Document ID: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-azd-2_12-cv-01365/USCOURTS-azd-2_12-cv-01365-0/pdf.json

Parties Involved:
Chamber of Commerce of the United States
Amicus
Federal Trade Commission
Plaintiff
International Franchise Association
Amicus
Wyndham Hotel Group LLC
Defendant
Wyndham Hotel Management Incorporated
Defendant
Wyndham Hotels and Resorts LLC
Defendant
Wyndham Worldwide Corporation
Defendant

Document Text:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

 Defendants’ request for oral argument is denied because the issues have been fully

briefed and oral argument will not aid the Court’s decision. See Fed.R.Civ.P. 78(b);

Partridge v. Reich, 141 F.3d 920, 926 (9th Cir. 1998).

2

 Defendants are Wyndham Worldwide Corporation; Wyndham Hotel Group, LLC;

Wyndham Hotels and Resorts, LLC; and Wyndham Hotel Management, Inc.

WO

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF ARIZONA

Federal Trade Commission, 

Plaintiff, 

v.

Wyndham Worldwide Corp., et al.,

Defendants.

)

)

)

)

)

)

)

)

)

CV 12-1365-PHX-PGR

ORDER

On August 8, 2012, Defendants filed a motion to transfer this case, pursuant to 28

U.S.C. § 1404(a), to the United States District Court for the District of New Jersey or, in the

alternative, to the United States District Court for the District of Columbia. (Doc. 23.)

Plaintiff Federal Trade Commission (“FTC”) has filed a response opposing transfer (Doc.

30) and Defendants have filed a reply (Doc. 34). For the reasons that follow, the Court will

grant the motion.1

I. Background.

On July 26, 2012, the FTC filed a complaint against Defendants in the District of

Arizona alleging violations of the FTC Act.2

 (Doc. 1.) It filed an amended complaint on

August 9, 2012. (Doc. 28.) 

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 1 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 2 -

The amended complaint alleges that “Defendants’ failure to maintain reasonable

security allowed intruders to obtain unauthorized access to the computer networks of

Wyndham Hotels and Resorts, LLC, and several hotels franchised and managed by

Defendants on three separate occasions in less than two years.” (Id., ¶ 2.) The incidents

occurred in 2008–2010. “In all three security breaches, hackers accessed sensitive consumer

data by compromising Defendants’ Phoenix, Arizona data center.” (Id.) According to the

amended complaint, much of Defendants’ corporate network “is located in the Phoenix data

center.” (Id., ¶ 16.) 

Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits “unfair or deceptive acts or

practices in or affecting commerce.” The amended complaint alleges deception (Count I) and

unfairness (Count II) based on representations Defendants made in their advertising,

marketing, and sales materials that they used industry-standard security measures to protect

their guests’ personal information and their failure to implement “reasonable and appropriate

measures to protect personal information against unauthorized access.” (Doc. 28, ¶¶ 44–49.)

II. Legal Standard.

Twenty-eight U.S.C. § 1404(a) provides: “For the convenience of the parties and

witnesses, in the interest of justice, a district court may transfer any civil action to any other

district or division where it might have been brought.” The Court has discretion “to adjudicate

motions for transfer according to an ‘individualized, case-by-case consideration of

convenience and fairness.’” Jones v. GNC Franchising, Inc., 211 F.3d 495, 498 (9th Cir.

2000) (quoting Stewart Org. v. Ricoh Corp., 487 U.S. 22, 29 (1988)). This adjudication

requires the court to weigh several factors, including the convenience of the parties, the

relative financial burdens, the convenience of witnesses, the availability of compulsory

process to compel unwilling witness attendance, the availability of witnesses and their live

testimony at trial, the ease of access to sources of proof, relevant contacts with the chosen

forum, jurisdiction over the parties, the state most familiar with the governing law, and the

relevant public policy of the forum state. See Decker Coal Co. v. Commonwealth Edison Co.,

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 2 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 3 -

805 F.2d 834, 843 (9th Cir. 1986); Jones, 211 F.3d at 498–99.

Defendants have the burden of demonstrating that transfer is appropriate, see Piper

Aircraft Co. v. Reyno, 454 U.S. 235, 255–256 (1981), and “must make a strong showing of

inconvenience to warrant upsetting the plaintiff’s choice of forum,” Decker, 805 F.2d at 843.

