HOT TOPICS IN U.S. PRIVACY AND SECURITY LITIGATION

Transcription

1 HOT TOPICS IN U.S. PRIVACY AND SECURITY LITIGATION Alan Charles Raul Sidley Austin LLP 1501 K Street, N.W. Washington, DC araul@sidley.com Matthew H. Meade Buchanan Ingersoll & Rooney PC 301 Grant Street Pittsburgh, PA T: matthew.meade@bipc.com 1

2 OVERVIEW Privacy Litigation Data Security Litigation Government Access Litigation State Court Decisions Actions by and against Banks Shareholder Derivative Cases What s Next 2

3 PRIVACY LITIGATION In re Yahoo Mail Litigation, Case No. 13-CV (N.D. Cal. May 26, 2015) (Koh). Yahoo scans and analyzes of non-yahoo Mail subscribers who send and receive to and from Yahoo Mail subscribers. Non-Yahoo Mail subscribers sued, seeking class certification for their Stored Communications Act and California Invasion of Privacy Act claims. Yahoo scans to create targeted advertising for its users, and shares specific objects from a message with third parties. Yahoo users have consented; but not non-subscribers. Only SCA improper disclosure and CIPA claims survived prior MTD. (CIPA requires all-party consent for interception.) District court held that all factors of class certification analysis were met. Plaintiffs only seeking injunctive relief, and certification of injunctive relief class would not necessarily preclude Plaintiffs from later pursuing monetary damages claims. SCA. The class certified is a nationwide class of all people in the U.S. who are not Yahoo Mail subscribers and who have sent s or received s from a Yahoo Mail subscriber from October 2, 2011 to the present, or who will do so in the future. CIPA. The class certified is a California-only class. Court rejected as overly narrow in the consumer protection context the standing argument ( presumptive knowledge ) that Plaintiffs could not be injured by Yahoo s conduct because they continued to send and receive from Yahoo subscribers even after the filing of the Complaint. Likelihood of future injury satisfied where consumer alleges intent to purchase/use again even after knowledge. 3

4 PRIVACY YAHOO (CONT D) Yahoo argued that questions of consent would overwhelm common questions of law and fact. But, for injunctive relief-only class (Rule 23(b)(2)), the commonality conditions are less rigorous than for class seeking damages. Plaintiffs here do not bear the burden of showing that a common question of law or fact predominates over individual questions. (Rule 23(b)(3)) The one common question was sufficient: whether Yahoo intercepts, scans and uses contents of s to and from non-yahoo subscribers. Court distinguished its own earlier Gmail scanning class certification decision where class sought damages and included both Gmail subscribers and nonsubscribers, and consent issue was supposedly more complicated. Court held that plaintiffs drafting around the Gmail decision to avoid claims that would preclude class certification is okay (i.e., not seeking damages). Subsequent claims for individual relief including damages would not be barred. Court also held that class ascertainability requirement does not apply in 23(b)(2) context.

5 PRIVACY LITIGATION Carlsen v. Gamestop, Inc., et al., Civ. No (D. Minn. June 4, 2015) (Frank). Plaintiff in this purported class action alleged that GameStop, a video game retailer, shared personally identifiable information with Facebook, allegedly in violation of its own privacy policy that it does not share personal information with anyone. Plaintiff would log in to GameStop s website, and through a Software Development Kit, would access his Facebook account or Facebook s like, share, or comment functions while on the GameStop website. Plaintiff paid to subscribe to the GameStop website, but the privacy policy governed paying and nonpaying users. The district court dismissed the complaint for lack of standing. Overpayment. The court held that Plaintiff did not pay anything specifically for the privacy policy. And it had no intrinsic monetary value because non-paying and paying subscribers were governed by the same policy. Cases have rejected argument that some indeterminate portion of purchase price went toward privacy measures ( too flimsy to support standing ). Would Not Have Shopped. The court held that Plaintiff failed to allege that he suffered actual damages or that he did not receive the full value of his purchase. Again, because non-paying users were governed by the same policy, Plaintiff could not allege that he would not have bought the subscription had he known about the privacy violation. 5

