Federal Trade Commission v. Wyndham Worldwide Corporation et al

Filing 77

ORDER granting 23 Motion to Change Venue. The Clerk of the Court is instructed to transfer this case to the District Court for the District of New Jersey. The following motions are denied without prejudice to refiling in the transferee court: Mo tion to Dismiss Case by Wyndham Hotels and Resorts LLC (Doc. 32 ); Motion toDismiss Case by Wyndham Hotel Group LLC, Wyndham Hotel Management Incorporated,and Wyndham Worldwide Corporation (Doc. 33 ); Motion for Leave to File Brief AmicusCuriae of the International Franchise Association (Doc. 49 ); Motion for Leave to File BriefAmici Curiae by Chamber of Commerce of the United States (Doc. 57 ). Signed by Senior Judge Paul G Rosenblatt on 3/25/13. (LAD)

Download PDF
1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA 8 9 Federal Trade Commission, 10 Plaintiff, 11 v. 12 Wyndham Worldwide Corp., et al., 13 Defendants. ) ) ) ) ) ) ) ) ) CV 12-1365-PHX-PGR ORDER 14 On August 8, 2012, Defendants filed a motion to transfer this case, pursuant to 28 15 16 17 18 19 20 21 22 23 24 25 26 27 U.S.C. § 1404(a), to the United States District Court for the District of New Jersey or, in the alternative, to the United States District Court for the District of Columbia. (Doc. 23.) Plaintiff Federal Trade Commission (“FTC”) has filed a response opposing transfer (Doc. 30) and Defendants have filed a reply (Doc. 34). For the reasons that follow, the Court will grant the motion.1 I. Background. On July 26, 2012, the FTC filed a complaint against Defendants in the District of Arizona alleging violations of the FTC Act.2 (Doc. 1.) It filed an amended complaint on August 9, 2012. (Doc. 28.) 1 Defendants’ request for oral argument is denied because the issues have been fully briefed and oral argument will not aid the Court’s decision. See Fed.R.Civ.P. 78(b); Partridge v. Reich, 141 F.3d 920, 926 (9th Cir. 1998). 2 28 Defendants are Wyndham Worldwide Corporation; Wyndham Hotel Group, LLC; Wyndham Hotels and Resorts, LLC; and Wyndham Hotel Management, Inc. 1 The amended complaint alleges that “Defendants’ failure to maintain reasonable 2 security allowed intruders to obtain unauthorized access to the computer networks of 3 Wyndham Hotels and Resorts, LLC, and several hotels franchised and managed by 4 Defendants on three separate occasions in less than two years.” (Id., ¶ 2.) The incidents 5 occurred in 2008–2010. “In all three security breaches, hackers accessed sensitive consumer 6 data by compromising Defendants’ Phoenix, Arizona data center.” (Id.) According to the 7 amended complaint, much of Defendants’ corporate network “is located in the Phoenix data 8 center.” (Id., ¶ 16.) 9 Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits “unfair or deceptive acts or 10 practices in or affecting commerce.” The amended complaint alleges deception (Count I) and 11 unfairness (Count II) based on representations Defendants made in their advertising, 12 marketing, and sales materials that they used industry-standard security measures to protect 13 their guests’ personal information and their failure to implement “reasonable and appropriate 14 measures to protect personal information against unauthorized access.” (Doc. 28, ¶¶ 44–49.) 15 II. Legal Standard. 16 Twenty-eight U.S.C. § 1404(a) provides: “For the convenience of the parties and 17 witnesses, in the interest of justice, a district court may transfer any civil action to any other 18 district or division where it might have been brought.” The Court has discretion “to adjudicate 19 motions for transfer according to an ‘individualized, case-by-case consideration of 20 convenience and fairness.’” Jones v. GNC Franchising, Inc., 211 F.3d 495, 498 (9th Cir. 21 2000) (quoting Stewart Org. v. Ricoh Corp., 487 U.S. 22, 29 (1988)). This adjudication 22 requires the court to weigh several factors, including the convenience of the parties, the 23 relative financial burdens, the convenience of witnesses, the availability of compulsory 24 process to compel unwilling witness attendance, the availability of witnesses and their live 25 testimony at trial, the ease of access to sources of proof, relevant contacts with the chosen 26 forum, jurisdiction over the parties, the state most familiar with the governing law, and the 27 relevant public policy of the forum state. See Decker Coal Co. v. Commonwealth Edison Co., 28 -2- 1 805 F.2d 834, 843 (9th Cir. 1986); Jones, 211 F.3d at 498–99. 