In plain terms. The Federal Trade Commission Act created the FTC and, through Section 5's prohibition of "unfair or deceptive acts or practices," supplies the FTC's principal authority to bring data-security and privacy enforcement actions. It is the de facto baseline for commercial data-protection accountability in the United States.
Citation. Pub. L. 63-311 (Sep. 26, 1914); 15 U.S.C. §§ 41-58.