The utility had sold 230 disks to a salvage operator, who sold 84 on eBay. Most of the drives have been returned to Idaho Power. The incident was disclosed earlier this month.

The Federal Trade Commission would not confirm or deny whether the incident is under investigation..

"In theory, there are different statutes that might come into play, but whether it was a basis for action would depend on the underlying circumstances," said Alain Sheer, an attorney in the division of privacy and identity protection in the bureau of consumer protection for the FTC, in Washington..

The Idaho Public Utilities Commission, which governs Idaho Power, would only investigate the incident if it has a direct financial impact on rate payers. a spokesman said.

"If they were to file a rate case and include costs of this mishap, we'd probably deny those costs," he said. "The only way we would be involved is if a rate payer filed a complaint that he was harmed."