The US Court of Appeals has ruled that the FTC mandate to protect consumers against fraudulent, deceptive and unfair business practices extends to oversight of corporate cybersecurity efforts — and lapses. But security experts are split about whether the decision will help improve enterprise security.
“It is not only appropriate, but critical, that the FTC has the ability to take action on behalf of consumers when companies fail to take reasonable steps to secure sensitive consumer information,” said Federal Trade Commission Chairwoman Edith Ramirez in a statement.
Specifically, last week’s decision allowed the FTC to take action against Wyndham Hotels and Resorts for failing to reasonably protect consumers’ personal information between 2008 and 2010, when hackers broke in three times and stole more than 600,000 bank card numbers.
Together with another court decision this summer allowing class action lawsuits against breached companies, this ruling means that data breaches are about to get a lot more expensive.
Pressure for action
Clearly, given the fact that data breaches keep happening, and are getting more and more destructive, something needed to happen.
“Everyone wants to see more done,” said Eric Chiu, president and co-founder at Mountain View, Calif.-based HyTrust Inc., a cloud security automation company. “Allowing companies to police themselves hasn’t worked.”
According to Chiu, economic and financial motivations aren’t enough, companies haven’t been policing themselves, and consumers have been paying the price. The FTC’s involvement is good news for consumers, he said…
Read the full article at CIO Magazine.
