3rd Circuit Sides With FTC in Agency’s Case Against Wyndham

Wyndham’s computer systems were breached three times in 2008 and 2009 by hackers, resulting in hundreds of thousands of consumers having their personal and financial information stolen, the FTC alleged that Wyndham’s conduct was unfair and its privacy policy was deceptive. A federal district court denied Wyndham’s motion to dismiss the lawsuit. The 3rd Circuit granted interlocutory appeal on two issues: Whether the FTC has authority to regulate cybersecurity under the unfairness prong of its Section 5 authority and whether Wyndham had fair notice from the FTC that its cybersecurity practices fell short. Ultimately, the appeals court sided with the FTC. “The three requirements in § 45(n) may be necessary rather than sufficient conditions of an unfair practice, but we are not persuaded that any other requirements proposed by Wyndham pose a serious challenge to the FTC’s claim here,” Ambro wrote. “Wyndham repeatedly argued there is no FTC interpretation of § 45(a) or (n) to which the federal courts must defer in this case, and, as a result, the courts must interpret the meaning of the statute as it applies to Wyndham’s conduct in the first instance,” he said. “Thus, Wyndham cannot argue it was entitled to know with ascertainable certainty the cybersecurity standards by which the FTC expected it to conform,” Ambro said. “Instead, the company can only claim that it lacked fair notice of the meaning of the statute itself -- a theory it did not meaningfully raise and that we strongly suspect would be unpersuasive under the facts of this case.” Wyndham had no immediate comment. The ruling "reaffirms the FTC’s authority to hold companies accountable for failing to safeguard consumer data,” FTC Chairwoman Edith Ramirez said. “It is not only appropriate, but critical, that the FTC has the ability to take action on behalf of consumers when companies fail to take reasonable steps to secure sensitive consumer information.”