III. Analysis.

After carefully considering all of the relevant factors, the Court will grant Defendants’

motion to transfer. 

The parties do not dispute that this case could have been brought in New Jersey or

Washington, D.C. Defendants argue that transfer is appropriate because the parties are located

in New Jersey and Washington, most of the witnesses reside in or near New Jersey, and

Defendants’ “data-security program—which is the core conduct relevant in this case—was

principally devised, implemented, and managed in New Jersey.” (Doc. 34 at 2.) Defendants

also assert that the FTC never visited Arizona in the course of its investigation of the case. (Id.

at 3.) 

The FTC argues that the operative facts of the case occurred in Phoenix and that a

number of key witnesses reside in Arizona. It also contends that its choice of venue is entitled

to deference. The Court finds Defendants’ arguments more persuasive.

1. FTC’s choice of forum

Courts give deference to a plaintiff’s choice of forum. See Decker Coal Co., 805 F.2d

at 843. However, the choice of forum is only entitled to minimal consideration when “the

operative facts have not occurred within the forum of original selection and that forum has no

particular interest in the parties or the subject matter.” Pacific Car & Foundry Co. v. Pence,

403 F.2d 949, 954 (9th Cir. 1968); see Fabus Corp. v. Asiana Express Corp., No. C-00-3172

PJH, 2001 WL 253185, at *1 (N.D.Cal. March 5, 2001); Control ESI, Inc. v. University of

Denver, No. CV-12-01639-PHX-DGC, 2012 WL 6608822, *2 (D.Ariz. Dec 18, 2012);

Reaves v. Cable One, Inc., No. CV–11–00469–PHX–JAT, 2011 WL 5331695, at *2 (D.Ariz.

Nov.7, 2011) (noting that choice of forum is given less deference when the plaintiff is not a

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 3 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 4 -

resident of the forum). The FTC’s choice of venue here is entitled to limited deference

because it does not “reside” in Arizona and the operative facts of the case did not occur in

Arizona.

Defendants maintain their principal places of business in Parsippany, New Jersey.

They contend that the operative facts of the case occurred there, at their corporate

headquarters, because that is where they “developed, implemented, and managed their datasecurity practices” and where “the statements that form the basis for the Count I deception

claim were all written, authorized, and disseminated.” (Doc. 34 at 3–4; see Doc. 23, Ex. 1, ¶¶

7, 10–12, 19, 21.) The FTC contends that the operative facts occurred in Arizona because

Defendants “operated a facility in Phoenix . . . that housed computer systems and networks”

that were “compromised and used as a conduit” during the cyber attacks. (Doc. 30 at 2.)

Phoenix is also “the location of the Wyndham hotel that was the likely first point of intrusion

in the first data breach.” (Id. at 5.)

The FTC’s claim of deception focuses on Defendants’ statements, disseminated on its

website, about the adequacy of their security measures. (Doc. 28, ¶¶ 21, 44–46). The

unfairness count alleges that Defendants “failed to employ reasonable and appropriate security

measures.” (Id., ¶ 47.) The amended complaint specifically alleges, among other “inadequate

security measures,” that Defendants “failed to use readily available security measures to limit

access between and among the Wyndham-branded hotels’ property management systems, the

Hotels and Resorts’ corporate network, and the Internet” and “failed to ensure the Wyndhambranded hotels implemented adequate information security policies and procedures.” (Id., ¶

24.) At issue, therefore, are marketing materials and data security practices that were

developed, implemented, and overseen in New Jersey by New Jersey employees. As discussed

next, these employees are also the key witnesses.

2. Convenience of parties and witnesses

“The convenience of witnesses is said to be the most important factor in passing on a

transfer motion.” Gomez v. Wells Fargo Bank, NA, No. CV-09-181-PHX-GMS, 2009 WL

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 4 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 5 -

1936790, at *2 (D.Ariz. July 2, 2009) (quoting Los Angeles Mem’l Coliseum Comm’n v. Nat’l

Football League, 89 F.R.D. 497, 501 (C.D.Cal. 1981).

