Antitrust Law Daily Wrap Up, PRIVACY—D.N.J.: FTC action against Wyndham hotels over data security breaches may proceed, (Apr 8, 2014)

By Linda O’Brien, J.D., LL.M.

In an action by the FTC against a hotel and resort chain for allegedly engaging in unfair and deceptive acts or practices by failing to implement reasonable data security measures protecting consumer information following two data breaches, the FTC adequately pleaded substantial, unavoidable consumer injury to support its unfair and deceptive practices claims, the federal district court in Newark has decided. Further, the FTC had the authority to bring the unfairness claim and was not required to promulgate regulations before bringing the claim (FTC v. Wyndham Worldwide Corporation, April 7, 2014, Salas, E.).

Hotel and resort chain, Wyndham Worldwide Corporation, franchises hotels and sells timeshares. Under its franchise agreements, Wyndham requires franchisee hotels to purchase and configure to their specifications a designated computer system to handle reservations and credit card payments. The system, which stores consumers’ personal information, is linked to the corporate network, including a central reservation system.

The FTC filed suit against Wyndham, alleging deceptive and unfair acts or practices in connection with its failure to maintain reasonable and appropriate data security for consumers’ personal information, in violation of the Section 5 of the FTC Act. Specifically, the FTC alleged that, between April 2008 and January 2010, intruders gained unauthorized access on three separate occasions to Wyndham’s computer network, which included stored personal information of customer payment card account numbers, expiration dates, and security codes. After discovering the first two data breaches, Wyndham failed to take appropriate steps in a reasonable time frame to prevent further compromise of the hotel’s network. As a result of Wyndham’s failure to implement reasonable and appropriate security measures, the exposure of consumers’ personal information caused substantial financial injury to consumers and businesses. Wyndham moved to dismiss the FTC complaint.

FTC authority. The court found that the FTC had the authority to bring an unfairness claim involving data security. The FTC Act defines “unfair acts or practices” as those that cause or are likely to cause substantial consumer injury that are not reasonably avoidable by the consumers themselves and not outweighed by any benefits to consumers or competition. The court noted that Wyndham failed to show how the FTC’s unfairness authority over data security would lead to results that are incompatible with recent legislation or contradict congressional policy. Any subsequent legislation would complement and not preclude FTC authority. Moreover, at no time has Congress withdrawn the broad discretionary authority originally granted to the FTC when it was formed to define unfair practices on a flexible, incremental basis.

Regulations. The FTC is not required to formally promulgate regulations before bringing an unfairness claim to satisfy fair notice principles, according to the court. Regarding enforcement of data security issues, the FTC had the discretion to proceed either by rulemaking or by individual adjudication. The promulgation of regulations was not the only means of providing sufficient fair notice, and Wyndham could have evaluated the reasonableness of its data security program in view of industry guidance sources, the FTC’s business guidance brochure, and FTC consent orders. Furthermore, to require the FTC to cease bringing all unfairness actions without first prescribing regulations would contradict the inherent flexibility in the FTC Act.

Adequacy of claims. The FTC adequately pleaded its unfairness claims. The court noted that the FTC’s allegations were sufficient to allow a reasonable inference that Wyndham’s data security practices exposed consumers’ personal data to unauthorized access, which ultimately caused substantial injury. In rejecting Wyndham’s argument that federal law limiting the amount of consumer liability for unauthorized payment card use meant any alleged injury could not be substantial, the court noted that an inference could be drawn that allegations of some unreimbursed financial injury were substantial. Moreover, the FTC described several data security insufficiencies in detail to satisfy federal pleading standards.

Additionally, the FTC adequately pleaded its deception claims. The FTC alleged that Wyndham was responsible for data security failures by allowing computers with inadequate security measures on its network and had control over the relevant aspects of its franchisees’ data security practices. The FTC also alleged that Wyndham disseminated privacy policies on its website. Accepting the allegations are true for purposes of the motion to dismiss, the court determined that the allegations supported a deception claim against Wyndham. Finally, the question of whether a reasonable consumer, after reading the website privacy policy statements, would have understood the statements to make representations about data security practices at the parent company and all Wyndham brand hotels created fact issues that could not resolved at the current stage of the suit, the court concluded.

The case is No. 13-1887.

Attorneys: Allison Michelle LeFrak for Federal Trade Commission. Jennifer A. Hradil (Gibbons, PC) for Wyndham Worldwide Corporation.

Companies: Wyndham Worldwide Corporation

Cases: ConsumerProtection Privacy NewJerseyNews