Late last month, the U.S. Court of Appeals for the Third Circuit Court issued a much-awaited decision in Federal Trade Commission v. Wyndham Worldwide.1 The ultimate holding may not be very surprising, but the expansive extent to which the court sided with the FTC requires close attention.

Although the court addressed several issues in its opinion, they all basically boil down to one ultimate question: How does §5 of the FTC Act of 1914, codified as 15 U.S.C. §45, grant the agency authority to regulate data security in a variety of industry and business endeavors?