Wyndham And FTC Agree To Consent Order Ending Data Security Breach Litigation

On Friday, December 11, 2015, the U.S. District Court for the District of New Jersey entered a consent order between the Federal Trade Commission (“FTC”) and hospitality company Wyndham Hotels and Resorts, LLC (“Wyndham”) along with several of its affiliates, putting to an end an FTC lawsuit alleging that Wyndham’s data security practices violated Section 5 of the FTC Act. The Wyndham order is of interest to all companies that collect or receive payment card information and/or are subject to an FTC data breach investigation, not only because it ends the first ever fully contested FTC action over the application of Section 5 to data security, but also because it provides guidance on the FTC’s position as to the elements of a reasonable data security program for payment card data. The Wyndham order is also notable for imposing narrower obligations on Wyndham than the FTC has typically obtained against the targets of its data security investigations.