Cyber liability issues are omnipresent in today\u2019s business world. Target, Home Depot, Anthem and Ashley Madison represent just a few recent examples. On Monday, the Third Circuit United States Court of Appeals addressed this issue, making it clear that the Federal Trade Commission (FTC) may take action against organizations that have subpar IT protocols. Based on this ruling, an organization\u2019s potential exposure has multiplied.<\/p>\n
Many companies, large or small, are at risk for substantial private civil litigation as a result of a data breach. The FTC\u2019s authority provides for civil claims by the FTC \u2013 and substantial fines. In other words, the FTC just became the cyber police (at least in the Third Circuit).<\/p>\n
Of interest, is Wyndham Worldwide Corporation. On three occasions in 2008 and 2009, hackers successfully accessed Wyndham\u2019s computer systems. Personal and financial information for hundreds of thousands of consumers was stolen and more than $10.6 million in fraudulent charges resulted.<\/p>\n
Based on these data breaches, the FTC brought an enforcement action against Wyndham. Wyndham requested the trial court dismiss the case, arguing that the FTC had no authority to regulate cyber security. The trial court refused and Wyndham appealed. The Third Circuit also rejected Wyndham\u2019s arguments and used fairly strong language in doing so. It stated the FTC can sanction businesses for \u201cunfair or deceptive acts or practices\u201d that affect commerce. In its decision this week, the Court ruled unequivocally that the breach of Wyndham\u2019s systems is precisely the type of \u201cunfair or deceptive practice\u201d the FTC is charged with stopping. Based on this ruling, Wyndham now must face the merits of the FTC\u2019s lawsuit in a trial court.<\/p>\n
So, what does this mean for business owners and potential exposure for a cyber attack? It means that in addition to potential civil actions, including class action claims, an FTC enforcement action can be looming. The breadth and scope of an FTC enforcement action is, as one would expect, quite broad.<\/p>\n
As stated above, the FTC just became the cyber police. Business owners should make cyber security the highest of priorities.<\/p>\n