Wyndham Agrees To Settle FTC Data Security Case

After four years of litigation, this past Wednesday, Wyndham Worldwide Corporation and three of its subsidiaries  (collectively, "Wyndham") settled the Federal Trade Commission's ("FTC") allegations that the global hospitality company failed to protect consumers' personal information in violation of Section 5 of the FTC Act.  Between 2008 and 2009, Wyndham suffered a series of data breaches that involved the credit and debit card information of more than 600,000 hotel customers.  This settlement comes at the heels of the Third Circuit Court of Appeals decision that affirmed the FTC's authority to bring an action for lax data security practices under Section 5 of the FTC Act, which prohibits unfair or deceptive practices.  We described the appellate decision at length here (See additional coverage of the Wyndham case here and here).  The settlement covers a 20-year period and does not involve a civil penalty.  However, Wyndham must (1) implement and maintain