BJ’s and DSW Cases Open a New Front in the War on Data Insecurity

Both federal and state regulators have expanded their campaigns against companies that fail to secure customer data or fail to advise consumers when breaches of information security have occurred. The new enforcement strategy, which targets companies that have given no assurances to consumers about information protection, is signaled by enforcement actions recently announced by the Federal Trade Commission ("FTC" or "Commission") and the Ohio Attorney General.

On June 16, 2005, the FTC announced its proposed settlement of an enforcement action against BJ’s Wholesale Club, Inc. ("BJ’s"). According to the FTC, BJ’s had committed unfair acts and practices when it failed to implement reasonable procedures to protect its customers’ credit and debit card information. BJ’s apparently had transmitted and stored this information in unencrypted form, using computer networks that could be accessed by means of default passwords and insecure wireless connections, with the result