6 PRIVACY LITIGATION In re Nickelodeon Consumer Privacy Litigation, 2015 WL (D. N.J. Jan. 20, 2015) (Chesler). After registering with Nick.com, Viacom places a cookie onto minor Plaintiffs computers without their consent, creates a record of the minors gender and birthday, and shares the information gathered from the cookie with Google. Google also places its own cookie on minor Plaintiffs computer. District court dismissed VPPA, NJ Computer Related Offenses Act, and intrusion upon seclusion claims by minor Plaintiffs with prejudice. VPPA claim failed because personal identifying information collected from could not, by itself, link the identity of the minor Plaintiffs to video-watching preferences. CROA claim failed because minor Plaintiffs failed to allege property or business damage. No allegation that personal identifying information could be monetized by minor Plaintiffs and that Defendants blocked them from doing so. Intrusion upon seclusion claim failed because Defendants conduct was not highly offensive as a matter of law. 6

7 PRIVACY LITIGATION In re Hulu Privacy Litigation, 2014 WL (N.D. Cal. April 28, 2014) (Beeler). Hulu discloses Plaintiffs video viewing selections and personal identification information to third-party metrics companies and Facebook, violating VPPA. Hulu moved for summary judgment. The district court mostly agreed with Plaintiffs. The district court entered judgment in Hulu s favor on its disclosures to the metrics companies, concluding that these disclosures did not tie the identified person to video viewing preferences. But it refused to enter judgment on the disclosures to Facebook because Facebook had enough information with the disclosures to tie identifying information to what a plaintiff was watching. The court rejected Hulu s remaining contentions, ruling that there was enough evidence to suggest that Hulu knew the information it was disclosing had identifying capability, and that there was insufficient evidence to suggest that Hulu had a policy in place in which it sought a consumer s consent to disclose the information. 7

8 PRIVACY LITIGATION Perkins v. LinkedIn Corp., 53 F. Supp. 3d 1190 (N.D. Cal. 2014) (Koh). LinkedIn harvests addresses from the contact lists of accounts associated with LinkedIn members. It then sends invitations to join LinkedIn to those harvested addresses. The district court declined to dismiss the case for lack of standing. Use of a plaintiff s name for targeted marketing purposes has concrete value, and misappropriation of such information can therefore constitute an injury. The court dismissed the federal SCA and Wiretap Act claims. Plaintiffs had consented and authorized LinkedIn to use their information. The court declined to dismiss the right of publicity claim with respect to the continued invitations/ endorsement s, but concluded that the first invitation or endorsement was consented to by Plaintiffs and therefore had to be dismissed. The court dismissed the California Comprehensive Data Access and Fraud Act. Plaintiffs did not allege a harm arising out of LinkedIn s decision to harvest a user s contact list without asking for a password to access that list (the gmail account was open, allowing LinkedIn to get that information without need for the gmail account password). 8

9 LINKEDIN (CONT D) Standing because: Court finds that individuals' names have economic value where those names are used to endorse or advertise a product to the individuals' friends and contacts. This is so because an advertisement bearing the imprimatur of a trusted or familiar source, such as a friend or acquaintance, has concrete value in the marketplace. Here, Plaintiffs allege that their names were misappropriated by LinkedIn to create personalized endorsements. No cause of action because of consent: It is only if, after viewing the disclosure that Linkedin.com is seeking a user's Google Contacts from her Google account, the user indicates Allow that a user's contacts' addresses are imported from Google Contacts to LinkedIn. Importantly, this disclosure is presented immediately prior to the moment at which LinkedIn is alleged to have engaged in wrongful conduct. It was not, as is often the case, a disclosure buried in a Terms of Service or Privacy Policy that may never be viewed or if viewed at all on a wholly separate page disconnected from the processes that led to the alleged wrongful conduct. Even more significantly, perhaps, is the fact that alongside the disclosure is an express opt out opportunity in the form of the No thanks button. The opportunity to opt-out of the harvesting process that leads to the allegedly wrongful conduct while still utilizing LinkedIn further distinguishes this case from cases like Gmail, where users who sought to use Gmail could not opt out of the allegedly unlawful conduct. In light of the clarity of the disclosure, the proximity of the disclosure to the wrongful conduct, and the ability to opt out, the Court finds that the FAC, as pleaded, suggests that Plaintiffs have consented to or authorized the collection of addresses.

