The Federal Trade Commission scored a major win today in its efforts to regulate cybersecurity when the Third Circuit affirmed that the agency can exercise its unfair practices jurisdiction to sue companies that do not take reasonable data security measures.
The FTC sued Wyndham Worldwide Corp. in district court after hackers obtained over 600,000 consumers' credit card information from the hotel group's systems in 2008 and 2009, resulting in over $10 million in fraudulent charges. Unlike virtually all other FTC cybersecurity cases, Wyndham opted to challenge the FTC's authority rather than settling.
The Third Circuit upheld the decision of the district court and ruled that the allegations of inadequate cybersecurity measures were within the plain meaning of the term "unfair" as it is used in Section 5 of the FTC Act. The three-judge panel also rejected Wyndham's argument that it did not have fair notice of the specific cybersecurity standards it was required to follow because the FTC had not promulgated any. In rejecting Wyndham's fair notice claim, the court cited many factors showing that it could have reasonably foreseen that its alleged practices would be construed as violating the FTC Act. For example, the court noted that the FTC did not simply allege that Wyndham, which had been hacked three times, used weak firewalls, IP address restrictions, encryption software, and passwords, but rather, it alleged that, "Wyndham failed to use any firewall at critical network points, did not restrict specific IP addresses at all, did not use any encryption for certain customer files, and did not require some users to change their default or factory-setting passwords at all."
Today's decision can only embolden the FTC to be even more aggressive in taking action when it believes that poor data security practices cause harm to consumer privacy and further highlights the critical importance of comprehensive data security practices for businesses.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
