Washington Post: The FTC is doing more to protect data, but to some it’s still not enough

“They have done a lot of work over the years to develop a clear framework for what is expected of businesses and what can bring them under enforcement actions,” John Davisson, director of litigation and senior counsel at the Electronic Privacy Information Center, told me. But “there are limitations to the FTC enforcement powers, significant ones, and those are a problem for all of its data protection work.”

[…]

Because the FTC usually can’t punish first offenses, “companies kind of get a mulligan,” Davisson said — although they aren’t entirely off the hook with initial offenses if the FTC places them under a consent decree that spells out remediation steps, he added. 

Read the full story.