10 PRIVACY LITIGATION Opperman v. Path, 2014 WL (N.D. Cal. May 14, 2014) (Tigar). Plaintiffs sued App Developers for stealing and disseminating contact information stored on their idevices. They also sued Apple for inadequately securing the phones from the intrusion, and for making attendant misrepresentations. They asserted federal and state statutory claims and common law claims. Apple. The court rejected many of Apple s standing arguments, but agreed that because there was no loss in value, Plaintiffs did not have standing by virtue of injury to their property rights in their address books. The district court dismissed the misrepresentation and statutory claims against Apple, ruling that there was no allegation indicating that Plaintiffs relied on Apple s representations regarding whether apps could access a phone user s data. App Developers. The district court dismissed all but one of Plaintiffs common law claims against the App Developers on standing grounds. It rejected Plaintiffs argument that accessing their address books diminished their value. The district court denied the App Developers motion to dismiss the intrusion upon seclusion claim, ruling that the surreptitious retention of the plaintiffs private contact information was not consensual, was sufficiently offensive, and raised a damages issue regarding the plaintiffs anxiety, embarrassment, humiliation, and the like. For intrusion upon seclusion claim, court could not conclude as a matter of law that copying address books was not highly offensive. 10

11 PRIVACY LITIGATION In re Facebook Privacy Litigation, 575 F. App x 494 (9th Cir. May 8, 2014). Plaintiffs sued Facebook, alleging that (1) information disclosed by Facebook could be used to obtain personal information about the plaintiffs, and (2) dissemination of that information diminished its market value. For breach of contract and fraud claims, Ninth Circuit held that allegations that information disclosed by Facebook can be used to obtain personal information, and that dissemination of personal information and losing the sales value of that information was sufficient allegation of damages element of these claims; district court reversed. Plaintiffs failure to allege that they lost money or property as a result of Facebook s conduct barred them from pursuing their California unfair competition claim. Consumer Legal Remedies Act claim failed because Plaintiffs did not allege that they obtained anything from Facebook by purchase or consumer transaction. 11

12 PRIVACY LITIGATION Campbell v. Facebook, -- F. Supp. 3d -- (N.D. Cal. Dec. 23, 2014) (Hamilton). Facebook, through its messaging service, would scan Plaintiffs private messages to assess whether there was a link to a web page contained in the message; if so, Facebook counted the reference as a like, and it used that data to create user profiles to deliver targeted advertising. Plaintiffs alleged that Facebook s scans violated the Electronic Communications Privacy Act, California s Invasion of Privacy Act, and California s unfair competition law. The court dismissed the California Invasion of Privacy Act claim. Internet communications are not confidential within the meaning of that Act because such communications can easily be shared by, for instance, the recipient(s) of the communications. California unfair competition claim. Plaintiffs did not lose any money or property as a result of Facebook s conduct. Plaintiffs property interest in their personal information was insufficient to satisfy statutory standing. The federal claim survived. Facebook s scanning of messages was not in the ordinary course of [its] business. The district court rejected the suggestion that any activity that generates revenue for a company should be considered within the ordinary course of its business. Facebook argued it had users consent, but court said: Disclosure in data use/privacy policy that information about users could be used for data analysis was not specific enough for express consent to scanning for use in targeted advertising. Overall circumstances and features not specific enough regarding scanning of message content for use in targeted advertising for implied consent. 12

