Lawyers often say “bad facts make bad law”. Combine that with weak legal arguments and, well, things can get really bad, really fast. That’s precisely what happened to Wyndham yesterday when the Third Circuit affirmed a federal District Court decision that the Federal Trade Commission (“FTC”) has authority to regulate cybersecurity under the unfairness prong of § 45(a) of the Federal Trade Commission Act. While commentators may disagree on the result from a legal or policy perspective, one thing is for certain, it was a bad result for Wyndham. The decision rejected in no uncertain terms Wyndham's argument that the FTC lacked authority; and not kindly.
By now, the facts of the Wyndham debacle are well known. As summarized by the Third Circuit:
On three occasions in 2008 and 2009 hackers successfully accessed Wyndham Worldwide Corporation's computer systems. In total, they stole personal and financial information for hundreds of thousands of consumers leading to over $10.6 million dollars in fraudulent charges.
On appeal, Wyndham presented essentially two arguments: (a) in addition to meeting the requirements of Section 45(n), its behavior must be “unscrupulous or unethical” to be actionable and (b) it did not have fair notice of the “specific cybersecurity standards” it was required to follow. The Third Circuit disposed of each of these arguments easily, leaving little doubt that if a company makes privacy or security claims for which it lacks reasonable basis, it will be held responsible.
As to the first argument, the Third Circuit both rejected the proposition and chided Wyndham for even raising it under the circumstances:
Furthermore, in response to Wyndham’s argument that extending the FTC's reach to Wyndham's conduct would necessarily result in the FTC "regulat[ing] the locks on hotel rooms . . . [authorizing the FTC] to sue supermarkets that are "sloppy about sweeping up banana peels", the court said:
Th[is] argument is alarmist to say the least. And it invites the tart retort that, were Wyndham a supermarket, leaving so many banana peels all over the place that 619,000 customers fall hardly suggests it should be immune from liability under § 45(a).
Wyndham fared no better on its second argument. In disposing of it the court noted that Wyndham changed its position at least seven times throughout the appeal. The court resolved that: "Wyndham was not entitled to know with ascertainable certainty the FTC's interpretation of what cybersecurity practices are required by § 45(a)", and that "Fair notice is satisfied as long as the company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute". The court elaborated, assuming that what Wyndham was really arguing was that the statute had not been fairly applied by the FTC because the FTC did not apply cost-benefit analysis required under §45(n), i.e. whether the harm to consumers was reasonably avoidable by consumers and not outweighed by countervailing benefits:
Wyndham's as-applied challenge falls well short given the allegation in the FTC complaint. As the FTC points out in its brief, the complaint does not allege that Wyndham used weak firewalls, IP address restrictions, encryption software, and passwords. Rather, it alleges that Wyndham failed to use any firewall at critical network points, did not restrict specific IP addresses at all, did not use any encryption for certain customer files, and did not require some users to change their default or factory-setting passwords at all. . . .
Wyndham's as-applied challenge is even weaker given it was hacked not one or two, but three, times. At least after the second attack, it should have been painfully clear to Wyndham that a court could find its conduct failed the cost-benefit analysis.
In the end, the court stated:
Thus, Wyndham cannot argue that it was entitled to know with ascertainable certainty the cybersecurity standards by which the FTC expected it to conform. Instead, the company can only claim that it lacked fair notice of the meaning of the statue itself - a theory it did not meaningfully raise and that we strongly suspect would be unpersuasive under the facts of this case.
Bottom line, as far as this case goes, yesterday was not a good day for Wyndham. The appellate court's decision lays bare that Wyndham - once again – failed to learn from and even disregarded its prior experience to the detriment of its customers. Also, in response to Wyndham’s direct challenge to the FTC's authority, the Third Circuit has now confirmed in an important published decision the FTC’s authority to regulate cybersecurity under the unfairness prong of §45(a). Perhaps, if, faced with better facts (and arguments), the court may have reached a different result. But, certainly, when a company doesn’t mind the "promise vs. performance" gap with respect to its public statements about security and its actual practices tempt fate, it risks the scrutiny of trade practice regulators and disappointed customers and their lawyers. The consequences of failure can be great: reputational harm, customer flight, lost sales, exposure of trade secrets, remedial efforts, litigation and associated costs and damages, and, as Wyndham illustrates, regulatory agency scrutiny and action.
To avoid this result, all companies that collect and store customer data need to measure carefully what they say and what they do against constantly evolving data security standards to confirm they are employing reasonable practices, and that their statements about privacy match their actions. This means examining FTC enforcement actions for guidance, industry and government standards/recommendations (see, e.g., Framework for Improving Critical Infrastructure Cybersecurity), and adjusting security practices accordingly. It also means dusting off and reviewing published and often-forgotten privacy policies to ensure they align with the steps actually taken to secure customer data, and, of course, actually taking reasonable steps to do so. Oh, and insurance; don't overlook cybersecurity insurance. The process of applying for it will likely expose flaws in security practices, and getting it will help offset the considerable costs of responding to a data breach incident. Remember, most experts agree that it is no longer a question of whether a data breach will occur, but when. Forewarned is forearmed.
Scott G. Warner is an Owner at Garvey Schubert Barer, and is working out of its Seattle office. Benjamin J. Lambiotte is an Owner at Garvey Schubert Barer, and is working out of its Washington, D.C. office.
Ben Lambiotte has a broad and eclectic practice. Consistent with his wide range of experience in regulatory, transactional, professional responsibility and litigation matters, Ben has a broad and practical perspective on ...
Scott Warner represents a diverse array of clients, including software and hardware companies, chip manufacturers, video game companies, content providers, hospitals and biotech companies, medical device manufacturers ...
Greg Duff, Editor
Greg Duff founded and chairs GSB’s national Hospitality, Travel & Tourism group. His practice largely focuses on operations-oriented matters faced by hospitality industry members, including sales and marketing, distribution and e-commerce, procurement and technology. Greg also serves as counsel and legal advisor to many of the hospitality industry’s associations and trade groups, including AH&LA, HFTP and HSMAI.