The Federal Trade Commission suffered a setback Wednesday in its efforts to police cybersecurity practices, as a federal appeals court struck down an order that compelled a now-defunct medical testing company to implement “sweeping” data protection measures.

In a 31-page opinion, a three-judge panel of the U.S. Court of Appeals for the Eleventh Circuit said the FTC overreached in ordering the company, Georgia-based LabMD, to establish a comprehensive data security program.