federal Trade Commission after LabMD declined to purchase the firm’s services.
- The FTC initiated an administrative enforcement action alleging LabMD’s data-security practices were an “unfair act or practice” under § 5(a) of the Federal Trade Commission Act.
- An FTC Administrative Law Judge dismissed the complaint for failure to prove “substantial injury,” finding no evidence of consumer harm or dissemination beyond the security firm.
- The Commission reversed, found unfairness, and issued a cease-and-desist order requiring LabMD to implement and maintain a comprehensive information-security program “reasonably designed” to protect personal information, plus long-term assessments and oversight.

## Issues

1. Whether the FTC’s cease-and-desist order satisfied § 5(b) by directing LabMD to cease a specific unfair act or practice.
2. Whether an order requiring a “reasonably designed” comprehensive data-security program, without concrete prohibitions or clear standards, is sufficiently definite to be enforceable in later judicial enforcement proceedings.

## Decision

- The Eleventh Circuit vacated the FTC’s final order.
- The court assumed without deciding that LabMD’s inadequate data-security could constitute an unfair act or practice under § 5(a).
- The court held the order was unenforceable because it did not enjoin a specific act or practice and instead imposed an open-ended mandate to meet an indeterminate “reasonableness” standard.
- The court reasoned that the order’s vagueness would force a later enforcing court to supervise ongoing compliance and define “reasonable” security in a changing technological environment, a role inconsistent with the statutory scheme.

## Legal Principles

- Under FTC Act § 5(b), a cease-and-desist order must direct the respondent to stop an identified unfair act or practice; it must be sufficiently definite to support judicial enforcement.
- An FTC order that contains no concrete prohibitions and requires a general “overhaul” to meet an undefined standard of reasonableness may be vacated as unenforceable.
- Courts reviewing enforcement of FTC orders must be able to determine, with reasonable clarity, what conduct is required or forbidden; orders that effectively turn courts into ongoing regulators exceed that workable boundary.
- A court may dispose of an FTC review petition on remedial enforceability grounds while leaving unresolved the substantive scope of “unfairness” and what constitutes “substantial injury” under the FTC Act.

## Conclusion

The Eleventh Circuit set aside the FTC’s data-security order because it lacked clear, enforceable directives to cease a specific unlawful practice, relying instead on an indefinite requirement to maintain a “reasonably designed” security program that would necessitate ongoing judicial supervision.


LabMD, Inc. v. Fed. Trade Comm'n, 894 F.3d 1221 (11th Cir. 2018)