Third Circuit Permits Federal Trade Commission To Bring Unfair Practice Claim Based On Cybersecurity Practices

In a closely-watched cybersecurity case, a three-judge panel of the U.S. Court of Appeals for the Third Circuit held in Federal Trade Commission v. Wyndham Worldwide Corporation (No. 14-3514) that the Federal Trade Commission ("FTC") may bring a claim that a company's data security practices, or alleged lack thereof, are "unfair" business practices in violation of Section 5 of the Federal Trade Commission Act, even in the absence of formal rulemaking. While the facts in Wyndham fall at one end of the spectrum, and the panel did acknowledge the possibility of "borderline" scenarios, the opinion demonstrates that companies that fail to take action in response to known cybersecurity holes that they could reasonably foresee leading to the loss of sensitive consumer information do so at their peril.