FTC watchers and data security experts, this is the decision you’ve been waiting for.The U.S. Court of Appeals for the Third Circuit issues a ruling in favor of the Commission Federal Trade Commission v. Wyndham Worldwide, Inc..
The Federal Trade Commission sued the hotel company and three subsidiaries, alleging data security failures led to three data breaches at Wyndham properties in less than two years. The complaints allege that these failures resulted in millions of dollars in fraudulent charges being charged to consumers’ credit and debit cards and that the account information of hundreds of thousands of consumers was transferred to websites registered in Russia.
In 2014, a federal district court in New Jersey denied Wyndham’s motion to dismiss the FTC lawsuit. The Third Circuit agreed to immediately hear the appeal on two issues: “whether the FTC has authority to regulate cybersecurity under unfair terms in Section 45(a); and, if so, whether Wyndham had sufficient notice of its particular network Road safety practices may not comply with this provision.”
If your customers are concerned about data security (and they should be), you will want to read the full opinion. But in summary, the Third Circuit upheld the district court’s ruling that the FTC can use the unfair conduct prohibition in Section 5 of the FTC Act to challenge the alleged data security breaches outlined in the complaint. The court also rejected Wyndham’s fair notice argument.
Of course, the case is still pending in the district court, but the Third Circuit’s decision affirms important principles about how the FTC Act applies in the data security arena.
The decision is a must-read for business executives and lawyers.
