If your company has a data privacy policy in place, make sure you live up to its provisions. Failure to do so makes it more likely that the Federal Trade Commission (“FTC”) will pursue an enforcement action against the company for engaging in a “deceptive practice” under Section 5 of the FTC Act.

What can you do to prevent this from happening? A recent article, referencing an FTC enforcement action, suggests the following:

• Conduct risk assessments

• Use “reasonable methods” to prevent/detect unauthorized access to personal information

• Train employees

• Employ proper response measures

If your business is a financial institution, or your company maintains personal health information, specific Federal laws (Graham-Leach-Bliley, HIPPA) directly impact your obligations with respect to data security and personal health information, respectively.