FTC V. Wyndham: The Third Circuit Recognizes FTC Authority To Regulate Commercial Cyber Security Practices

In 2014, the United States Court of Appeals for the Third Circuit ruling in FTC v. Wyndham Worldwide Corporation agreed to hear an immediate appeal on two issues: "whether the FTC has authority to regulate cybersecurity under the unfairness prong of § 45(a); and, if so, whether Wyndham had fair notice its specific cybersecurity practices could fall short of that provision." On August 24, 2015 the Third Circuit affirmed the decision of the District Court and denied Wyndham's motion to dismiss the complaint.

Factual Background

In 2012, after a two-year investigation into Wyndham's data security practices, the FTC filed suit against the hospitality company alleging that Wyndham had engaged in "unfair ... acts or practices" in violation of the Federal Trade Commission Act 15 U.S.C. § 45(a), by failing to take "reasonable and appropriate" measures to adequately secure hotel guests' personal information. Specifically, the FTC alleged that between 2008 and January 2010,