## Facts

- Wyndham Worldwide Corporation and affiliated entities licensed the Wyndham brand to many independently owned hotels and operated a network that processed guest personal and payment-card data.
- Between 2008 and 2009, Wyndham’s network and Wyndham-branded hotel networks were hacked three times, allegedly exposing unencrypted payment-card information for over 600,000 accounts and causing about $10.6 million in fraud losses.
- The FTC alleged Wyndham’s data-security practices were unreasonable, including permitting storage of payment-card data in readable text, use of weak passwords, inadequate firewalls and network controls, insufficient vendor/property access controls, and deficient incident-response practices that allowed repeated intrusions.
- The FTC also alleged Wyndham’s privacy policy misrepresented its security practices, rendering its statements materially misleading.

## Issues

1. Whether the FTC has authority under FTC Act § 5(a) to challenge deficient cybersecurity as an “unfair” act or practice.
2. Whether due process/fair-notice principles bar an FTC unfairness action absent cybersecurity-specific FTC regulations.
3. Whether the FTC plausibly pleaded unfairness under § 5(n) and deception based on alleged security representations.

## Decision

- The district court denied Wyndham’s Rule 12(b)(6) motion to dismiss and certified the order for interlocutory appeal.
- The Third Circuit affirmed, holding the FTC has authority to regulate cybersecurity under the unfairness prong of § 5(a).
- The Third Circuit held Wyndham had fair notice that its specific practices could violate § 5’s unfairness standard, even without prior FTC cybersecurity rulemaking.
- The court allowed the FTC’s claims to proceed past the pleading stage; the matter later resolved by stipulated injunction and settlement.

## Legal Principles

- FTC Act § 5(a) “unfairness” authority extends to unreasonable data-security practices; the concept of “unfair” is flexible and not limited to historically common consumer-protection categories.
- Section 5(n) supplies the governing unfairness standard: substantial injury (or likely substantial injury) that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits.
- Due process does not require the FTC to issue technology-specific regulations before bringing an unfairness enforcement action; notice may be satisfied by statutory text and publicly available enforcement history and guidance.
- Inadequate cybersecurity can constitute actionable unfairness where it plausibly exposes consumers to substantial financial injury, including through practices such as storing sensitive data in plain text, weak access controls, and failure to use basic network protections.
- Deception under § 5 may be plausibly pleaded where a company’s privacy-policy statements about security are materially misleading in light of its actual practices.

## Conclusion

The Third Circuit held that the FTC may pursue Section 5 unfairness claims based on unreasonable cybersecurity practices and rejected Wyndham’s argument that the FTC must first issue cybersecurity-specific rules, concluding that Wyndham had adequate notice that the alleged practices could violate the statutory unfairness standard.


FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015)