Less than a month after an administrative judge ruled against the Federal Trade Commission (FTC) in a case against LabMD, the commission reached a settlement with Wyndham Worldwide that had challenged its authority to pursue enforcement action against companies regarding security.
The stipulations in the proposed agreement require Wyndham to institute annual security audits of its information security program that will certify the untrusted status of the networks of its fanchisees; ensure compliance with a formal risk assessment process and certify the independent and qualifications of the auditor, the Commission stressed in a release. The terms of the settlement are to remain in place for 20 years.
The commission filed a lawsuit against Wyndham in 2012, accusing the hotel chain of serious security shortcomings after a trio of data breaches exposed payment card information of hundreds of thousands of its customers.
Wyndham and LabMD had challenged the FTC's authority to investigate and take action against their companies for their security practices. The protracted LabMD case appeared to have come to a conclusion in November when an FTC Chief Administrative Law Judge Michael Chappell ruled that the FTC “failed to carry its burden of proving its theory that Respondent's alleged failure to employ reasonable data security constitutes an unfair trade practice because Complaint Counsel has failed to prove the first prong of the three-part test – that this alleged unreasonable conduct caused or is likely to cause substantial injury to consumers.” But that's a ruling that the agency intends to appeal, according to court documents filed shortly before Thanksgiving.
Chappell's decision in LabMD was seen as potentially reshaping future FTC enforcement authority, possibly clipping its wings. But the settlement with Wyndham is seen as having the opposite effect, cementing the commission's authority, according to FTC Chairwoman Edith Ramirez, who said of the agreement in a release, “Not only will it provide important protection to consumers, but the court rulings in the case have affirmed the vital role the FTC plays in this important area.”