U.S. District Court Confirms FTC Authority to Regulate Corporate Data Security Practices

On April 7, 2014, Judge Esther Salas of the U.S. District Court for the District of New Jersey denied the first ever motion to dismiss filed in Federal court that challenged the authority of the Federal Trade Commission ("the FTC") to regulate corporate data security practices under section 5(a) of the Federal Trade Commission Act (the "Act").  The ruling came as part of the ongoing litigation between the FTC and Wyndham Worldwide Corporation and its subsidiaries, including Wyndham Hotels and Resorts ("Wyndham").  Specifically, the District Court rejected Wyndham's argument that the FTC lacked authority under section 5(a) of the Act to bring a complaint alleging that Wyndham's "failure to maintain reasonable and appropriate data security for consumers' sensitive personal information" was an "unfair" or "deceptive" business practice.¹  FTC v. Wyndham Worldwide Corp., No. 13-1887, 2014 WL 1349019, at *3 (D.N.J. Apr. 7, 2014).  In so deciding, the District Court has