Yesterday, the FTC published a blog post outlining what companies should expect if they find themselves as the subject of an FTC data security investigation.  In addition to highlighting the different phases of the FTC’s investigative process, the FTC’s discussed the types of information that it seeks as well as the questions it wants answered.  The FTC highlights that it would consider a company’s cooperation with “criminal and other law enforcement agencies in their efforts to apprehend the people responsible for the intrusion” as part of the “steps the company took to help affected consumers[,]” and such cooperation with law enforcement would lead the FTC to “likely . . . view that company more favorably than a company that hasn’t cooperated.”  Notably, the FTC does not provide any guidance on what actions qualify as “cooperation with law enforcement” or whether withholding privileged information — such as internal or third-party forensic reports — would be viewed less favorably than a company that discloses such information. 

Yesterday, the U.S. Supreme Court granted certiorari and agreed to consider Campbell-Ewald Company v. Gomez, in which the U.S. Court of Appeals for the Ninth Circuit held that a consumer’s failure to accept an advertiser’s settlement offer that would fully satisfy the consumer’s claim did not render moot either the consumer’s individual claim under the Telephone Consumer Protection Act (TCPA) or his putative class action, arising from the alleged transmission of unsolicited automated text messages.