Wyndham stands up to the FTC.

• Position: EHR

Hotel operator Wyndham Worldwide Corp. is fighting back in a data breach lawsuit filed in June 2012 by the Federal Trade Commission (FTC) against the company and three of its subsidiaries.

The lawsuit alleges that Wyndham failed to implement reasonable information security measures and consequently experienced three major data breaches in two years. Hundreds of thousands of credit and debit cards were ultimately compromised, and there were fraud losses of more than $10.6 million.

[ILLUSTRATION OMITTED]

The FTC accused the hotel operator of unfair trade practices and of deceiving customers into thinking their cardholder data was adequately protected when it wasn't. Other companies facing similar charges have opted to settle with the FTC, accepting fines as high as $10 million (as in the case of ChoicePoint) and comprehensive bi-annual audits.

Wyndham has questioned the FTC's authority to sue companies on behalf of consumers for cyber-security breaches and lax or misleading data security policies. The U.S. Chamber of Commerce and several other organizations joined the battle by seeking permission to file for a dismissal, accusing the FTC of holding breached entities like Wyndham to unfair and arbitrary standards. ComputerWorld reported the groups also alleged that the FTC is forcing businesses into lengthy data breach settlements and imposing costly fines for violating security standards the agency hasn't formally promulgated.

A federal court judge in New Jersey agreed to allow the groups to file for the dismissal.

The Wyndham lawsuit is considered a landmark case because...