On May 20, 2022, with little fanfare and just five short paragraphs, the Federal Trade Commission announced that businesses must publicly report security incidents to prevent potential harms, even if no other applicable law would compel such notice. Specifically, the FTC opined, failing to disclose a breach to consumers and other affected parties could constitute an unfair or deceptive trade practice under Section 5 of the FTC Act.
Please don’t go looking for an explicit breach notification requirement in the FTC Act. It’s not there. Don’t look for a regulation, either. The only FTC-authored rule requiring notification of a breach applies to a limited audience: vendors of personal health records and (surprise!) health apps, courtesy of the HITECH Act.
Source: