One of the most important regulatory agencies in the area of privacy in the US is the Federal Trade Commission. While Health and Human Services developed and enforces the HIPAA rules. And other agencies have developed and enforce other industry sector privacy regulations. There is this broader backdrop related to privacy in the US. And again, this comes from the FTC. The FTC regulates, with few exception,s all commercial entities. And we've seen its regulation of nonprofits as well. It does so in the privacy field most commonly through its authority under Section 5 of the FTC Act. Which provides that unfair or deceptive acts or practices in or affecting commerce are declared unlawful. Deception under this standard is a representation, omission or practice that's likely to mislead the consumer. Unfair practices under the standard are those that cause or are likely to cause substantial injury to consumers. Which is not reasonably avoidable by consumers themselves. And which is not outweighed by countervailing benefits to consumers or to competition. The FTC has been very active in bringing privacy cases based on finding certain acts and practices deceptive or unfair. Indeed it's done so 60 times between 2002 and 2017. A recent case against Uber Technologies, the ride-sharing company is illustrative. The FTC alleged in its complaint against Uber that Uber had misrepresented its privacy protections. With statements including, but not limited to, access to rider and driver accounts is being closely monitored and audited by data security specialists on an ongoing basis. And, all of your personal information including payment methods is kept secure and encrypted to the highest security standards available. The FTC alleged that these statements were misleading. Because, according to the FTC, in truth and in fact Uber, had suspended monitoring employees' access to driver and rider information. And because it's computing infrastructure lacked several of the promised highest security standards. Including encrypting data it stored in the cloud. As is often the case with FTC enforcement actions, the case settled with no admission of wrongdoing. But with Uber agreeing to a consent decree with some pretty significant requirements. Including, but not limited to, first, prohibiting misrepresentations regarding the monitoring or auditing of access to personal information. And prohibiting misrepresentations regarding the extent to which it protects privacy, confidentiality, security or integrity. The consent decree also required the establishment of a comprehensive privacy program. Including, but not limited to, the designation of a responsible person for the program. A risk assessment regarding personal information protection. Including covering topics like employee training and management, product design development and research. Secure software design development and testing. Review assessment and response to third-party security vulnerability reports. And prevention, detection and response to attacks, intrusions or system failures. This consent decree also required initial and biennial assessments of the privacy program by a qualified objective independent third party professional. Who uses procedures and standards generally accepted in the profession. Most professionals studying FTC cases agree that consent decrees involved in privacy cases can be extensive, detailed, challenging, costly and long-lasting. They typically last about 20 years.