Do As You Say (And As You Should Do): How The Hospitality Industry Can Brace For Data Privacy Actions

On October 2, 2015, Trump International Hotels became the latest in a growing line of data breach class action victims. Driscoll v. Trump International Hotels Management LLC, No. 15-cv-1089 (S.D. Ill.). Indeed, the hospitality industry as a whole is seeing increased scrutiny from both plaintiffs' attorneys and federal regulators. Less than two months ago, the Third Circuit Court of Appeals affirmed the Federal Trade Commission's broad authority to clamp down on the allegedly lax cybersecurity measures implemented by Wyndham Worldwide. F.T.C. v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015)

The Trump and Wyndham cases highlight a growing trend for both federal regulators and plaintiffs' attorneys in the data privacy realm. That is, data privacy claims founded in large part on a defendant's own privacy policies and industry standards, using those very policies and standards against it.

Given the amount of consumer information the hospitality industry maintains—and how vast and sprawling a hospitality chain's own network can be—it is crucial going forward that hospitality companies consistently evaluate their own privacy policies and practices to ensure that they are in fact doing as they say.

Recent Data Privacy Litigation

The newly filed Trump class action stems from a data breach allegedly running from May 19, 2014 to June 2, 2015 in which hackers were able to access the Trump computer systems and obtain a variety of customer data, including payment card information. The foundation of the complaint—which alleges claims of unfair competition and common law claims of negligence, breach of contract and unjust enrichment—is Trump's alleged failure to abide by industry standard data security practices, including the Payment Card Industry Data Security Standard.

Similarly, the Wyndham FTC action was predicated on the alleged failure of Wyndham to adopt and abide by basic security precautions over a period of years in which it suffered three separate cyberattacks. The alleged failure to do so was made all the worse in light of the fact that Wyndham adopted and published a public-facing privacy policy touting its "industry standard" and other security measures. Following the three attacks, the FTC filed suit, alleging that Wyndham's lax...