Antitrust Law Daily Wrap Up, CONSUMER PROTECTION—DAriz: FTC Action Against Hotel Franchisor Wyndham Transferred to New Jersey District , (Mar 26, 2013)

By Peter Reap, J.D., LLM

The federal district court in Phoenix has transferred an action brought there by the Federal Trade Commission (FTC) against hotel franchisor Wyndham Worldwide Corporation and three affiliated entities (collectively, “Wyndham”) for failing to reasonably secure sensitive consumer data to the New Jersey federal district court (FTC v. Wyndham Worldwide Corp., March 25, 2013, Rosenblatt, P.). The relevant factors under the federal venue statute, particularly the convenience of the witnesses, weighed in favor of the transfer.

Background. The FTC alleges that Wyndham’s “failure to maintain reasonable security allowed intruders to obtain unauthorized access to the computer networks of Wyndham Hotels and Resorts, LLC, and several hotels franchised and managed by Wyndham on three separate occasions in less than two years.” In each incident, hackers allegedly accessed sensitive consumer data located in Wyndham’s Phoenix data center.

The amended complaint alleges deception (Count I) and unfairness (Count II) in violation of the FTC Act based on representations Wyndham made in its advertising, marketing, and sales materials that it used industry-standard security measures to protect guests’ personal information and its failure to implement “reasonable and appropriate measures to protect personal information against unauthorized access.”

Wyndham filed a motion to transfer the case to the United States District Court for the District of New Jersey or, in the alternative, to the United States District Court for the District of Columbia.

Legal standard. The federal venue statute provides: “For the convenience of the parties and witnesses, in the interest of justice, a district court may transfer any civil action to any other district or division where it might have been brought.” The court has discretion to transfer actions according to an individualized, case-by-case consideration of convenience and fairness.

The court is required to weigh several factors, including the convenience of the parties, the relative financial burdens, the convenience of witnesses, the availability of compulsory process to compel unwilling witness attendance, the availability of witnesses and their live testimony at trial, the ease of access to sources of proof, relevant contacts with the chosen forum, jurisdiction over the parties, the state most familiar with the governing law, and the relevant public policy of the forum state.

Analysis. It was undisputed that the case could have been brought in New Jersey or Washington, D.C. Wyndham argues that transfer is appropriate because the parties are located in New Jersey and Washington, most of the witnesses reside in or near New Jersey, and Wyndham’s data-security program—which is the core conduct relevant in this case—was principally devised, implemented, and managed in New Jersey.

Courts give deference to a plaintiff’s choice of forum, the court observed. However, the choice of forum is only entitled to minimal consideration when the operative facts have not occurred within the forum of original selection and that forum has no particular interest in the parties or the subject matter. Here, The FTC’s choice of venue was entitled to limited deference because it did not “reside” in Arizona and the operative facts of the case did not occur in Arizona, the court held.

Wyndham identified 11 witnesses, current and former employees, who reside in or near Newark, New Jersey. These individuals would testify about data-security protections in place prior to the first intrusion, Wyndham’s responses to intrusions, and Wyndham’s current data-security practices. According to Wyndham, “[e]ssentially all the current employees who have knowledge of those issues work at defendants’ headquarters in New Jersey.”

Kirsten Hotchkiss, a Wyndham senior vice president, stated that only one current and one former employee—Mike Stevens and Jason Rowland, respectively—who had “significant knowledge regarding the intrusions” reside in Arizona. Stevens and Rowland, however, both reported to senior employees who resided in New Jersey.

The potential testimony of the Arizona witnesses was not as significant as that of the New Jersey witnesses, the court determined. Stevens and Rowlands reported to senior-level employees in New Jersey. The fact they were custodians of records produced during the FTC investigation did not mean that they are key witnesses with respect to the deception and unfairness counts against Wyndham.

The FTC identified as witnesses two other Wyndham employees residing in Arizona—the Director of Sales and Marketing at the Phoenix hotel that was hacked during the first attack and the president of the company that owned that hotel. According to the FTC, the former “is likely to have material testimony about Wyndham’s role in providing information technology and information security services to the Wyndham-branded hotels,” while the latter “is likely to have material testimony about the facts surrounding the three breaches and how they affected the Wyndham Phoenix Hotel.”

This potential testimony was unlikely to have the significance of the testimony offered by the New Jersey employees who were responsible for developing and implementing Wyndham’s data- security practices.

Finally, the FTC identified two Arizona employees of Fishnet Security, a consulting firm retained by Wyndham to examine the cyber attacks. Each would “testify to the results of his forensic investigation and the nature of the remedial steps he advised.”

However, because Wyndham’s third-party New Jersey witnesses would also offer testimony about their response to the attacks, the presence of FTC’s witnesses in Arizona did not weigh in favor of venue in Arizona. In sum, the convenience of the parties and witnesses strongly favored transfer to New Jersey, according to the court.

For the reasons stated above, additional factors weighed in favor of transfer of venue. Ease of access to sources of proof, relative financial burden, and costs of litigation favored transfer to New Jersey, the court reasoned. Generally, litigation costs were reduced when venue was located near most of the witnesses expected to testify or give depositions. The remaining factors did not weigh in favor of either party.

The case is CV 12-1365-PHX-PGR.

Attorneys: Andrea Vanina Arias for Federal Trade Commission. Anne Michelle Chapman (Osborn Maledon PA) for Wyndham Worldwide Corp.

Companies: Wyndham Worldwide Corp.

Cases: ConsumerProtection FranchisingDistribution Privacy ArizonaNews