The Federal Trade Commission (“FTC”) has been active in recent years pursuing companies that suffer data security breaches and arguably failed to live up to the data security standards promised in their privacy policies. There have been numerous settlements with companies that have resulted in payment of fines and agreements to take steps to remedy any data security lapses that may have occurred.

FTC enforcement actions in this regard are usually private until news of a settlement is announced. But in the case of Wyndham Hotel & Resorts a settlement did not occur and the FTC filed suit after hackers accessed customer credit card data on Wyndham systems. The FTC alleges that Wyndham failed to live up to its privacy policy and that this failure was a “deceptive” act under Section 5 of the FTC Act (15 U.S.C. § 45) which prohibits ‘‘unfair or deceptive acts or practices in or affecting commerce.’’