13 PRIVACY LITIGATION In re Google, Inc. Privacy Policy Litigation, 58 F. Supp. 3d 968 (N.D. Cal. 2014) (Grewal). Google collects information through its various products and uses that information to place advertisements tailored to each consumer. As of 2012, Google instituted a policy allowing it to commingle information gathered through those various channels. Plaintiffs sued Google for moving to this less-protective privacy policy without the user s consent, alleging breach of contract, federal and state statutory privacy claims Alleging unreasonable invasion of consumer privacy The court dismissed Plaintiffs claims that Google s less restrictive privacy policy would lead to increased risk of inadvertent disclosure, ruling that this was insufficient to confer Article III standing. The court dismissed the unfair competition law and intrusion upon seclusion claim because the disclosure of common, basic digital information to third parties is not a serious or egregious violation[] of social norms[.] Two claims survived: (1) a California unfair competition law claim premised on the allegation that Google held out its privacy policy for its application users knowing that they would falsely believe that their data would be accessed by a limited number of groups; and (2) a breach of contract claim that Google divulged information in violation of the contracts it had with specific application users. 13

14 GOOGLE PRIVACY LIT. (CONT D) The Ninth Circuit has recognized that the improper disclosure of personal information can give rise to standing based on the threat of future harm so long as that harm is credible, real, and immediate, and not merely conjectural or hypothetical. But establishing such a credible, real, and immediate harm is no small feat. For example, in Low v. LinkedIn, the court found no such harm, even where a digital service provider was alleged to have disclosed information to (un)authorized third-parties. Similarly, in Yunker v. Pandora, the court found insufficient harm to confer standing where the defendant, a music service provider, shared personal information without anonymizing it. Each of these courts concluded that the alleged risk of future harm posed by the defendant's conduct was too conjectural and hypothetical to fall within the scope of the Ninth Circuit's standard.

15 PRIVACY LITIGATION Robins v. Spokeo, Inc., 742 F.3d 409 (9th Cir. 2014) (Feb. 4, 2014) (O Scannlain). Spokeo operates a website that provides users with information about other individuals. Plaintiff sued Spokeo for violation of the Fair Credit Reporting Act for providing false information about him on Spokeo s website. Spokeo moved to dismiss this claim for lack of standing. The district court agreed. The Ninth Circuit reversed, holding that (1) a plaintiff can suffer a violation of a statutory right without suffering actual damages, (2) the plaintiff in this particular case suffered a concrete and particularized injury in his handling of his credit information, and (3) the statutory monetary damages sought could redress the FCRA violation. The Supreme Court granted cert on April 27, 2015, over the contrary view of the Solicitor General. Question Presented: Whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute. 15

16 PRIVACY LITIGATION Vidal-Hall v. Google, Inc., English Court of Appeal (March 2015). Google collects Safari users browser information, allegedly without their knowledge or consent. Four individuals who used Safari browsers sued for breach of privacy. Rejecting previous case law, the Court held that damages claimed may include distress even where there is no financial loss. The Court relied on EU legal authorities to override and displace limitations on recovery under the UK Data Protection Act. The Court rejected Google s argument that the allegations were not serious enough, nor the claimed damages significant enough, to warrant the Court s intervention. It held instead that the alleged tracking and collection of information involved potentially extremely private data such as confidential schedules and internet use, and said that [t]he case relates to the anxiety and distress this intrusion upon autonomy has caused. The Court of Appeal reasoned that the requirement for an individual to have suffered financial loss contradicted the aims of the corresponding EU Data Protection Directive which are to compensate individuals who have suffered distress as a result of a breach of their privacy rights. 16

17 DATA SECURITY LITIGATION Columbia Casualty Co. v. Cottage Health System, Civ. No (C.D. Cal. May 7, 2015) (Pregerson) Complaint Filed; no decision. Cottage Health System settled for $4.125 million a class action asserting California Confidentiality of Medical Information claims arising out of a data breach of its servers. Its insurer, Columbia, filed suit in May seeking a declaratory judgment that it is not obligated to provide Cottage with a defense or indemnification for any claims in connection with the data breach (including regulatory investigations), and seeks reimbursement. Columbia asserts that Cottage Health failed to maintain minimum data protections that it agreed to maintain in its coverage policy, and/or misrepresented its willingness to do so: 1. The data breach was caused as a result of File Transfer Protocol settings on Cottage s internet servers that permitted anonymous user access, thereby allowing electronic personal health information to become available to the public via Google s internet search engine ; 2. Cottage Health to replace factory default settings; and 3. Cottage Health failed to reassess its information security exposure and risk controls. 17