Defendants have identified 11 witnesses, current and former employees, who reside

in or near Newark, New Jersey. These individuals will testify about data-security protections

in place prior to the first intrusion, Defendants’ responses to intrusions, and Defendants’

current data-security practices. (See Doc. 23 at 8.) According to Defendants, “[e]ssentially

all the current employees who have knowledge of those issues work at defendants’

headquarters in New Jersey.” (Id. at 8–9.) These witnesses include:

Tim Voss, the global head of Information Security at Wyndham Worldwide

Corporation (“WWC”), who “has overall responsibility for data-security efforts at WWC and

all of its subsidiaries.” Id. at 8.

Dan Kornick, the Chief Information Officer at Wyndham Hotel Group (“WHG”), who

“has responsibility for information technology at WHG, including integrating data security

requirements with information technology operations.” Id.

Bob Loewen, Chief Financial Officer at WHG, who has “knowledge of the

expenditures made to respond to the intrusions and to enhance data-security protections, as

well as knowledge regarding the monetary relief sought by the FTC.” Id.

Kirsten Hotchkiss, Senior Vice President, Employment Counsel at WWC and former

Corporate Compliance Officer at WWC, who “was involved in coordinating the response to

all three intrusions and in enhancing data-security protections after those intrusions.” Id.

Defendants have submitted a declaration from Ms. Hotchkiss in support of their motion

for transfer. (Doc. 23, Ex. 1.) She attests that the “vast majority” of individuals with

knowledge Defendants’ past and current data security practices “currently work at WWC’s,

WHG’s, WHR’s [Wyndham Hotels and Resorts], or WHM’s [Wyndham Hotel Management]

headquarters in Parsippany, New Jersey and live in New Jersey or within 100 miles of

Newark, New Jersey.” (Id., ¶ 15.) She further states that only one current and one former

employee—Mike Stevens and Jason Rowland, respectively—who have “significant

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 5 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 6 -

knowledge regarding the intrusions” reside in Arizona. (Id., ¶¶17, 18.) Stevens and Rowland,

however, both reported to senior employees who still reside in New Jersey. (Id.) Finally, Ms.

Hotchkiss attests that the website referenced in the amended complaint “is managed and

administered by employees located in New Jersey” and that the allegedly deceptive statements

quoted in the amended complaint “were written, authorized, and disseminated primarily by

employees working from WHR’s Parsippany, New Jersey headquarters.” (Id., ¶ 21.)

The list of past employees who worked for Defendants at the time of the intrusions and

who live in or near Newark includes the former Vice President of Information Security at

WWC; the former Vice President of Security & Compliance at WHG; the former Chief

Information Officer for WWC; the former Senior Vice President of Information Technology

& Systems Development and Chief Technology Officer at WHG; the former Director of IT

Security & Risk Management at WHG and Director of Global Security Compliance at WWC;

and the former Director of Global Information Security Management at WWC. Id. at 9.

The FTC has identified six witnesses who reside in Arizona. (Doc. 30 at 6–8.) These

include Stevens and Rowland, custodians of electronically stored information produced by

Defendants during discovery. (Id. at 6–7.) According to the FTC, Stevens and Rowland are

likely to have material testimony concerning Defendants’ information technology and security

practices at the time of the breaches. (Id.) The FTC also lists as Arizona witnesses the Director

of Sales and Marketing at the Phoenix Wyndham Hotel at the time of the security breaches;

the President of Phoenix Hotel Ventures, LLC, which owned the Phoenix Wyndham Hotel;

and two employees of Fishnet Securities, a firm that consulted with Defendants about the

breaches. (Id. at 7–8.)

“In determining the convenience of the witnesses, a court should consider not only the

number of witnesses located in the respective venues, but also the nature and quality of their

testimony.” Sloan v. Pfizer, Inc., No. C-08-1849-SBA, 2008 WL 4167083, at *5 (N.D.Cal.

September 8, 2008) (citing Waites v. First Energy Leasing Corp., 605 F.Supp. 219, 222

(N.D.Ill. 1985)). Here, both the number of witnesses and the “substance and importance of

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 6 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 7 -

the potential testimony,” FTC v. Mazzoni & Son, Inc., No. 106-CV-2385, 2006 WL 3716808,

at *3 (N.D.Ohio Dec. 14, 2006), strongly favor transfer to New Jersey.

