## Facts

- Dave & Buster’s, Inc., operated restaurant/entertainment venues and processed consumer credit and debit card payments through in-store and corporate networks.
- The company collected sensitive payment-card data, including account numbers, expiration dates, and electronic security codes used for authorization.
- Between April 30, 2007 and August 28, 2007, an intruder repeatedly accessed the company’s networks without authorization, installed unauthorized software, and intercepted payment-card data transmitted to a third-party processor.
- The incident allegedly compromised approximately 130,000 payment cards and was associated with several hundred thousand dollars in claimed fraudulent charges by issuing banks.
- The FTC alleged that the company failed to provide reasonable and appropriate security, including by not adequately detecting intrusions, restricting third-party access, monitoring outbound traffic, and limiting lateral movement across networks through segmentation and access controls.
- The FTC also alleged the company made materially misleading statements that it used appropriate safeguards to protect consumers’ personal information.
- The matter was resolved through an FTC administrative settlement; the respondent did not admit liability.

## Issues

1. Whether inadequate protection of payment-card data, resulting in a breach and fraud losses, constitutes an unfair act or practice under § 5(a) of the FTC Act.
2. Whether representations that personal information was protected by appropriate safeguards were deceptive under § 5(a) when security practices allegedly did not match those claims.
3. What remedial measures the FTC may require through a consent order to address alleged data-security deficiencies.

## Decision

- The FTC issued an administrative complaint alleging unfair and deceptive acts or practices under § 5(a) of the FTC Act.
- The Commission accepted an agreement containing a consent order for public comment and later issued a final decision and order (June 8, 2010).
- The final order required the company to establish, implement, and maintain a written, comprehensive information-security program reasonably designed to protect the security, confidentiality, and integrity of personal information.
- The order required biennial independent third-party assessments of the information-security program for 10 years.
- The order imposed recordkeeping, reporting, and compliance-monitoring obligations and remained in effect for 20 years.

## Legal Principles

- Under § 5(a) of the FTC Act, deficient data-security practices may be treated as unfair when they cause or are likely to cause substantial injury, the injury is not reasonably avoidable by consumers, and it is not outweighed by countervailing benefits.
- Statements about using appropriate physical, electronic, and procedural safeguards can be deceptive if they are materially misleading in light of actual security practices.
- Reasonable and appropriate security is assessed through a risk-based approach that considers the sensitivity of the data, foreseeable threats, available safeguards, and the entity’s size and operations.
- FTC consent orders in data-security matters commonly require a written security program, ongoing risk assessment and testing, service-provider oversight, periodic independent assessments, and long-term compliance reporting.

## Conclusion

The FTC resolved allegations that Dave & Buster’s failed to implement reasonable payment-card data protections and misrepresented its safeguards by entering a consent order requiring a comprehensive security program, independent assessments, and extended compliance obligations under § 5 of the FTC Act.


In re Dave & Buster’s, Inc., FTC File No. 082 3153, Docket No. C-4291 (F.T.C. 2010)