In a test of the Federal Trade Commission's authority to
police cybersecurity, the Third Circuit Court of Appeals yesterday
ruled that the agency has broad power to take action against
private sector companies which fail to take adequate steps to
protect customer data.
In Federal Trade Commission v. Wyndham
Worldwide Corporation, the Third Circuit upheld
the FTC's authority to pursue a lawsuit against the hotel and
resort chain based on allegations that it failed to maintain
reasonable data security standards. After three successful
cyber-attacks on Wyndham's computer networks led to the theft
of thousands of customers' records, the FTC sued Wyndham in
federal court, alleging that Wyndham's cybersecurity practices
were "unfair and deceptive trade practices." The district
court
denied Wyndham's motion to dismiss, finding
that the Commission had the authority to regulate data security
practices. On appeal, the Third Circuit affirmed the district
court's ruling,
