Appeals court upholds FTC's authority over data security.

• Position: INFO SECURITY

A U.S. appeals court has silenced any questions about whether the Federal Trade Commission (FTC) should have the authority to punish companies for security breaches.

The decision in FTC v. Wyndham Worldwide Corp. solidifying the FTC's data security authority stems from a series of hacks of Wyndham's computer systems in 2008 and 2009. The personal and financial data from more than 619,000 customers was stolen, resulting in more than $10.6 million in fraudulent charges.

The FTC filed suit in June 2012, alleging that Wyndham had engaged in "unfair and deceptive" cybersecurity practices since 2008 that "taken together, unreasonably and unnecessarily exposed consumers' personal data to unauthorized access and theft."

Wyndham challenged the FTC's authority to regulate data security issues under the "unfairness" prong of the FTC's consumer protection powers, and the Third Circuit answered with a resounding "yes." The ruling also gave the go-ahead on the lawsuit against Wyndham.

"While the FTC has been active in seeking to address data security issues, this is the first major ruling confirming that it has the authority to do so," Michael Hindelang, head of the data security/ privacy litigation and e-discovery/information management practice groups at Honigman Miller Schwartz and Cohn...