The fight between the Federal Trade Commission and LabMD, the defunct medical testing lab, entered a new chapter late yesterday. In a 13-page ruling, the U.S. Court of Appeals for the Eleventh Circuit said that LabMD’s appeal presented “a serious legal question” as to the Commission’s interpretation of Section 5 of the FTC Act and that any enforcement of the agency’s order should be stayed until the appellate process had run its course.

‎LabMD’s appeal to the Eleventh Circuit has set up a high stakes legal battle with far-reaching implications for any organization under the FTC’s watch: namely, the interpretation of Section 5’s requirement that an unfair act or practice “causes or is likely to cause substantial injury to consumers….”.

LabMD has been sparring with the FTC since 2013 when an administrative complaint charged the lab with shoddy data security practices. But after years of discovery and motion practice, Chief Administrative Law Judge D. Michael Chappell dismissed the FTC’s case against LabMD. He concluded that the FTC failed to show any proof whatsoever of actual consumer injury and flatly rejected the FTC’s theory that a statistical or hypothetical risk of future harm was enough to find LabMD liable for unfair conduct under the FTC Act. “To impose liability for unfair conduct under Section 5(a) of the FTC Act, where there is no proof of actual injury to any consumer, based only on an unspecified and theoretical ‘risk’ of a future data breach and identity theft, would require unacceptable speculation and would vitiate the statutory requirements of ‘likely’ substantial consumer injury.”

But the Commission reversed the ALJ’s ruling, holding that “an intangible but very real harm like a privacy harm resulting from the unauthorized disclosure of sensitive health or medical information may constitute a substantial injury.” In its decision, the Commission declared that Congress had entrusted it with protecting a broad range of consumer harms and “need not wait for consumers to suffer known harm at the hands of identity thieves” before taking action.

In granting the stay, the Eleventh Circuit concluded that LabMD had “made a strong showing that the FTC’s factual findings and legal interpretations may not be reasonable.”