18 DATA SECURITY LITIGATION In re Zappos.com, Inc., 2015 WL (D. Nev. June 1, 2015) (Jones). Plaintiffs sued Zappos after hacking of 24 million consumers information. They alleged that Zappos insufficient protection resulted in (1) decreased value of their personal information, (2) an increased threat of future harm, and (3) expenditures related to mitigating the risk of future harm. Zappos moved to dismiss for lack of Article III standing. The court dismissed the case, permitting leave to amend in the event a plaintiff suffers an injury. Decreased value of personal information was inadequate because there were no facts explaining how Plaintiffs personal information lost value. Increased threat of future harm was speculative and not imminent. The court highlighted that the litigation had been ongoing for three years; in that period, not one plaintiff had been the subject of identity theft. With respect to costs to mitigate, the court held that the threat of future theft or fraud is not sufficiently imminent to confer standing compels the conclusion that incurring costs to mitigate that threat cannot serve as the basis for this action. 18

19 DATA SECURITY LITIGATION In re Target Corp. Customer Data Security Breach Litigation, -- F. Supp. 3d (D. Minn. 2014) (Dec. 2, 2014) (financial institution cases), -- F. Supp. 3d -- (Dec. 18, 2014) (customer cases) (Magnuson). A group of financial institutions and consumers filed suit against Target in the wake of Target s 2013 data breach involving the theft of card information for approximately 110 million customers. Financial Institutions. The court ruled that the allegations that Target disabled certain security features in its systems and failed to heed FireEye warnings indicating an intrusion were sufficient to sustain a negligence claim. Target could not claim that owing a duty of care to plaintiffs was an undue burden, the court reasoned, because the company had already assumed such duties in its agreements with Visa and MasterCard. Consumers. The court dismissed several claims on various grounds, but the unjust enrichment claim survived. That claim was premised on the allegation that the customers would not have shopped at Target had they known of the breach. Both cases suggest a duty to warn. 19

20 DATA SECURITY LITIGATION Remijas v. The Neiman Marcus Group LLC, 2014 WL (N.D. Ill. 2014) (Sept. 16, 2014) (Zagel). Currently pending before the 7th Circuit. Customer-Plaintiffs sued Neiman Marcus for negligence, breach of implied contract, unjust enrichment, unfair and deceptive business practices, invasion of privacy, and violation of state data breach laws, alleging that Neiman Marcus failed to adequately protect against a major data breach and failed to provide timely notice of the breach once it happened. Neiman Marcus conduct left them at an increased risk of identity theft, decreased the value of their private information, and cost them time and money in resolving fraudulent charges and implementing further protections against the risk of future identity theft. Neiman Marcus moved to dismiss the case for lack of standing. The district court agreed, concluding that: (1) the increased risk of future identity theft was not an injury under Article III because it did not constitute a certainly impending risk; (2) derivatively, the costs incurred from purchasing identity theft protections for future identity theft could not be an Article III injury; (3) the unauthorized credit card charges for which none of the plaintiffs were financially responsible did not qualify as concrete injuries; (4) the expensive quality of Neiman Marcus goods did not create a deficiency-invalue theory of standing (i.e., that the plaintiffs paid a premium in part for added protection is not an Article III injury); and (5) the plaintiffs loss of control and value of their private information was not sufficiently concrete to constitute an Article III injury. 20

21 DATA SECURITY LITIGATION Moyer v. Michaels Stores (N.D. Ill. 2014)(Bucklo). Followed Seventh Circuit decision in Pisciotta v. Old Natl. Bancorp (2007) holding that consumers facing increased risk of identity theft following data breach satisfy injury requirement even if they suffer no monetary loss. Distinguished Supreme Court standing decision in Clapper requiring injury to be certainly impending because: Involved national security and constitutional issues No evidence that relevant risk of harm had ever materialized in similar circumstances Dismissed Illinois breach of contract and consumer fraud claims because of lack of damages Elevated risk of ID theft not actual damage Purchase of credit card monitoring does not meet economic damage threshold.

