On August 24, 2015, the Third Circuit Court of Appeals issued a much-awaited decision in FTC v. Wyndham Worldwide Corporation, holding that the Federal Trade Commission (FTC) has authority to regulate “unfair” or “deceptive” cybersecurity practices under Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45(a). The decision may not only enhance the FTC’s authority going forward, it could also inspire other federal and state agencies acting under similar statutory language to forge ahead with enforcement of cybersecurity practices. We thus recommend that companies: (i) institute comprehensive cybersecurity governance programs; and (ii) utilize the National Institute of Standards and Technology’s Framework for Improving Critical Infrastructure Cybersecurity (“Framework”) or another comprehensive model to maintain practices that will be articulable and defensible in the ever-evolving legal landscape.

The FTC’s Authority to Regulate Cybersecurity -

The FTC is the federal agency charged with, among other things, protecting consumers from unfair and deceptive trade practices. The FTC’s enforcement authority is derived from over 70 different statutes, including the Federal Trade Commission Act. Section 5 of the Federal Trade Commission Act (“Section 5”) authorizes the FTC to bring actions—in both judicial and administrative forum—against entities engaging in “unfair or deceptive acts or practices in or affecting commerce.” More specifically, an act or practice is unlawful if it (i) is likely to cause substantial injury; (ii) is not outweighed by countervailing benefits to consumers and competition; and (iii) could not reasonably have been avoided by consumers.