2 Defendants have the burden of demonstrating that transfer is appropriate, see Piper 3 Aircraft Co. v. Reyno, 454 U.S. 235, 255–256 (1981), and “must make a strong showing of 4 inconvenience to warrant upsetting the plaintiff’s choice of forum,” Decker, 805 F.2d at 843. 5 III. 6 Analysis. After carefully considering all of the relevant factors, the Court will grant Defendants’ 7 motion to transfer. 8 The parties do not dispute that this case could have been brought in New Jersey or 9 Washington, D.C. Defendants argue that transfer is appropriate because the parties are located 10 in New Jersey and Washington, most of the witnesses reside in or near New Jersey, and 11 Defendants’ “data-security program—which is the core conduct relevant in this case—was 12 principally devised, implemented, and managed in New Jersey.” (Doc. 34 at 2.) Defendants 13 also assert that the FTC never visited Arizona in the course of its investigation of the case. (Id. 14 at 3.) 15 The FTC argues that the operative facts of the case occurred in Phoenix and that a 16 number of key witnesses reside in Arizona. It also contends that its choice of venue is entitled 17 to deference. The Court finds Defendants’ arguments more persuasive. 18 1. FTC’s choice of forum 19 Courts give deference to a plaintiff’s choice of forum. See Decker Coal Co., 805 F.2d 20 at 843. However, the choice of forum is only entitled to minimal consideration when “the 21 operative facts have not occurred within the forum of original selection and that forum has no 22 particular interest in the parties or the subject matter.” Pacific Car & Foundry Co. v. Pence, 23 403 F.2d 949, 954 (9th Cir. 1968); see Fabus Corp. v. Asiana Express Corp., No. C-00-3172 24 PJH, 2001 WL 253185, at *1 (N.D.Cal. March 5, 2001); Control ESI, Inc. v. University of 25 Denver, No. CV-12-01639-PHX-DGC, 2012 WL 6608822, *2 (D.Ariz. Dec 18, 2012); 26 Reaves v. Cable One, Inc., No. CV–11–00469–PHX–JAT, 2011 WL 5331695, at *2 (D.Ariz. 27 Nov.7, 2011) (noting that choice of forum is given less deference when the plaintiff is not a 28 -3- 1 resident of the forum). The FTC’s choice of venue here is entitled to limited deference 2 because it does not “reside” in Arizona and the operative facts of the case did not occur in 3 Arizona. 4 Defendants maintain their principal places of business in Parsippany, New Jersey. 5 They contend that the operative facts of the case occurred there, at their corporate 6 headquarters, because that is where they “developed, implemented, and managed their data7 security practices” and where “the statements that form the basis for the Count I deception 8 claim were all written, authorized, and disseminated.” (Doc. 34 at 3–4; see Doc. 23, Ex. 1, ¶¶ 9 7, 10–12, 19, 21.) The FTC contends that the operative facts occurred in Arizona because 10 Defendants “operated a facility in Phoenix . . . that housed computer systems and networks” 11 that were “compromised and used as a conduit” during the cyber attacks. (Doc. 30 at 2.) 12 Phoenix is also “the location of the Wyndham hotel that was the likely first point of intrusion 13 in the first data breach.” (Id. at 5.) 14 The FTC’s claim of deception focuses on Defendants’ statements, disseminated on its 15 website, about the adequacy of their security measures. (Doc. 28, ¶¶ 21, 44–46). The 16 unfairness count alleges that Defendants “failed to employ reasonable and appropriate security 17 measures.” (Id., ¶ 47.) The amended complaint specifically alleges, among other “inadequate 18 security measures,” that Defendants “failed to use readily available security measures to limit 19 access between and among the Wyndham-branded hotels’ property management systems, the 20 Hotels and Resorts’ corporate network, and the Internet” and “failed to ensure the Wyndham21 branded hotels implemented adequate information security policies and procedures.” (Id., ¶ 22 24.) At issue, therefore, are marketing materials and data security practices that were 23 developed, implemented, and overseen in New Jersey by New Jersey employees. As discussed 24 next, these employees are also the key witnesses. 25 2. 26 “The convenience of witnesses is said to be the most important factor in passing on a Convenience of parties and witnesses 27 transfer motion.” Gomez v. Wells Fargo Bank, NA, No. CV-09-181-PHX-GMS, 2009 WL 28 -4- 1 1936790, at *2 (D.Ariz. July 2, 2009) (quoting Los Angeles Mem’l Coliseum Comm’n v. Nat’l 2 Football League, 89 F.R.D. 497, 501 (C.D.Cal. 1981). 