Federal Trade Commission v. Wyndham Worldwide Corporation et al

Filing 77

ORDER granting 23 Motion to Change Venue. The Clerk of the Court is instructed to transfer this case to the District Court for the District of New Jersey. The following motions are denied without prejudice to refiling in the transferee court: Mo tion to Dismiss Case by Wyndham Hotels and Resorts LLC (Doc. 32 ); Motion toDismiss Case by Wyndham Hotel Group LLC, Wyndham Hotel Management Incorporated,and Wyndham Worldwide Corporation (Doc. 33 ); Motion for Leave to File Brief AmicusCuriae of the International Franchise Association (Doc. 49 ); Motion for Leave to File BriefAmici Curiae by Chamber of Commerce of the United States (Doc. 57 ). Signed by Senior Judge Paul G Rosenblatt on 3/25/13. (LAD)

1

WO

2
3
4
5
6

IN THE UNITED STATES DISTRICT COURT

7

FOR THE DISTRICT OF ARIZONA

8
9

Federal Trade Commission,

10

Plaintiff,

11

v.

12

Wyndham Worldwide Corp., et al.,

13

Defendants.

)
)
)
)
)
)
)
)
)

CV 12-1365-PHX-PGR
ORDER

14
On August 8, 2012, Defendants filed a motion to transfer this case, pursuant to 28

15
16
17
18
19
20
21
22
23
24
25
26
27

U.S.C. § 1404(a), to the United States District Court for the District of New Jersey or, in the
alternative, to the United States District Court for the District of Columbia. (Doc. 23.)
Plaintiff Federal Trade Commission (“FTC”) has filed a response opposing transfer (Doc.
30) and Defendants have filed a reply (Doc. 34). For the reasons that follow, the Court will
grant the motion.1
I.

Background.
On July 26, 2012, the FTC filed a complaint against Defendants in the District of

Arizona alleging violations of the FTC Act.2 (Doc. 1.) It filed an amended complaint on
August 9, 2012. (Doc. 28.)
1

Defendants’ request for oral argument is denied because the issues have been fully
briefed and oral argument will not aid the Court’s decision. See Fed.R.Civ.P. 78(b);
Partridge v. Reich, 141 F.3d 920, 926 (9th Cir. 1998).
2

28

Defendants are Wyndham Worldwide Corporation; Wyndham Hotel Group, LLC;
Wyndham Hotels and Resorts, LLC; and Wyndham Hotel Management, Inc.

1

The amended complaint alleges that “Defendants’ failure to maintain reasonable

2

security allowed intruders to obtain unauthorized access to the computer networks of

3

Wyndham Hotels and Resorts, LLC, and several hotels franchised and managed by

4

Defendants on three separate occasions in less than two years.” (Id., ¶ 2.) The incidents

5

occurred in 2008–2010. “In all three security breaches, hackers accessed sensitive consumer

6

data by compromising Defendants’ Phoenix, Arizona data center.” (Id.) According to the

7

amended complaint, much of Defendants’ corporate network “is located in the Phoenix data

8

center.” (Id., ¶ 16.)

9

Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits “unfair or deceptive acts or

10

practices in or affecting commerce.” The amended complaint alleges deception (Count I) and

11

unfairness (Count II) based on representations Defendants made in their advertising,

12

marketing, and sales materials that they used industry-standard security measures to protect

13

their guests’ personal information and their failure to implement “reasonable and appropriate

14

measures to protect personal information against unauthorized access.” (Doc. 28, ¶¶ 44–49.)

15 II.

Legal Standard.

16

Twenty-eight U.S.C. § 1404(a) provides: “For the convenience of the parties and

17 witnesses, in the interest of justice, a district court may transfer any civil action to any other
18 district or division where it might have been brought.” The Court has discretion “to adjudicate
19 motions for transfer according to an ‘individualized, case-by-case consideration of
20 convenience and fairness.’” Jones v. GNC Franchising, Inc., 211 F.3d 495, 498 (9th Cir.
21 2000) (quoting Stewart Org. v. Ricoh Corp., 487 U.S. 22, 29 (1988)). This adjudication
22 requires the court to weigh several factors, including the convenience of the parties, the
23 relative financial burdens, the convenience of witnesses, the availability of compulsory
24 process to compel unwilling witness attendance, the availability of witnesses and their live
25 testimony at trial, the ease of access to sources of proof, relevant contacts with the chosen
26 forum, jurisdiction over the parties, the state most familiar with the governing law, and the
27 relevant public policy of the forum state. See Decker Coal Co. v. Commonwealth Edison Co.,
28
-2-

