Federal Trade Commission settles with Wyndham Worldwide over security breaches

December 10, 2015 |

I posted August 2015 (found here) on the significant win by the Federal Trade Commission (“FTC”) in the Court of Appeal on its powers to enforce data security in Federal Trade Commission v Wyndham Worldwide Corporation & ors.  The result was a milestone for the FTC as it affirmed the FTC’s powers to take enforcement action relating to data security.

As a result of that development Wyndham has very recently settled with the FTC over 3 separate data breaches involving hundreds of thousands of its customers.

The settlement is stringent, being for 20 years, but not so onerous as to prevent Wyndham to continue operating. It is certainly more onerous than the anaemic enforceable undertakings the Australian Privacy Commissioner has entered into in the last year.  The contrast is stark.  The FTC has set very specific obligations which will last for 20 years.  The Privacy Commissioner opts for a very short term minimalist approach to dealing with data breaches.  It is little wonder that privacy compliance in Australia is so poor.

The terms are described in the media release as follows:

Wyndham Hotels and Resorts has agreed to settle FTC charges that the company’s security practices unfairly exposed the payment card information of hundreds of thousands of consumers to hackers in three separate data breaches.

Under the terms of the settlement, the company will establish a comprehensive information security program designed to protect cardholder data – including payment card numbers, names and expiration dates.  In addition, the company is required to conduct annual information security audits and maintain safeguards in connections to its franchisees’ servers.

“This settlement marks the end of a significant case in the FTC’s efforts to protect consumers from the harm caused by unreasonable data security,” said FTC Chairwoman Edith Ramirez. “Not only will it provide important protection to consumers, but the court rulings in the case have affirmed the vital role the FTC plays in this important area.”

The proposed stipulated federal court order requires Wyndham Hotels and Resorts to obtain annual security audits of its information security program that conform to the Payment Card Industry Data Security Standard for certification of a company’s security program.  In addition, the order requires Wyndham’s audit to:

  • certify the “untrusted” status of franchisee networks, to prevent future hackers from using the same method used in the company’s prior breaches;
  • certify the extent of compliance with a formal risk assessment process that will analyze the possible data security risks faced by the company; and
  • certify that the auditor is qualified, independent and free from conflicts of interest.

The order also requires that in the event Wyndham suffers another data breach affecting more than 10,000 payment card numbers, they must obtain an assessment of the breach and provide that assessment to the FTC within 10 days.

The order provides that if Wyndham successfully obtains the necessary compliance certifications, it will be deemed in compliance with the comprehensive information security program provision of the order. That provision is not effective, however, in the event that Wyndham in any way misleads or provides false information during the annual audit and assessment process.

Wyndham’s obligations under the settlement are in place for 20 years.

The settlement is set out here.

One Response to “Federal Trade Commission settles with Wyndham Worldwide over security breaches”

  1. Federal Trade Commission settles with Wyndham Worldwide over security breaches | Australian Law Blogs

    […] Federal Trade Commission settles with Wyndham Worldwide over security breaches […]

Leave a Reply