FTC Act Section 5 and Data: Why ‘Unfair’ Is a Recordkeeping Problem

The FTC does not need a specific rule to act on weak data security. Section 5's 'unfair' standard reaches almost any company, and the defence is evidence of reasonable practices.

Sarah MitchellUS agencies correspondent · New York

October 7, 2024 · 6 min read

Engineers reviewing code, illustrating reasonable data-security practices under FTC Section 5. · Image: Girder Group

There is no single federal statute that says “all companies must have reasonable data security.” The contradiction is that the FTC enforces one anyway, through Section 5’s prohibition on unfair practices, and the way a company escapes it is by being able to show, on the record, that its security was reasonable.

Key takeaways

Section 5 lets the FTC treat unreasonable data security as an 'unfair' practice, with no sector-specific rule required.
'Reasonable' is judged after the fact, which makes contemporaneous records of your controls the core defence.
Consent orders from FTC cases have effectively set baseline expectations across the economy.
The exposure reaches technology and consumer companies well outside financial services.

The standard, and why records carry it

Section 5 of the FTC Act prohibits “unfair or deceptive acts or practices in or affecting commerce” (15 U.S.C. § 45). The FTC has used the “unfair” prong for years to challenge data-security practices it considers unreasonable, without needing a bespoke rule for the industry involved. That breadth is the point: it reaches companies that assume no data-security law applies to them.

Because “reasonable” is assessed with hindsight after an incident, the company’s position is only as strong as the evidence it created beforehand, the risk assessments it ran, the controls it documented, the vulnerabilities it tracked and closed. A firm that did sensible things but recorded none of them argues from memory against a regulator arguing from consequences.

The FTC’s consent orders compound this. Over many cases they have described, in operational detail, the security programs firms must implement, effectively publishing a baseline that other companies are expected to meet. Reading those orders is a cheaper way to learn the standard than becoming one.

“‘Reasonable’ is judged after the fact, which is why the records you kept before the incident are the argument.”

How AI could address the gap

Section 5 rewards a company that can reconstruct, credibly, what it knew and did. That reconstruction is far easier when the evidence was captured continuously rather than assembled under subpoena.

AI-assisted systems can keep security decisions, risk findings, and remediations linked and timestamped, so “we acted reasonably” becomes a retrievable record rather than a recollection. As everywhere in this coverage, the machine maintains the evidence; a named owner still makes the calls.

Building the platforms, portals, and systems that make these obligations provable is what Girder Group does.

Sources

1.Federal Trade Commission Act, Section 5 (15 U.S.C. § 45).Federal Trade Commission
2.FTC data security guidance and enforcement resources.Federal Trade Commission

Sarah Mitchell

US agencies correspondent · Girder Group · New York

Sarah Mitchell covers US federal regulators, the SEC and FINRA, the FTC, and the FCC, with a focus on recordkeeping and data obligations, from Girder Group's New York desk.

Meet the desk