1 805 F.2d 834, 843 (9th Cir. 1986); Jones, 211 F.3d at 498–99.
2

Defendants have the burden of demonstrating that transfer is appropriate, see Piper

3 Aircraft Co. v. Reyno, 454 U.S. 235, 255–256 (1981), and “must make a strong showing of
4 inconvenience to warrant upsetting the plaintiff’s choice of forum,” Decker, 805 F.2d at 843.
5 III.
6

Analysis.
After carefully considering all of the relevant factors, the Court will grant Defendants’

7 motion to transfer.
8
The parties do not dispute that this case could have been brought in New Jersey or
9 Washington, D.C. Defendants argue that transfer is appropriate because the parties are located
10 in New Jersey and Washington, most of the witnesses reside in or near New Jersey, and
11 Defendants’ “data-security program—which is the core conduct relevant in this case—was
12 principally devised, implemented, and managed in New Jersey.” (Doc. 34 at 2.) Defendants
13
also assert that the FTC never visited Arizona in the course of its investigation of the case. (Id.
14
at 3.)
15
The FTC argues that the operative facts of the case occurred in Phoenix and that a
16
number of key witnesses reside in Arizona. It also contends that its choice of venue is entitled
17
to deference. The Court finds Defendants’ arguments more persuasive.
18
1.
FTC’s choice of forum
19
Courts give deference to a plaintiff’s choice of forum. See Decker Coal Co., 805 F.2d
20
at 843. However, the choice of forum is only entitled to minimal consideration when “the
21
operative facts have not occurred within the forum of original selection and that forum has no
22
particular interest in the parties or the subject matter.” Pacific Car & Foundry Co. v. Pence,
23
403 F.2d 949, 954 (9th Cir. 1968); see Fabus Corp. v. Asiana Express Corp., No. C-00-3172
24
PJH, 2001 WL 253185, at *1 (N.D.Cal. March 5, 2001); Control ESI, Inc. v. University of
25
Denver, No. CV-12-01639-PHX-DGC, 2012 WL 6608822, *2 (D.Ariz. Dec 18, 2012);
26
Reaves v. Cable One, Inc., No. CV–11–00469–PHX–JAT, 2011 WL 5331695, at *2 (D.Ariz.
27
Nov.7, 2011) (noting that choice of forum is given less deference when the plaintiff is not a
28
-3-

1 resident of the forum). The FTC’s choice of venue here is entitled to limited deference
2 because it does not “reside” in Arizona and the operative facts of the case did not occur in
3 Arizona.
4

Defendants maintain their principal places of business in Parsippany, New Jersey.

5 They contend that the operative facts of the case occurred there, at their corporate
6 headquarters, because that is where they “developed, implemented, and managed their data7 security practices” and where “the statements that form the basis for the Count I deception
8 claim were all written, authorized, and disseminated.” (Doc. 34 at 3–4; see Doc. 23, Ex. 1, ¶¶
9 7, 10–12, 19, 21.) The FTC contends that the operative facts occurred in Arizona because
10 Defendants “operated a facility in Phoenix . . . that housed computer systems and networks”
11 that were “compromised and used as a conduit” during the cyber attacks. (Doc. 30 at 2.)
12 Phoenix is also “the location of the Wyndham hotel that was the likely first point of intrusion
13 in the first data breach.” (Id. at 5.)
14

The FTC’s claim of deception focuses on Defendants’ statements, disseminated on its

15 website, about the adequacy of their security measures. (Doc. 28, ¶¶ 21, 44–46). The
16 unfairness count alleges that Defendants “failed to employ reasonable and appropriate security
17 measures.” (Id., ¶ 47.) The amended complaint specifically alleges, among other “inadequate
18 security measures,” that Defendants “failed to use readily available security measures to limit
19 access between and among the Wyndham-branded hotels’ property management systems, the
20 Hotels and Resorts’ corporate network, and the Internet” and “failed to ensure the Wyndham21 branded hotels implemented adequate information security policies and procedures.” (Id., ¶
22 24.) At issue, therefore, are marketing materials and data security practices that were
23 developed, implemented, and overseen in New Jersey by New Jersey employees. As discussed
24 next, these employees are also the key witnesses.
25

2.

