Landmark Decision Confirms FTC Authority To Regulate Privacy And Data Security

In FTC v. Wyndham Worldwide Corp., No 13-1887, 2014 U.S. Dist. LEXIS 47622 (D.N.J. Apr. 7, 2014)—a case closely watched by privacy and data security professionals across the United States—a federal district court held that the Federal Trade Commission ("FTC") has authority under Section 5 of the Federal Trade Commission Act ("Act")¹ to regulate data security practices and to bring enforcement actions targeting those practices deemed insufficient.² Notwithstanding any appeal in the case, the FTC's increasingly active role of late in regulating data security practices and the federal district court's decision in Wyndham means that businesses should assess and, where appropriate, implement security measures that meet industry standards. Businesses should also review existing privacy policies in order to ensure consistency with actual practices.