The Federal Trade Commission (FTC) is more active in privacy and data security enforcement actions now than at any time in recent memory. It announces new enforcement actions almost daily, together with press releases, public statements from one or more Commissioners, and, in many cases, agreed (stipulated) orders that provide for significant monetary relief and civil penalties.
These orders also contain breathtakingly broad injunctive provisions — including some injunctions that attach to specific individuals for decades, onerous required privacy and/or data security programs, recordkeeping, reporting, the forfeiture of data collected in violation of law, and even of algorithms developed using such data. The breadth of FTC orders is trending up and to the right, and the frequency of FTC investigations leading to them is also increasing.