26

“The convenience of witnesses is said to be the most important factor in passing on a

Convenience of parties and witnesses

27 transfer motion.” Gomez v. Wells Fargo Bank, NA, No. CV-09-181-PHX-GMS, 2009 WL
28
-4-

1 1936790, at *2 (D.Ariz. July 2, 2009) (quoting Los Angeles Mem’l Coliseum Comm’n v. Nat’l
2 Football League, 89 F.R.D. 497, 501 (C.D.Cal. 1981).
3

Defendants have identified 11 witnesses, current and former employees, who reside

4 in or near Newark, New Jersey. These individuals will testify about data-security protections
5 in place prior to the first intrusion, Defendants’ responses to intrusions, and Defendants’
6 current data-security practices. (See Doc. 23 at 8.) According to Defendants, “[e]ssentially
7 all the current employees who have knowledge of those issues work at defendants’
8 headquarters in New Jersey.” (Id. at 8–9.) These witnesses include:
9

Tim Voss, the global head of Information Security at Wyndham Worldwide

10 Corporation (“WWC”), who “has overall responsibility for data-security efforts at WWC and
11 all of its subsidiaries.” Id. at 8.
12

Dan Kornick, the Chief Information Officer at Wyndham Hotel Group (“WHG”), who

13 “has responsibility for information technology at WHG, including integrating data security
14 requirements with information technology operations.” Id.
15

Bob Loewen, Chief Financial Officer at WHG, who has “knowledge of the

16 expenditures made to respond to the intrusions and to enhance data-security protections, as
17 well as knowledge regarding the monetary relief sought by the FTC.” Id.
18

Kirsten Hotchkiss, Senior Vice President, Employment Counsel at WWC and former

19 Corporate Compliance Officer at WWC, who “was involved in coordinating the response to
20 all three intrusions and in enhancing data-security protections after those intrusions.” Id.
21

Defendants have submitted a declaration from Ms. Hotchkiss in support of their motion

22 for transfer. (Doc. 23, Ex. 1.) She attests that the “vast majority” of individuals with
23 knowledge Defendants’ past and current data security practices “currently work at WWC’s,
24 WHG’s, WHR’s [Wyndham Hotels and Resorts], or WHM’s [Wyndham Hotel Management]
25 headquarters in Parsippany, New Jersey and live in New Jersey or within 100 miles of
26 Newark, New Jersey.” (Id., ¶ 15.) She further states that only one current and one former
27 employee—Mike Stevens and Jason Rowland, respectively—who have “significant
28

-5-

1 knowledge regarding the intrusions” reside in Arizona. (Id., ¶¶17, 18.) Stevens and Rowland,
2 however, both reported to senior employees who still reside in New Jersey. (Id.) Finally, Ms.
3 Hotchkiss attests that the website referenced in the amended complaint “is managed and
4 administered by employees located in New Jersey” and that the allegedly deceptive statements
5 quoted in the amended complaint “were written, authorized, and disseminated primarily by
6 employees working from WHR’s Parsippany, New Jersey headquarters.” (Id., ¶ 21.)
7

The list of past employees who worked for Defendants at the time of the intrusions and

8 who live in or near Newark includes the former Vice President of Information Security at
9 WWC; the former Vice President of Security & Compliance at WHG; the former Chief
10 Information Officer for WWC; the former Senior Vice President of Information Technology
11 & Systems Development and Chief Technology Officer at WHG; the former Director of IT
12 Security & Risk Management at WHG and Director of Global Security Compliance at WWC;
13 and the former Director of Global Information Security Management at WWC. Id. at 9.
14

The FTC has identified six witnesses who reside in Arizona. (Doc. 30 at 6–8.) These

15 include Stevens and Rowland, custodians of electronically stored information produced by
16 Defendants during discovery. (Id. at 6–7.) According to the FTC, Stevens and Rowland are
17 likely to have material testimony concerning Defendants’ information technology and security
18 practices at the time of the breaches. (Id.) The FTC also lists as Arizona witnesses the Director
19 of Sales and Marketing at the Phoenix Wyndham Hotel at the time of the security breaches;
20 the President of Phoenix Hotel Ventures, LLC, which owned the Phoenix Wyndham Hotel;
21 and two employees of Fishnet Securities, a firm that consulted with Defendants about the
22 breaches. (Id. at 7–8.)
23

“In determining the convenience of the witnesses, a court should consider not only the

24 number of witnesses located in the respective venues, but also the nature and quality of their
25 testimony.” Sloan v. Pfizer, Inc., No. C-08-1849-SBA, 2008 WL 4167083, at *5 (N.D.Cal.
26 September 8, 2008) (citing Waites v. First Energy Leasing Corp., 605 F.Supp. 219, 222
27 (N.D.Ill. 1985)). Here, both the number of witnesses and the “substance and importance of
28
-6-

