Should Companies be Accountable for Leaked Customer Data?

Companies that don't do enough to protect customer data against hacking are more likely to be sued, thanks to a court ruling this week. A federal appeals court rejected an argument that the Federal Trade Commission (FTC) overstepped its powers by suing a company over three hacking incidents.

The company is question is the Wyndham Hotel chain, in which 619,000 customers' credit card data was leaked. According to the FTC, Wyndham failed to use suitably complex login details on accounts, stored card data on its servers in unencrypted form, and did not use adequate firewalls to protect the data. (Source: ftc.gov)

Misleading Promises Are The Legal Issue

The FTC believes it has the right to sue in such cases, though not for the security failings in themselves. Instead, it says that Wyndham's privacy policy, as detailed on its website, misrepresented the efforts it made to protect customer data. That's classed as deceptive marketing, which is one of the key things the FTC can crack down on under its terms of operation as a federal agency.

Wyndham challenged the FTC's right to bring the case on several grounds, all of which were rejected by the appeals court. One argument involved the precise definition of "unfair behavior," but the appeals court argued that telling customers their data is safe when that is not the case is inherently unfair.

Another Wyndham argument was that a company can't be acting "unfairly" if an incident is sparked by third-party criminals, something the court flat out rejected.

Banana Peel Ploy Slips Up

Finally, Wyndham argued that if the FTC can sue over inadequate cyber security, they should also "require every store in the land to post an armed guard at the door [and sue a supermarket if it is] sloppy about sweeping up banana peels." The court not only rejected this analogy, but also made a snide dig by stating that a supermarket that left so many banana peels lying around that 619,000 customers fell over would also probably find itself in legal bother. (Source: scribd.com)

The ruling will likely be cited as precedent in any future disputes over FTC lawsuits over inadequate security. However, it doesn't necessarily settle the issue of whether it's unlawful for companies to have sloppy customer security if they don't have any listed privacy policy and thus aren't specifically making any misleading claims.

What's Your Opinion?

Should companies have a legal responsibility to protect customer data from hacking? Do you think any of Wyndham's arguments were valid? Which is worse: not safeguarding customer data, or misleading customers about security measures?