The preliminary ruling in FTC v. Wyndham is expected to come out very soon, and all sides are paying close attention since the case (which may take years to conclude) has the potential to take away the agency’s data security authority altogether. Washington Internet Daily took an in-depth look at the potential impacts of the case, heavily citing TF’s Berin Szoka and other experts:
Assaf [one of Wyndham’s lawyers] seemed resigned during oral argument to a discovery process: “The FTC will never ever worry about a motion to dismiss under their view. All they have to say is we alleged unreasonable security practices – let’s go forward with discovery. That is all they have to allege, no matter what the violation is.”
Which means Wyndham will likely get a chance to raise the issue of fair notice after discovery, Szoka said. But the company may have missed its best chance to press the point on FTC pleading standards in data security cases, he said. “The only argument that was easier for them to make now is that the pleadings aren’t adequate” because the case was still in its first stages, he said. Szoka thinks it was a missed opportunity. When bringing the case, the FTC alleged the data breach had resulted more than $10.6 million in fraud loss. That doesn’t necessarily imply direct consumer financial harm, Assaf argued. Banks and credit card companies, not consumers, bear those fees, he said during oral argument. The FTC had separately alleged “unreimbursed fraud charges,” or payments illegally charged to a consumer’s account, said Moriarty. “We are not saying $10.6 million in unreimbursed fraud charges, but we do allege separately that there were unreimbursed fraud charges.”
It wasn’t specific enough, Szoka said. The FTC hasn’t “satisfied what should be their standard of pleading” for alleging deceptive and unfair practices, he said. Fraud generally has a heightened pleading standard in court, he said. “You would think that would include deception,” but “the FTC thinks that should only apply to common law fraud,” Szoka said. “They claim it doesn’t apply to deception cases.” Wyndham failed to drive home this argument in oral argument, he said.
Read the full article, and check out our other work on the Wyndham case.