22 DATA SECURITY LITIGATION In re Sony Gaming Networks and Customer Data Security Breach Litigation, 996 F. Supp. 2d 942 (S.D. Cal. 2014). Sony s video game online network was hacked in Plaintiffs in this class action alleged that the hackers stole the personal information of millions of Sony customers, and that Sony unduly delayed in notifying its customers of the intrusion and theft. The district court held that Plaintiffs had standing because they alleged a credible threat of impending harm due to the disclosure of their personal information following the data breach. Courts in Ninth Circuit routinely deny motions to dismiss where Article III standing is based on PII having been collected and wrongfully disclosed, as opposed to merely collected without consent. In Sony breach, plaintiffs alleged wrongful disclosure due to the data intrusion. Court found delay in notification caused no injury beyond the breach; but allowed plaintiffs to pursue injunctive relief for delayed notification. Court finds legal duty to safeguard consumer s confidential information, requiring reasonable security measures. No negligence or negligent misrepresentation cause of action for economic damages in states recognizing economic loss doctrine, without special relationship, physical damage, or other exception. 22

23 SONY GAMING LIT. (CONT D) Almost all of the claims were dismissed, except for the claims premised on Sony s (1) affirmative misrepresentation that it had implemented reasonable security and industry-standard encryption, and (2) untimely delay in disclosing the intrusion. Of the surviving state consumer protection law claims, the court dismissed plaintiffs claims for damages, leaving them only the possibility of equitable relief.

24 DATA SECURITY LITIGATION Palkon v. Holmes (Wyndham Litigation), 2015 WL (D.N.J. Oct. 20, 2014) (Chesler). Following the hack of Wyndham, shareholders brought derivative suit for Wyndham s failure to implement satisfactory safety measures and provide timely notice of the hack. Wyndham moved for dismissal. The district court granted the motion and dismissed the case. It held that the Board s decision not to bring a derivative suit was within its business judgment. It held that Wyndham s counsel was not conflicted in providing its opinion that the Board not pursue the derivative case merely because the law firm was involved in managing Wyndham s FTC investigation related to the data breach. It also held that Wyndham s investigation was sufficient to support its decision not to pursue a derivative action. The Board had 15+ meetings on the data breach prior to the demand letter. It was therefore sufficiently apprised of the facts and was capable of making a decision regarding a derivative action. 24

25 GOVERNMENT ACCESS LITIGATION Riley v. California, 134 S. Ct (2014) (Roberts, C.J.,) The Court held that police may not conduct a search of digital information on a cell phone seized from an arrested individual without a search warrant. The Court concluded that the search incident to arrest exception to the warrant requirement did not encompass a search of a person s cell phone. Although the data stored on a cell phone is distinguished from physical records by quantity alone, certain types of data are also qualitatively different. An Internet search and browsing history, for example, can be found on an Internet-enabled phone and could reveal an individual's private interests or concerns perhaps a search for certain symptoms of disease, coupled with frequent visits to WebMD. Data on a cell phone can also reveal where a person has been. Historic location information is a standard feature on many smart phones and can reconstruct someone's specific movements down to the minute, not only around town but also within a particular building. We cannot deny that our decision today will have an impact on the ability of law enforcement to combat crime. Cell phones have become important tools in facilitating coordination and communication among members of criminal enterprises, and can provide valuable incriminating information about dangerous criminals. Privacy comes at a cost. 25

26 GOVERNMENT ACCESS LITIGATION In re Warrant to Search a Certain Account, 15 F. Supp. 3d 466 (S.D.N.Y. 2014) (Francis). Microsoft moved to quash a search warrant commanding it to produce the contents of one of its customer s s stored on a server in Dublin, Ireland. Microsoft contended that U.S. courts are without authority to issue warrants for extraterritorial search and seizure. The court denied the motion, concluding that the Stored Communications Act requires an entity receiving a subpoena to comply and produce relevant information regardless of where that information is stored. Microsoft is appealing that decision. The Second Circuit will likely hear argument on September 9,

