Critics question FTC's authority to bring data security complaints