Developments in Data Security Breach Liability

• Published in: The Business Lawyer 2014-12, Vol.70 (1), p.231-245
• Main Author: Silverman, David L.
• Format: Article
• Language: English
• Subjects: Bank credit cards; Bank fraud; Bank liabilities; Banking services; Case dismissal; Causality; Class action lawsuits; Commercial law; Cybercrime; Data integrity; Data security; Laws, regulations and rules; Losses; Misrepresentation; Motions to dismiss; Negligence; Plaintiffs; Point of sale; Privacy; Punitive damages; Security management; State court decisions; Survey—Cyberspace Law; Tort liability
• ISSN: 0007-6899; 2164-1838

In 2013-2014, databases on, and communications across, the Internet again proved less than perfectly secure. According to one industry study, in 2013, there were over 63,000 data security incidents reported worldwide, with at least 1,367 resulting in the confirmed loss of data. There was no shortage of well-known brands suffering high-profile breaches. On the legal front in the US, 2013 and the first part of 2014 produced some progress for the plaintiffs' privacy bar and some new lessons for business lawyers. In the Sony, Linked-In, and Zappos.com cases, class action claims following payment card data security breaches survived motions to dismiss, where plaintiffs alleged misrepresentation based on limited promises about data security set forth in privacy policies or terms of service. Courts are split on the issue of whether the kind of increased risk of future harm experienced by typical data security breach victims is sufficiently concrete to confer standing in federal courts.