Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more
Standard view
Full view
of .
Look up keyword
Like this
0 of .
Results for:
No results containing your search query
P. 1
FTC v Wyndham Opinion Denying Motion to Dismiss

FTC v Wyndham Opinion Denying Motion to Dismiss

Ratings: (0)|Views: 37|Likes:
Published by Bennet Kelley
Decision upholding FTC authority on data security consent decree.
Decision upholding FTC authority on data security consent decree.

More info:

Published by: Bennet Kelley on Apr 09, 2014
Copyright:Traditional Copyright: All rights reserved


Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See more
See less





: FEDERAL TRADE COMMISSION, : : Plaintiff, : : Civil Action No. 13-1887 (ES) v. : : OPINION WYNDHAM WORLDWIDE : CORPORATION, et al., : : Defendants. : : S
The Federal Trade Commission (the “FTC”) brought this action under Section 5(a) of the Federal Trade Commission Act (the “FTC Act”), 15 U.S.C. § 45(a), against Wyndham Worldwide Corporation (“Wyndham Worldwide”), Wyndham Hotel Group, LLC (“Hotel Group”), Wyndham Hotels and Resorts, LLC (“Hotels and Resorts”), and Wyndham Hotel Management, Inc. (“Hotel Management”) (collectively, “Wyndham” or “Defendants”). The FTC alleges that Wyndham violated Section 5(a)’s prohibition of “acts or practices in or affecting commerce” that are “unfair” or “deceptive.” Specifically, the FTC alleges that Defendants violated both the deception and unfairness  prongs of Section 5(a) “in connection with Defendants’ failure to maintain reasonable and appropriate data security for consumers’ sensitive personal information.” (D.E. No. 28, First Amended Complaint for Injunctive and Other Equitable Relief (“Compl.”) ¶¶ 1, 44-49). Hotels and Resorts moves to dismiss the FTC’s complaint under Federal Rule of Civil Procedure
Case 2:13-cv-01887-ES-JAD Document 181 Filed 04/07/14 Page 1 of 42 PageID: 3753
12(b)(6). (D.E. No. 91-1, Motion to Dismiss by Defendant Wyndham Hotels & Resorts LLC (“HR’s Mov. Br.”) at 6).
 Its motion to dismiss raises the following three issues.
, Hotels and Resorts challenges the FTC’s authority to assert an unfairness claim in the data-security context. Citing recent data-security legislation and the FTC’s public statements, Hotels and Resorts likens this action to
FDA v. Brown & Williamson Tobacco Corp.
, 529 U.S. 120 (2000). It declares that, under
 Brown & Williamson
, the FTC does not have the authority to bring an unfairness claim involving data security. As explained below, however, the Court rejects this challenge to the FTC’s authority because the circumstances here differ from those in
 Brown & Williamson
, Hotels and Resorts asserts that the FTC must formally promulgate regulations  before bringing its unfairness claim. It contends that, without promulgating such regulations, the FTC violates fair notice principles. But precedent instructs that agencies like the FTC need not formally issue regulations. The Court, therefore, rejects Hotels and Resorts’ contention that the FTC must issue regulations before bringing its unfairness claim.
, Hotels and Resorts argues that the FTC’s allegations are pleaded insufficiently to support either an unfairness or deception claim. Hotels and Resorts asserts that the FTC fails to  plead certain elements of each of these claims and fails to otherwise satisfy federal pleading requirements. As detailed below for both the unfairness and deception claims, the Court disagrees. Having resolved each of these issues in favor of the FTC, the Court DENIES Hotels and Resorts’ motion to dismiss.
 Wyndham Worldwide, Hotel Group and Hotel Management separately move to dismiss the FTC’s complaint, (D.E. No. 92), which the Court will address in a separate opinion. On November 7, 2013, the Court heard oral argument on both motions to dismiss. (
 D.E. No. 139 (“11/7/13 Tr.”)).
Case 2:13-cv-01887-ES-JAD Document 181 Filed 04/07/14 Page 2 of 42 PageID: 3754
Wyndham Worldwide is in the hospitality business. (Compl. ¶ 7). “At all relevant times,” Wyndham Worldwide controlled the acts and practices of the following subsidiaries: Hotel Group, Hotels and Resorts, and Hotel Management. (
 ¶¶ 7-10). Through these three subsidiaries, Wyndham Worldwide “franchises and manages hotels and sells timeshares.” (
 ¶ 13). More specifically, “Hotel Group is a wholly-owned subsidiary of Wyndham Worldwide.” (
 ¶ 8). Both Hotels and Resorts and Hotel Management, in turn, are wholly-owned subsidiaries of Hotel Group. (
 ¶¶ 9, 10). Hotels and Resorts licensed the “Wyndham” name to approximately seventy-five independently-owned hotels under
 agreements. (
 ¶ 9). Similarly, Hotel Management licensed the “Wyndham” name to approximately fifteen independently-owned hotels under
 agreements. (
 ¶ 10). Under these agreements, Hotels and Resorts and Hotel Management require each Wyndham-branded hotel to purchase—and “configure to their specifications”—a designated computer system that, among other things, handles reservations and payment card transactions. (
 ¶ 15). This system, known as a “property management system,” stores consumers’ personal information, “including names, addresses, email addresses, telephone numbers, payment card account numbers, expiration dates, and security codes.” (
). The property management systems for
 Wyndham-branded hotels “are part of Hotels and Resorts’ computer network” and “are linked to its corporate network.” (
 16). Indeed, Hotels and Resorts’ computer network “includes its central reservation system” that “coordinates reservations across the Wyndham brand” and, using Hotels and Resorts’ website, “consumers
 The Court must
accept the FTC’s factual allegations as true for purposes of resolving Hotels and Resorts’ motion to dismiss.
See Ashcroft v. Iqbal
, 556 U.S. 662, 678 (2009);
see also Bistrian v. Levi
, 696 F.3d 352, 358 n.1 (3d Cir. 2012) (“As such, we set out facts as they appear in the Complaint and its exhibits.”).
Case 2:13-cv-01887-ES-JAD Document 181 Filed 04/07/14 Page 3 of 42 PageID: 3755

You're Reading a Free Preview

/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->