27 GOVERNMENT ACCESS LITIGATION Patriot Act Update The Second Circuit, in ACLU v. Clapper, held that the NSA s automated bulk collection of telephone call metadata was not authorized by the statutory text of Section 215 of the Patriot Act. On June 1, 2015, Section 215 expired. Congress subsequently reauthorized the lapsed provision, but in modified form: Within six months, the NSA will have to abandon the automatic bulk collection of metadata and instead move to a call log system that targets particular individuals for intelligence purposes. 27

28 GOVERNMENT ACCESS LITIGATION United States v. Davis, 2015 WL (11th Cir. May 5, 2015) (en banc) (Hull). Davis was convicted of several counts of robbery, conspiracy, and possession of a firearm during a crime of violence. He challenged the admission of location evidence based on stored cell site information obtained by the Government without a warrant. The district court denied the motion. A panel of the Eleventh Circuit (Sentelle, J.,) held that cell site location information is within the subscriber s reasonable expectation of privacy, and thus that gaining that such information without a warrant and/or without probable cause is a violation of the Fourth Amendment, but it ultimately affirmed the district court, concluding that the good faith exception saved the Government s conduct in this case. En banc, the Eleventh Circuit vacated the panel opinion and instead held that such information does not need to be gained with a warrant when it is obtained via court order pursuant to the Stored Communications Act. 28

29 STATE COURT DECISIONS 29

30 AVERY CENTER Patient sued Connecticut OB/GYN clinic because it released medical records to a third party in response to a subpoena in paternity suit by father Patient had issued specific instructions not to release records to father. Did not give notice to patient or seek to quash subpoena Connecticut Supreme Court held that HIPAA establishes standard of care and did not preempt private right of action for unauthorized release of medical records

31 WALGREENS Indiana Court upholds $1.44 million verdict involving love triangle of pharmacist, her husband and her husband s ex girlfriend Pharmacist accessed ex girl friend s prescription records and shared info with husband who used it in child support fight Weak discipline of pharmacist Actions of pharmacist e.g., looking up and printing out customer info, were within scope of employment Walgreens liable for HIPAA violation by employee

32 CHARLESTON AREA MEDICAL CENTER West Virginia Supreme Court reverses trial court ruling denying class cert to 3600 patients of Charleston Area Medical Center whose data was inadvertently posted on the Internet Data included name, contact information and SSN None of plaintiffs were aware of any actual or attempted ID theft, nor suffered any loss Primary damages arise from the alleged increased risk of future harm

33 CHARLESTON AREA MEDICAL CENTER Court agreed that risk of future harm did not convey standing Court ruled that patients had standing on breach of confidentiality and invasion of privacy claims because they had a legal interest in having their medical information kept confidential TAKEAWAY -Opens the door to class actions whenever there is a loss of patient data in WV

34 UPMC Class composed of 62,000 UPMC employees and an untold number of former employees, who had names, birth dates, SSNs, confidential tax information, addresses, salaries and bank account information stolen from UPMC s computer systems. Court dismissed class action suit over a data breach, ruling PA law does not recognize civil cause of action against companies for failing to keep confidential employee data secure. Plaintiffs contended that hospital was negligent for failing to implement and monitor an adequate security system, and for failing to properly detect data security breach

35 UPMC Court.rejected argument, and said that any duty of care for negligence action would need to be created by state General Assembly. The only legislation which PA had chosen to enact requires entities that suffer breach of their security systems to provide notification Legislature gives the Office of Attorney General exclusive authority to bring an action for violation of the notification requirement (i.e., no private actions are permitted). no recovery on negligence claim if harm was purely economic (i.e., no physical harm to person or property)

36 CASES INVOLVING BANKS

37 BANCORPSOUTH BANK 8 th Circuit affirms district court and found that customer bore risk of loss when employee fell for phishing attack which resulted in unauthorized transfer of $440,000 to Bank of Cypress Bank s security procedures were adequate because it complied with the FFIEC guidance Court rejected Choice Escrow s claim that a human needed to manually review each wire transaction. An informed customer assumed risk of compromise by refusing commercially reasonable security procedures such as dual control, which required two independent authorized users to separately approve a wire request.