1 the potential testimony,” FTC v. Mazzoni & Son, Inc., No. 106-CV-2385, 2006 WL 3716808,
2 at *3 (N.D.Ohio Dec. 14, 2006), strongly favor transfer to New Jersey.
3

As discussed above, the FTC alleges that Defendants engaged in deception by

4 representing, in their marketing information, that they had implemented reasonable and
5 appropriate security measures to protect their customers’ personal information. The FTC also
6 alleges that Defendants engaged in unfair practices because the security measures it
7 implemented were not reasonable and appropriate. With respect to both allegations, the
8 challenged conduct was overseen by Defendants’ current and former employees who reside
9 in or near New Jersey. See Gomez, 2009 WL 1936790, at *2 (granting transfer because
10 defendants’ “executive management and administrative employees, who are likely to be
11 extensively engaged in this litigation” were all located at their corporate headquarters in
12 Minnesota); see also Mazzoni, 2006 WL 3716808, at *3; FTC v. American Tax Relief, LLC,
13 No. 10-C-6123, 2009 WL 1936790, at *6 (N.D.Ill. July 20, 2011).
14

The Court agrees with Defendants that the potential testimony of the Arizona witnesses

15 is not as significant as that of the New Jersey witnesses. Stevens and Rowlands reported to
16 senior-level employees in New Jersey. The fact they are custodians of records produced
17 during the FTC investigation does not mean that they are key witnesses with respect to the
18 deception and unfairness counts against Defendants.
19

The FTC has identified as witnesses two other Wyndham employees residing in

20 Arizona—the Director of Sales and Marketing at the Phoenix hotel that was hacked during
21 the first attack and the president of the company that owned that hotel. According to the FTC,
22 the former “is likely to have material testimony about Wyndham’s role in providing
23 information technology and information security services to the Wyndham-branded hotels,”
24 while the latter “is likely to have material testimony about the facts surrounding the three
25 breaches and how they affected the Wyndham Phoenix Hotel.” (Doc. 30 at 7–8.) Again, this
26 potential testimony is unlikely to have the significance of the testimony offered by the New
27 Jersey employees who were responsible for developing and implementing Defendants’ data28
-7-

1 security practices.
2

Finally, the FTC identifies two Arizona employees of Fishnet Security, a consulting

3 firm retained by Defendants to examine the cyber attacks. Each would “testify to the results
4 of his forensic investigation and the nature of the remedial steps he advised.” (Doc. 30 at 8.)
5 However, because Defendants’ third-party New Jersey witnesses will also offer testimony
6 about their response to the attacks (see Doc. 34 at 8), the presence of FTC’s witnesses in
7 Arizona does not weigh in favor of venue in Arizona.
8

In sum, the convenience of the parties and witnesses strongly favors transfer to New

9 Jersey.
10

3.

11

For the reasons stated above, additional factors weigh in favor of transfer of venue.

Additional factors

12 Ease of access to sources of proof, relative financial burden, and costs of litigation favor
13 transfer to New Jersey. “Generally, litigation costs are reduced when venue is located near
14 most of the witnesses expected to testify or give depositions.” Gomez, 2009 WL 1936790, at
15 *3 (quoting Italian Colors Restaurant v. Am. Express Co., No. C-03–3719 SI, 2003 WL
16 22682482, at *5 (N.D.Cal. Nov. 10, 2003)).
17

The remaining factors do not weigh in favor of either party.

18 IV.

CONCLUSION

19

After considering all of the relevant factors, the Court finds that notwithstanding the

20 FTC’s choice of venue, the District of New Jersey is the most appropriate forum for the
21 convenience of the witnesses, parties, and the interests of justice. Accordingly, the Court
22 transfers this case to the District of New Jersey.
23

Accordingly,

24

IT IS ORDERED:

25
26
27

1.

Defendants’ motion to transfer venue (Doc. 23) is granted.

2.

The Clerk of the Court is instructed to transfer this case to the District Court

for the District of New Jersey.

28
-8-

1

3.

The following motions are denied without prejudice to refiling in the transferee

2 court: Motion to Dismiss Case by Wyndham Hotels and Resorts LLC (Doc. 32); Motion to
3 Dismiss Case by Wyndham Hotel Group LLC, Wyndham Hotel Management Incorporated,
4 and Wyndham Worldwide Corporation (Doc. 33); Motion for Leave to File Brief Amicus
5 Curiae of the International Franchise Association (Doc. 49); Motion for Leave to File Brief
6 Amici Curiae by Chamber of Commerce of the United States (Doc. 57).
7

DATED this 25th day of March, 2013.

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-9-