FTC Data Security Authority Confirmed, For Now: Wyndham’s Motion To Dismiss Denied

The FTC's Claim

A New Jersey federal judge has confirmed the Federal Trade Commission's ("FTC") authority to regulate data security and bring claims against companies suffering data breaches due to inadequate cybersecurity safeguards, at least for now. In FTC v. Wyndham Worldwide Corp., et al., No. 13-1887 (D.N.J), the FTC brought a claim against Wyndham Worldwide Corporation ("Wyndham") relating to alleged "data security failures that led to three data breaches at Wyndham hotels in less than two years." The FTC claimed that Wyndham violated Section 5(a) of the FTC Act, which prohibits "unfair or deceptive acts or practices in or affecting commerce" by failing to (a) comply with its customer-facing privacy policies, and (b) maintain adequate data security standards.