3 Defendants have identified 11 witnesses, current and former employees, who reside 4 in or near Newark, New Jersey. These individuals will testify about data-security protections 5 in place prior to the first intrusion, Defendants’ responses to intrusions, and Defendants’ 6 current data-security practices. (See Doc. 23 at 8.) According to Defendants, “[e]ssentially 7 all the current employees who have knowledge of those issues work at defendants’ 8 headquarters in New Jersey.” (Id. at 8–9.) These witnesses include: 9 Tim Voss, the global head of Information Security at Wyndham Worldwide 10 Corporation (“WWC”), who “has overall responsibility for data-security efforts at WWC and 11 all of its subsidiaries.” Id. at 8. 12 Dan Kornick, the Chief Information Officer at Wyndham Hotel Group (“WHG”), who 13 “has responsibility for information technology at WHG, including integrating data security 14 requirements with information technology operations.” Id. 15 Bob Loewen, Chief Financial Officer at WHG, who has “knowledge of the 16 expenditures made to respond to the intrusions and to enhance data-security protections, as 17 well as knowledge regarding the monetary relief sought by the FTC.” Id. 18 Kirsten Hotchkiss, Senior Vice President, Employment Counsel at WWC and former 19 Corporate Compliance Officer at WWC, who “was involved in coordinating the response to 20 all three intrusions and in enhancing data-security protections after those intrusions.” Id. 21 Defendants have submitted a declaration from Ms. Hotchkiss in support of their motion 22 for transfer. (Doc. 23, Ex. 1.) She attests that the “vast majority” of individuals with 23 knowledge Defendants’ past and current data security practices “currently work at WWC’s, 24 WHG’s, WHR’s [Wyndham Hotels and Resorts], or WHM’s [Wyndham Hotel Management] 25 headquarters in Parsippany, New Jersey and live in New Jersey or within 100 miles of 26 Newark, New Jersey.” (Id., ¶ 15.) She further states that only one current and one former 27 employee—Mike Stevens and Jason Rowland, respectively—who have “significant 28 -5- 1 knowledge regarding the intrusions” reside in Arizona. (Id., ¶¶17, 18.) Stevens and Rowland, 2 however, both reported to senior employees who still reside in New Jersey. (Id.) Finally, Ms. 3 Hotchkiss attests that the website referenced in the amended complaint “is managed and 4 administered by employees located in New Jersey” and that the allegedly deceptive statements 5 quoted in the amended complaint “were written, authorized, and disseminated primarily by 6 employees working from WHR’s Parsippany, New Jersey headquarters.” (Id., ¶ 21.) 7 The list of past employees who worked for Defendants at the time of the intrusions and 8 who live in or near Newark includes the former Vice President of Information Security at 9 WWC; the former Vice President of Security & Compliance at WHG; the former Chief 10 Information Officer for WWC; the former Senior Vice President of Information Technology 11 & Systems Development and Chief Technology Officer at WHG; the former Director of IT 12 Security & Risk Management at WHG and Director of Global Security Compliance at WWC; 13 and the former Director of Global Information Security Management at WWC. Id. at 9. 14 The FTC has identified six witnesses who reside in Arizona. (Doc. 30 at 6–8.) These 15 include Stevens and Rowland, custodians of electronically stored information produced by 16 Defendants during discovery. (Id. at 6–7.) According to the FTC, Stevens and Rowland are 17 likely to have material testimony concerning Defendants’ information technology and security 18 practices at the time of the breaches. (Id.) The FTC also lists as Arizona witnesses the Director 19 of Sales and Marketing at the Phoenix Wyndham Hotel at the time of the security breaches; 20 the President of Phoenix Hotel Ventures, LLC, which owned the Phoenix Wyndham Hotel; 21 and two employees of Fishnet Securities, a firm that consulted with Defendants about the 22 breaches. (Id. at 7–8.) 23 “In determining the convenience of the witnesses, a court should consider not only the 24 number of witnesses located in the respective venues, but also the nature and quality of their 25 testimony.” Sloan v. Pfizer, Inc., No. C-08-1849-SBA, 2008 WL 4167083, at *5 (N.D.Cal. 26 September 8, 2008) (citing Waites v. First Energy Leasing Corp., 605 F.Supp. 219, 222 27 (N.D.Ill. 1985)). Here, both the number of witnesses and the “substance and importance of 28 -6- 1 the potential testimony,” FTC v. Mazzoni & Son, Inc., No. 106-CV-2385, 2006 WL 3716808, 2 at *3 (N.D.Ohio Dec. 14, 2006), strongly favor transfer to New Jersey. 