In a recent settled enforcement action, the SEC provided an important lesson on required public disclosures.[1] The SEC charged that Facebook disclosed misuse of its user data as a potential or hypothetical risk even though the company knew that user data had actually been misused.
According to the SEC’s