Navigating The Cyber Liability Storm Part I

Franchisors are facing a precarious three-way intersection of increased accountability and regulation over consumer privacy, the growing volume and sophistication of cyber-attacks on consumer data, and the expanding boundaries of franchisor liability for matters arising at the franchise unit level.

Two recent cases have raised awareness of the risky climate for franchisors in the realm of cybersecurity and privacy compliance.

Aaron's, Inc.¹

On March 10, 2014, the Federal Trade Commission ("FTC") approved a final order settling charges that the franchisor knowingly assisted its franchisees to engage in deceptive acts and practices, and that the franchisor permitted and participated in gathering consumer information in a manner that resulted in significant risk of harm. Not only is Aaron's, Inc. the first case that held a franchisor liable for franchisee conduct involving breach of consumer privacy, it also imposes an obligation on a franchisor to oversee and