38 BANK OF AMERICA Chelan County, Washington sued over 3 unauthorized payroll requests for Chelan County Public Hospital in an amount just over 1 million dollars According to allegations BOA employee called County Treasurer and asked whether transfer was authorized. County said no but transfer still went through Claims for violation of Washington state law for unauthorized transfer and breach of contract for failing to follow NACHA rules regarding transfers as set forth in the agreement between Chelan County and BOA

39 TARGET Consolidated class action over losses to payment cardissuing banks suffered as a result of the retailer's massive data breach, Court held that Target owed banks a duty to protect customer credit and debit card information from hackers. Rejected argument that that merchants can t be held liable to payment card issuers following data breaches. Banks have established a plausible claim that Target s failure to detect intrusion into its computer systems caused financial institutions harm.

40 TARGET Banks also preliminarily established that Target had a special relationship with financial institutions From that relationship flowed Target's duty to banks and credit unions to ensure that customer credit and debit card data was adequately protected, That duty is reflected in Minnesota s Plastic Card Security Act, which regulates corporate data security practices for businesses located in MN.

41 HOME DEPOT Community banks and credit unions, along with Credit Union National Association and 16 state credit union associations and leagues filed a consolidated class-action suit in May Home Depot failed to properly secure and monitor its payments network, and, as a result, exposed personal and financial information of 56 million U.S. consumers. The attackers later used the breached information to perpetrate fraud, and banking institutions are paying for that expense Now institutions are asking the court to compensate card issuers for losses and expenses linked to Home Depot's breach above and beyond what the card brands will pay.

42 HOME DEPOT The data breach was the inevitable result of Home Depot s longstanding approach to the security of its customer s confidential data, an approach characterized by neglect, incompetence, and an overarching desire to minimize costs. refused to upgrade critical security systems; Ignored experts warnings about the vulnerability of its computer network; placed ineffective leadership in key information technology positions; and disregarded applicable industry standards..

43 WYNDHAM - SHAREHOLDER DERIVATIVE Breach of fiduciary duty for failure to implement appropriate security measures even though defendants knew customers were vulnerable to attack Waste of corporate assets by failing to implement adequate internal controls to prevent breaches Unjust enrichment for compensation received while breaching fiduciary duties

44 WYNDHAM - SHAREHOLDER DERIVATIVE Court rejected bad faith and unreasonable investigation claim BOD discussed cyber-attacks at 14 meetings and GC gave presentation regarding data breaches or security at each meeting. Audit committee discussed issues during at least 16 meetings. FTC investigation helped to develop BOD s understanding Retained third-party technology firms to investigate each breach and recommend enhancements TAKEAWAY : BOD SHOULD REGULARLY DISCUSS CYBER ISSUES

45 WHAT S NEXT More data breach cases in state court and reliance on Federal standards like HIPAA to provide a basis for a claim and establish standard of care Increase in regulatory enforcement actions for failure to have adequate policies and procedures in place in connection with cybersecurity As government investigations continue expect an increase into the discoveries of companies that were aware of breaches and chose not to report them 45

46 WHAT S NEXT As government investigations continue expect an increase into the discoveries of companies that were aware of breaches and chose not to report them Privacy/security suits where plaintiff can show actual harm (not just risk of identity theft) E.g., issuing banks (Target and Home Depot), bank account owners (Choice Escrow and Chelan County) 46

47 WHAT S NEXT Consequences of Clapper? Significance of Spokeo? Business as usual? Impacts of privacy policy? Personal information as (valuable) property? Paying for privacy/security Economic loss doctrine debate? Highly offensive recovery? Ingenuity of injunctive relief? Rule of Riley? Price of privacy?

48 QUESTIONS? Matthew Meade Buchanan Ingersoll & Rooney PC Alan Charles Raul Sidley Austin LLP