On February 20, the Third Circuit sent a letter to counsel in FTC v. Wyndham Worldwide Corp., identifying at least one topic that will be addressed in the upcoming oral argument regarding the parties’ dispute over whether the FTC has the authority to regulate companies’ data security practices: whether unreasonable cybersecurity practices are “unfair.” The letter requested that counsel be prepared to address the issue by answering three questions. First, whether the FTC has declared that unreasonably security practices are “unfair” through procedures provided in the FTA Act. Second, if not, whether the FTC is requesting that the federal courts determine that unreasonable cybersecurity practices are “unfair” in the first instance. And finally, whether federal courts have the authority to determine that unreasonable cybersecurity practices are “unfair” in the first instance under a case brought under 15 U.S.C. § 53(b) (providing authority for the Commission to bring suit to enjoin a person or entity that the Commission has reason to believe is violating or is about to violate a provision of the FTC Act). The letter further indicated that the Third Circuit may also request additional briefing on these topics.
Recall that, in the District Court ruling that preceded the Third Circuit appeal, Judge Esther Salas said that the “untenable consequence” of Wyndham’s argument that the FTC provide notice as to which security practices are lawful, and which are “unfair” before bringing an enforcement action would force the FTC “to cease bringing all unfairness actions without first proscribing particularized prohibitions—a result that is in direct contradiction with the flexibility necessarily inherent in Section 5 of the FTC Act.” But the Third Circuit’s request indicates that the Third Circuit is at least considering whether to weigh in on the meaning of unfairness—particularly, whether unreasonable cybersecurity practices are unfair—something that has the potential to offer greater clarity for privacy and data security industries.
The Third Circuit’s interest in the meaning of “unfair” was shared by then-FTC Commissioner J. Thomas Rosch in his dissent from the count charging Wyndham with engaging in “unfair” practices in the initial vote authorizing staff to file the complaint. In his dissent, Rosch voiced reservations about what he viewed as an expansion of the Commission’s understanding of unfairness from instances where there is tangible harm to consumers to those where there are intangible injuries, such as unreasonable cybersecurity practices.