A New Cyber Regulator on the Beat: The CFPB Issues its First Cybersecurity Order and Fine Additional Contacts: Irene C. Freidel irene.freidel@klgates.com +1.617.951.9154 Stephen G. Topetzes stephen.topetzes@klgates.com +1.202.778.9328 Anchorage Austin Fort Worth Frankfurt Orange County Beijing Berlin Harrisburg Palo Alto Paris Boston Hong Kong Perth Brisbane Houston Pittsburgh Brussels London Portland Charleston Los Angeles Raleigh Charlotte Melbourne Research Triangle Park Chicago Miami Dallas Milan San Francisco Doha Newark Dubai New York São Paulo Seattle Seoul Shanghai Singapore Sydney Taipei Tokyo Warsaw Washington, D.C. Wilmington K&L Gates comprises approximately 2,000 lawyers globally who practice in fully integrated offices located on five continents.

The firm represents leading multinational corporations, growth and middle-market companies, capital markets participants and entrepreneurs in every major industry group as well as public sector entities, educational institutions, philanthropic organizations and individuals. For more information about K&L Gates or its locations, practices and registrations, visit www.klgates.com. This publication is for informational purposes and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting a lawyer. © 2016 K&L Gates LLP.

All Rights Reserved. 1 Consent Order, In re Dwolla, Inc., File No. 2016-CFPB-0007 (Mar. 2, 2016). 12 U.S.C.

§ 5531(a). See Am. Compl., FTC v. Wyndham Worldwide Corp., No.

12-1365 (D. Ariz. Aug.

9, 2012). 4 15 U.S.C. § 45(a) (making unlawful “unfair or deceptive acts or practices in or affecting commerce”). 5 See FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir.

2015). 6 Some of these allegations as to insufficient data security measures are similar to those described in other regulator cybersecurity actions. See, e.g., Complaint at ¶ 21, In re Credit Karma, Inc., Dkt. No. C-4480 (FTC Aug.

13, 2014). 2 3 3 .