Following the latest major security breach, this time aimed at Target Corp. in which data connected to approximately 40 million credit and debit card users was stolen, over a dozen lawsuits have been filed, including 3 class action lawsuits.\u00a0 The claims range from negligence in failing to protect customer data, to invasion of privacy, to failure to notify of the breach.\u00a0 And a number of states have breach notification laws requiring the attorney general be notified.\u00a0 This could also that governmental action will be taken possibly resulting in fines and penalties.<\/p>\n
Civil lawsuits are becoming more prevalent to enforce data privacy policies and data protection laws.\u00a0 Thus far, the biggest hurdle to overcome by plaintiffs, is proving damages.\u00a0 Courts have dismissed a number of these suits simply because the plaintiffs could not establish that the data breach caused the plaintiff injury.\u00a0 Plaintiff\u2019s schooled off previous cases are becoming more clever in carefully in establishing damages.<\/p>\n
One of the early cases, Burrows v. Purchasing Power, LLC, 12-cv-22800-UU (S.D. Fla. Oct. 18, 2012), filed claims for identify theft, negligence, invasion of privacy, and a violation of Florida\u2019s Deceptive and Unfair Trade Practices Act.\u00a0 The Plaintiffs, employee\u2019s of Winn-Dixie, alleged that Winn-Dixie failed to protect and secure their personal information from theft.\u00a0 An employee of a Winn-Dixie service provider, Purchasing Power, had obtained the Plaintiff\u2019s personal information and misused it. \u00a0The case was eventually settled, and the defendants were required to maintain rigorous security safeguards going forward. \u00a0In order to receive settlement proceeds the plaintiffs had to prove they were victims of fraud and the circumstances of any loss.<\/p>\n
In another case, there was no data breach, rather the plaintiffs alleged that their personal information was collected and sold to media outlets without their consent.\u00a0 The claims included violations of the Electronic Communications, the Computer Fraud and Abuse Act and the Stored Communications Act.\u00a0 This Seventh Circuit upheld certification of the class action, giving little weight to the defendant\u2019s argument that the plaintiffs would each have to establish damages.<\/p>\n
A Massachusetts law, the Song-Beverly Credit Card Act, prohibited retailers from collecting ZIP code information, thus preventing retailers from using ZIP code to find other personal information.\u00a0 The Massachusetts Supreme Judicial Court broadened the term \u201cpersonal information\u201d to include ZIP codes and allowed the plaintiffs to proceed without having to establish that their data was compromised.<\/p>\n
The number of cases involving claims of breach of data privacy or unauthorized use of information will undoubtedly continue to grow.\u00a0 Businesses must keep vigilante to ensure compliance data protection laws wherever customers are located. Take precautions to avoid inadvertent breaches and update data privacy policies at least bi-annually.<\/p>\n
Contact us if you need assistance maintaining an up-to-date data privacy policy.<\/p>\n","protected":false},"excerpt":{"rendered":"
Following the latest major security breach, this time aimed at Target Corp. in which data connected to approximately 40 million credit and debit card users was stolen, over a dozen lawsuits have been filed, including 3 class action lawsuits.\u00a0 The claims range from negligence in failing to protect customer data, to invasion of privacy, to … Continue reading You don’t need to be Target to get sued over data privacy violations<\/span>