Hard Lessons From The Wyndham Decision: What Businesses Must Know About The FTC's Authority To Regulate Data Security

In a unanimous decision, the U.S. Court of Appeals for the Third Circuit upheld the Federal Trade Commission's ("FTC") authority to bring actions against companies for failure to adequately protect consumer information from data breaches. Federal Trade Commission v. Wyndham Worldwide Corp., et al., No. 14-3514 (3d Cir. Aug. 24, 2015). The decision is the first time a court has opined on the scope of the FTC's authority, and it solidifies the FTC's position as a regulator of corporate data security standards. It also is another reminder of the critical need for all companies to establish, update, and follow their data privacy standards.

Background

The action stemmed from Wyndham Worldwide Corp.'s ("Wyndham") allegedly faulty cybersecurity measures from 2008 and 2009, during which three separate hacking episodes occurred. Hackers broke into Wyndham's computer network and stole unencrypted data from at least 619,000 consumers. The resulting loss was $10.6 million.