Third Circuit Decides The FTC Will Be The Primary Authority On Data Breach And Privacy

In FTC v. Wyndham Worldwide Corporation, et al.,¹ the United States Court of Appeals for the Third Circuit held that the Federal Trade Commission ("FTC") has the authority over "unfair or deceptive" cybersecurity practices under Section 5 of the Federal Trade Commission Act ("Act"). This case will have important implications for any business or person that solicits, accepts and stores private, personal and financial information.

On three occasions in 2008 and 2009, hackers successfully accessed Wyndham Worldwide Corporation's ("Wyndham") computer systems. In total, they stole personal and financial information for hundreds of thousands of consumers, leading to over $10.6 million in fraudulent charges. The FTC filed suit in federal District Court alleging that Wyndham's conduct was an unfair practice and that its privacy policy was deceptive. More specifically, the FTC alleged that Wyndham: