FTC Authority to Police Cybersecurity: Third Circuit Court of Appeals Panel Holds That the Federal Trade Commission Has Authority to Regulate Cybersecurity Deficiencies as an Unfair Trade Practice

Sullivan & Cromwell LLP - August 26, 2015

On August 24, 2015, a Third Circuit Court of Appeals panel in Federal Trade Commission v. Wyndham Worldwide Corp et al., unanimously upheld an April 2014 district court ruling that the Federal Trade Commission (FTC) may bring enforcement actions against companies that do not adequately protect consumer information from cybersecurity breaches under the FTC’s authority to address unfair trade practices.  The panel rejected Wyndham’s claim that it did not have fair notice as to what cybersecurity practices would be deemed inadequate by the FTC.  The case solidifies the FTC’s authority as a key regulator of companies’ data security practices.