On June 6, the Eleventh Circuit Court of Appeals threw out a cease-and-desist order the Federal Trade Commission ("FTC") issued against a clinical laboratory. The order had directed the company to overhaul its data security program pursuant to the FTC's authority to regulate unfair acts or practices under Section 5(a) of the FTC Act. Even assuming that the company's alleged failure constituted an unfair act or practice, the Eleventh Circuit nevertheless found that the cease-and-desist order exceeded the FTC's authority by failing to enjoin any specific act or practice, instead mandating a complete overhaul of the company's data protection program.