As discussed above, the FTC alleges that Defendants engaged in deception by

representing, in their marketing information, that they had implemented reasonable and

appropriate security measures to protect their customers’ personal information. The FTC also

alleges that Defendants engaged in unfair practices because the security measures it

implemented were not reasonable and appropriate. With respect to both allegations, the

challenged conduct was overseen by Defendants’ current and former employees who reside

in or near New Jersey. See Gomez, 2009 WL 1936790, at *2 (granting transfer because

defendants’ “executive management and administrative employees, who are likely to be

extensively engaged in this litigation” were all located at their corporate headquarters in

Minnesota); see also Mazzoni, 2006 WL 3716808, at *3; FTC v. American Tax Relief, LLC,

No. 10-C-6123, 2009 WL 1936790, at *6 (N.D.Ill. July 20, 2011).

The Court agrees with Defendants that the potential testimony of the Arizona witnesses

is not as significant as that of the New Jersey witnesses. Stevens and Rowlands reported to

senior-level employees in New Jersey. The fact they are custodians of records produced

during the FTC investigation does not mean that they are key witnesses with respect to the

deception and unfairness counts against Defendants. 

The FTC has identified as witnesses two other Wyndham employees residing in

Arizona—the Director of Sales and Marketing at the Phoenix hotel that was hacked during

the first attack and the president of the company that owned that hotel. According to the FTC,

the former “is likely to have material testimony about Wyndham’s role in providing

information technology and information security services to the Wyndham-branded hotels,”

while the latter “is likely to have material testimony about the facts surrounding the three

breaches and how they affected the Wyndham Phoenix Hotel.” (Doc. 30 at 7–8.) Again, this

potential testimony is unlikely to have the significance of the testimony offered by the New

Jersey employees who were responsible for developing and implementing Defendants’ dataCase 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 7 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 8 -

security practices. 

Finally, the FTC identifies two Arizona employees of Fishnet Security, a consulting

firm retained by Defendants to examine the cyber attacks. Each would “testify to the results

of his forensic investigation and the nature of the remedial steps he advised.” (Doc. 30 at 8.)

However, because Defendants’ third-party New Jersey witnesses will also offer testimony

about their response to the attacks (see Doc. 34 at 8), the presence of FTC’s witnesses in

Arizona does not weigh in favor of venue in Arizona. 

In sum, the convenience of the parties and witnesses strongly favors transfer to New

Jersey. 

3. Additional factors

For the reasons stated above, additional factors weigh in favor of transfer of venue.

Ease of access to sources of proof, relative financial burden, and costs of litigation favor

transfer to New Jersey. “Generally, litigation costs are reduced when venue is located near

most of the witnesses expected to testify or give depositions.” Gomez, 2009 WL 1936790, at

*3 (quoting Italian Colors Restaurant v. Am. Express Co., No. C-03–3719 SI, 2003 WL

22682482, at *5 (N.D.Cal. Nov. 10, 2003)). 

The remaining factors do not weigh in favor of either party.

IV. CONCLUSION

After considering all of the relevant factors, the Court finds that notwithstanding the

FTC’s choice of venue, the District of New Jersey is the most appropriate forum for the

convenience of the witnesses, parties, and the interests of justice. Accordingly, the Court

transfers this case to the District of New Jersey.

Accordingly, 

IT IS ORDERED:

1. Defendants’ motion to transfer venue (Doc. 23) is granted.

2. The Clerk of the Court is instructed to transfer this case to the District Court

for the District of New Jersey.

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 8 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

- 9 -

3. The following motions are denied without prejudice to refiling in the transferee

court: Motion to Dismiss Case by Wyndham Hotels and Resorts LLC (Doc. 32); Motion to

Dismiss Case by Wyndham Hotel Group LLC, Wyndham Hotel Management Incorporated,

and Wyndham Worldwide Corporation (Doc. 33); Motion for Leave to File Brief Amicus

Curiae of the International Franchise Association (Doc. 49); Motion for Leave to File Brief

Amici Curiae by Chamber of Commerce of the United States (Doc. 57).

DATED this 25th day of March, 2013.

Case 2:12-cv-01365-PGR Document 77 Filed 03/25/13 Page 9 of 9