Fair Notice of Unfair Practices: Due Process in FTC Data Security Enforcement after Wyndham

Abstract

This Note examines the Third Circuit’s decision in FTC v. Wyndham Worldwide Corp., which is the first case to explicitly uphold the FTC’s authority to challenge corporate data security practices as unfair or deceptive. The Note considers whether, in light of constitutional due process requirements and the history of FTC data security enforcement efforts, the agency has provided companies with fair notice of the security standards they must meet. It concludes that the FTC’s past complaints and other guidance, but not consent orders, define particular unfair practices in a way that satisfies the fair notice requirement.