The Third Circuit Upholds the U.s. Federal Trade Commission's Authority to Regulate Cybersecurity

The Federal Trade Commission's longstanding effort to establish itself as the primary federal regulator of cybersecurity survived its first appellate test on Monday when the Third Circuit allowed the FTC to continue pursuing its case against Wyndham Worldwide Corp.[1] The FTC sued Wyndham after the hotelier suffered three data breaches that allegedly compromised the payment card information of more than 600,000 customers. The FTC alleged, among other things, that Wyndham's failure to use encryption, firewalls, and non-obvious passwords constituted an "unfair" practice under Section 5 of the FTC Act. The district court denied Wyndham's motion to dismiss the FTC's case, but allowed Wyndham to pursue an interlocutory appeal. A unanimous Third Circuit panel affirmed the district court's ruling in an opinion the FTC touted as a "must read for business executives and attorneys."[2]