Franchise Hotel Payment Card Breach Register

PROBLEM: The FTC sued Wyndham Hotels in 2012 after three criminal network intrusions (2008–2010) compromised payment-card information at Wyndham-branded hotels and led to more than $10.6 million in fraudulent charges. The Third Circuit affirmed the FTC's authority to regulate data security under Section 5 of the FTC Act (799 F.3d 236, 24 August 2015), and on 11 December 2015 the court entered a consent order requiring Wyndham to maintain a comprehensive information-security programme for payment-card data, with annual PCI DSS assessments, for 20 years. Wyndham paid no monetary relief and did not admit liability.

SOLUTION: A Storage Copy Data Management register that records, per franchised hotel property, the payment-card data it collects, the security programme in place, the date and result of each annual PCI DSS assessment, any breach affecting more than 10,000 unique card numbers, and the franchisor's oversight actions, so that card-data risk is visible across the franchise network rather than only at corporate level.

EVIDENCE BASIS: DOCUMENTED — FTC v. Wyndham: three breaches 2008–2010, >$10.6 million in fraudulent charges; Third Circuit affirmed FTC authority 24 Aug 2015 (799 F.3d 236); consent order entered 11 Dec 2015 requiring a 20-year comprehensive information-security programme for payment-card data.