On April 7, 2014, US District Judge Esther Salas denied Wyndham’s motion to dismiss directly challenging the FTC’s authority to regulate cyber security practices. Wyndham’s motion asserted that Congress had not delegated such authority to the FTC under its Section 5 powers, and even if it did, the FTC failed to publish rules or regulations providing companies fair notice of the protections expected and “legal standards” to be enforced by the FTC.
ALSO READ: Shareholder Derivative Suit against Wyndham Worldwide Implicates D&O Coverage
At the time, Judge Salas unequivocally ruled in favor of the FTC’s authority. However, on June 23, 2014, the court granted Wyndham’s application and certified the matter for an immediate interlocutory appeal to the Third Circuit Court of Appeals.
The appeal involves two questions of law: (1) whether the FTC can bring an unfairness claim involving data security under Section 5 of the FTC Act and (2) whether the FTC must formally promulgate regulations before bringing its unfairness claim under Section 5 of the FTC Act.
Interlocutory appeals are rarely granted, are in the complete discretion of the trial court, and must meet certain requirements under 28 U.S.C. § 1292(b), including whether there is a substantial ground for difference of opinion on the matter. While Judge Salas’s denial of Wyndham’s motion to dismiss was certain as to the FTC’s Section 5 authority and the issue of fair notice, the order certifying the matter for interlocutory appeal, on the other hand, acknowledged Wyndham’s “statutory authority and fair-notice challenges confront this court with novel, complex statutory interpretation issues that give rise to a substantial ground for difference of opinion.”
The Court further acknowledged that it was dealing with an issue of first impression with “nationwide significance… which indisputably affects consumers and businesses in a climate where we collectively struggle to maintain privacy while enjoying the benefits of the digital age.”
As a result, the Third Circuit will be the first major appellate court to weigh in on the issue of whether the FTC has authority to regulate cyber security practices, and if so whether those regulations require specific legal standards and fair notice to those within the scope of FTC’s enforcement.
Stuart A. Panensky practices in Traub Lieberman Straus & Strewsberry’s Construction Defect, Professional Liability, Environmental, and Technology practice groups. He primarily defends architects and engineers from third party claims of professional negligence. Stu also represents contractors, subcontractors as well as owners/developers in all aspects of construction litigation. He also handles environmental litigation including CERCLA and Spill Act claims, cyber claims (including coverage issues), as well as complex litigation management and insurance coverage litigation. He also lectures on technology and the law, cyber claims and co-authored a chapter in Data Security and Privacy Law – Combating Cyberthreats.
