On April 24, the Federal Trade Commission issued a press release highlighting the agency's new stance of strengthening and improving its orders regarding privacy and data security that include going beyond previous requirements.

“We have instructed staff to closely review our orders to determine whether they could be strengthened and improved—particularly in the areas of privacy and data security,” according to the FTC press release regarding the i-Dressup.com and ClixSense matters. The agency added, “Future orders will better ensure that third-party assessors know they are accountable for providing meaningful, independent analysis of the data practices under examination.”

Specifically, in ClixSense the FTC filed a complaint alleging the internet advertising company didn't use the latest security techniques as it promised its users, including not using password management tools, encryption and access controls. Additionally, i-Dressup's proposed settlement orders the children's website pay a $35,000 fine, undergo biennial assessments by a third party, and install a data security officer, among other mandates.

Lawyers said while the FTC's latest data security and privacy orders follow precedent, they see the agency's detailed orders as a response to rapidly evolving technology and the pressures for a U.S. federal law.

The press release was the agency's attempt to “brand these orders as forward-thinking in the consumer protection realm,” said Myriah Jaworski of Buffalo, New York-based law firm Beckage and a former U.S. Department of Justice attorney.

Baker Botts special counsel Cynthia Cole said the FTC's newly announced rigor regarding data security and privacy opinions is a response to the large trend of data privacy laws enacted internationally and domestically.

“[The orders are] more focused on the security of data, which is very much in line with GDPR principles [because of] the fact that they are saying they need to have third-party assessment and in i-Dressup.com they need to appoint a data security officer or senior-level management.”

While lawyers that spoke to Legaltech News said the orders included many agreed-upon best practices, they also noted the agency's announcement is in part to proclaim its authority.

“I think the FTC is trying to show some muscle and try to exercise that muscle with the constraints they currently have,” Cole added. Indeed, as talk of a national data privacy law heats up, the FTC is jockeying to be the lead authority if a nationwide regulation is enacted.

Recently in testimony before the U.S. House of Representative's House Energy and Commerce subcommittee on consumer protection, FTC chairman Joseph Simons called for a data privacy law and authorization for the agency to enforce it.   

To be sure, lawyers did say more detailed orders from the FTC creates better guidelines for companies to follow. The FTC is “making an effort to throw their hats in the ring to be a participant in those privacy discussions,” said Jennifer Beckage of Beckage.

Still, although talks are intensifying about a possible national data privacy law, Richard Newman of Hinch Newman noted the FTC's new initiative may also be sparked by an appeal's court finding that the agency failed to include specificity in a settlement order with LabMD Inc. last year.

“The court held that the FTC's order should be invalidated because it failed to direct LabMD to cease committing any specific unfair acts or practices and instead imposed on the general requirement that the company maintain a 'comprehensive information security program that is reasonably designed to protect the security, confidentiality and integrity of personal information collected from or about consumers.'”

Newman added that while that 11th Circuit decision perhaps wasn't the overriding factor for the FTC's new stance, it was likely a component.

“Here, the FTC was almost certainly mindful of the need for specificity in conjunction with injunctive relief and how failing to account for the issue may render settlements vulnerable to attack.”