FTC v Wyndham MTD Ruling

Ruling on a motion to dismiss brought by Wyndham hotels, a Federal District Court has decided that the Federal Trade Commission has authority under the unfairness prong of the FTC Act to bring enforcement actions to remedy unreasonable data security practices. The court ruled that it is not required that Congress explicitly give the FTC the authority to use the FTC Act against companies who cause consumer and business harm by maintaining weak data security systems. The FTC also need not promulgate regulations regarding data security, or explain in detail which security practices are lawful and which are not, prior to bringing an enforcement action. In deciding that the FTC's enforcement action could proceed against Wyndham, the court also allowed the FTC's claim that the differences between promises Wyndham made in its privacy policy and the company's actual data security practices were sufficient to support a deceptive practices claim under the FTC Act.