3 As discussed above, the FTC alleges that Defendants engaged in deception by 4 representing, in their marketing information, that they had implemented reasonable and 5 appropriate security measures to protect their customers’ personal information. The FTC also 6 alleges that Defendants engaged in unfair practices because the security measures it 7 implemented were not reasonable and appropriate. With respect to both allegations, the 8 challenged conduct was overseen by Defendants’ current and former employees who reside 9 in or near New Jersey. See Gomez, 2009 WL 1936790, at *2 (granting transfer because 10 defendants’ “executive management and administrative employees, who are likely to be 11 extensively engaged in this litigation” were all located at their corporate headquarters in 12 Minnesota); see also Mazzoni, 2006 WL 3716808, at *3; FTC v. American Tax Relief, LLC, 13 No. 10-C-6123, 2009 WL 1936790, at *6 (N.D.Ill. July 20, 2011). 14 The Court agrees with Defendants that the potential testimony of the Arizona witnesses 15 is not as significant as that of the New Jersey witnesses. Stevens and Rowlands reported to 16 senior-level employees in New Jersey. The fact they are custodians of records produced 17 during the FTC investigation does not mean that they are key witnesses with respect to the 18 deception and unfairness counts against Defendants. 19 The FTC has identified as witnesses two other Wyndham employees residing in 20 Arizona—the Director of Sales and Marketing at the Phoenix hotel that was hacked during 21 the first attack and the president of the company that owned that hotel. According to the FTC, 22 the former “is likely to have material testimony about Wyndham’s role in providing 23 information technology and information security services to the Wyndham-branded hotels,” 24 while the latter “is likely to have material testimony about the facts surrounding the three 25 breaches and how they affected the Wyndham Phoenix Hotel.” (Doc. 30 at 7–8.) Again, this 26 potential testimony is unlikely to have the significance of the testimony offered by the New 27 Jersey employees who were responsible for developing and implementing Defendants’ data28 -7- 1 security practices. 2 Finally, the FTC identifies two Arizona employees of Fishnet Security, a consulting 3 firm retained by Defendants to examine the cyber attacks. Each would “testify to the results 4 of his forensic investigation and the nature of the remedial steps he advised.” (Doc. 30 at 8.) 5 However, because Defendants’ third-party New Jersey witnesses will also offer testimony 6 about their response to the attacks (see Doc. 34 at 8), the presence of FTC’s witnesses in 7 Arizona does not weigh in favor of venue in Arizona. 8 In sum, the convenience of the parties and witnesses strongly favors transfer to New 9 Jersey. 10 3. 11 For the reasons stated above, additional factors weigh in favor of transfer of venue. Additional factors 12 Ease of access to sources of proof, relative financial burden, and costs of litigation favor 13 transfer to New Jersey. “Generally, litigation costs are reduced when venue is located near 14 most of the witnesses expected to testify or give depositions.” Gomez, 2009 WL 1936790, at 15 *3 (quoting Italian Colors Restaurant v. Am. Express Co., No. C-03–3719 SI, 2003 WL 16 22682482, at *5 (N.D.Cal. Nov. 10, 2003)). 17 The remaining factors do not weigh in favor of either party. 18 IV. CONCLUSION 19 After considering all of the relevant factors, the Court finds that notwithstanding the 20 FTC’s choice of venue, the District of New Jersey is the most appropriate forum for the 21 convenience of the witnesses, parties, and the interests of justice. Accordingly, the Court 22 transfers this case to the District of New Jersey. 23 Accordingly, 24 IT IS ORDERED: 25 26 27 1. Defendants’ motion to transfer venue (Doc. 23) is granted. 2. The Clerk of the Court is instructed to transfer this case to the District Court for the District of New Jersey. 28 -8- 1 3. The following motions are denied without prejudice to refiling in the transferee 2 court: Motion to Dismiss Case by Wyndham Hotels and Resorts LLC (Doc. 32); Motion to 3 Dismiss Case by Wyndham Hotel Group LLC, Wyndham Hotel Management Incorporated, 4 and Wyndham Worldwide Corporation (Doc. 33); Motion for Leave to File Brief Amicus 5 Curiae of the International Franchise Association (Doc. 49); Motion for Leave to File Brief 6 Amici Curiae by Chamber of Commerce of the United States (Doc. 57). 7 DATED this 25th day of March, 2013. 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -9-

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?