Smart Business
(by Jayne Gest with Molly Meacham)
In early data breach and cybersecurity litigation, courts took the perspective that cybercriminals were bad-acting third parties and businesses should not be held responsible in negligence for economic losses. That’s changing, however.
“Courts, in general, are looking for ways to turn to companies that are the custodians of the data, versus the individuals who traditionally have borne the uncertain burden of potential future identity theft if their data is stolen,” says Molly Meacham, shareholder at Babst Calland.
Smart Business spoke with Meacham about data breach litigation trends.
What are examples of courts shifting their approaches to data breach litigation?
In Dittman v. UPMC, the Pennsylvania Supreme Court broke new ground, finding that companies have an affirmative duty of care to protect confidential personal data that they have collected. The court viewed the actions of cybercriminals as a foreseeable risk that’s not a shield from liability. The court also did not let UPMC point to the economic loss doctrine, which previously held that if the loss is only financial, it cannot be recovered under a negligence theory.
The Dittman decision drew nationwide attention, because litigants in other states will ask their courts to adopt or reject it.
In addition, courts are looking at data breach damages. Several federal judges rejected data breach class action settlements to demand a larger or simpler recovery for the individuals, including higher caps per plaintiff, larger pools of funds and/or easier hurdles toward getting those funds.
Courts have also pushed back against the threshold issue of whether plaintiffs have to show actual damages to participate in a class action, or whether the risk of future damage is sufficient. …

Justine M. Kasznica