January 15, 2021

Volume XI, Number 15


January 15, 2021

Subscribe to Latest Legal News and Analysis

January 14, 2021

Subscribe to Latest Legal News and Analysis

January 13, 2021

Subscribe to Latest Legal News and Analysis

New FTC Standards for Data Security?

When the Federal Trade Commission, in conjunction with the White House, promulgated its Consumer Privacy Bill of Rights in February 2012, one of the more intriguing considerations was that the FTC appeared to be setting up a matrix by which a company’s voluntary decision to adopt that matrix could become the basis for an FTC enforcement action. Now, after several months, it should be back at the forefront of data security considerations for U.S. businesses.

Earlier this summer, the FTC used that matrix in authorizing a federal action against Wyndham Worldwide Corp. and three of its subsidiaries – a development that highlights a possible change in stance from FTC Commissioner J. Thomas Rosch and illustrates for businesses the importance of developing detailed data/privacy policies.

In its action, the FTC’s asserted claim is based entirely upon the alleged violation of the Wyndham group’s own internally generated and approved privacy/security policy. In particular, the FTC complaint alleges that the hotel group’s “privacy policy misrepresented the security measures that the company and its subsidiaries took to protect consumers’ personal information.” The agency charges that the hotel’s security practices as represented to the public were “unfair and deceptive” and thus violated the FTC Act.

Rosch voted with a unanimous majority of FTC Commissioners to authorize the federal action against Wyndham, but had dissented from the same portion of the FTC’s privacy report and recommendation, which accompanied the release of the Consumer Privacy Bill of Rights in February.

This apparent development at the FTC will bear continued observation across the United States business community, and, at the same time, presents an excellent opportunity for all companies handling sensitive data to conduct an immediate evaluation of their privacy/data security policies and practices to assure that their practices are in complete alignment with their policies. Specific issues of concern include:

> Enforcement and litigation risks and developments;

> Contingency breach response planning (including breach notification efforts to
affected persons and relevant governmental agencies);

> Incident response planning (including possible external forensic

> Global/cross-border notification obligations.

In this case, the key to the FTC’s charges appears to be that one security breach allegedly facilitated other later breaches. In particular, the FTC alleges that the hotel group first learned in September 2008 of a data breach to its system through one of its properties (which first occurred in April 2008). According to the FTC’s allegations, the security flaws exploited in that initial breach were not corrected, and, thus, allowed two subsequent breaches in March 2009 and late 2009.

Approximately 120,000 consumer payment card records were accessed in those two later breaches, according to the FTC’s allegations, and were used by various crime syndicates to make fraudulent purchases totaling approximately $10.6 million. These compromised records were in addition to the 500,000 consumer payment card records compromised in the first breach, according to the FTC.

This enforcement action highlights the importance of developing clear and detailed data/privacy policies that:

> Implement “best practices” for protecting private consumer data;

> Maintain compliance with those practices; and > Regularly update those practices to track ongoing
technical advances. Significantly, consumers are submitting their confidential data to companies in reliance on those companies’ stated practices and policies. The FTC is apparently now going to hold those companies to their public pronouncements in this sphere. Perhaps more importantly, it also demonstrates that, despite some early public misgivings from at least one Commissioner, the FTC now seems intent upon using this enforcement power in the federal courts to force compliance with these companies’ previously stated privacypolicies.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume II, Number 228



About this Author

Kenneth Dort, Drinker Biddle Law Firm, Intellectual Property and Data Security Attorney, Chicago

Kenneth K. Dort counsels clients on information technology and intellectual property law issues—specifically, software development and licensing, systems development and integration, data security and privacy, trade secret protection and patent/copyright/trademark licensing and protection. He is chair of the firm’s Technology Committee.

Ken is CIPP/US, CIPP/E and CIPP/C certified and advises clients throughout the United States, the European Union and Canada on their data security and privacy practices and compliance needs...