Defending Litigation After a Data Breach

Transcription

1 Defending Litigation After a Data Breach November 9, 2016 Stewart Baker Steptoe & Johnson LLP

2 Defending Litigation After a Data Breach Class Action Suits Commonly Filed By: Consumers Financial Institutions (Credit & Debit Card Issuers) Common Claims include: Common Law Negligence Negligent misrepresentation Breach of express or implied contract Invasion of privacy Unjust Enrichment Statutory State Breach Notification Unfair & Deceptive Trade Practices State Data Privacy Laws

3 Class Action Defense: Consumers Article III Standing Commonly Alleged Injury Actual harm (fraudulent charges, unauthorized withdrawals) Loss of value of personal information Loss of benefit of the bargain Increased risk of identity theft or fraud Mitigation costs (time & money) Standing Found? Most often Least often Emerging circuit split

4 Class Action Defense: Consumers Standing: Can Increased Risk Be Enough? Standard: Clapper v. Amnesty Int l USA, 133 S. Ct (2013): Actual harm suffered, or substantial risk that harm will occur The threat of future harm alone is too speculative, unless it is certainly impending No Actual Misuse = No Injury First Circuit: No allegations of third party access or use Katz. v. Pershing, 672 F.3d 64 (1 st Cir. 2012) Third Circuit: Alleged theft of data, but no allegations of misuse Reilly v. Ceridian, 664 F.3d 38 (3d Cir. 2011) Increased Risk = Sufficient Injury Seventh Circuit: Allegations of misuse, but not for named plaintiffs Remijas v. Neiman Marcus, 794 F.3d 688 (7 th Cir. 2015) Sixth Circuit: No allegations of misuse of any stolen data Galaria v. Nationwide, No (6 th Cir. Sept. 12, 2016)

5 Class Action Defense: Consumers Key Standing Considerations Nature of the Attack What type of information was stolen? Has there has been actual misuse? If no actual misuse, are there reasons to suspect future misuse? Whether stolen data was aim of or incidental to attack Whether there is evidence data was downloaded or taken How much time has passed since the data breach Company Statements After the Attack Courts have begun to point to statements in press releases after a breach as the defendant s acknowledgement of a real risk of harm Lewert v. P.F. Chang s, 819 F.3d 963 (7 th Cir. 2016) Galaria v. Nationwide, No (6 th Cir. Sept. 12, 2016)

6 Class Action Defense: Financial Institutions Understanding the Relationships Credit Card Company Issuing Bank (offers payment cards to consumers) Acquiring Bank (processes card payments) Consumers/ Customers Merchant (restaurants, retailors, etc.)

7 Class Action Defenses: Financial Institutions Failure to State a Claim No implied or express contract: No direct contractual relationship between merchant (who suffers the breach) and issuing banks (who replace cards and reimburse fraudulent charges) Negligence claims are often barred Economic loss doctrine precludes negligence claims where the only loss is economic, absent a special relationship Some courts have found it to block class actions by financial institutions because the alleged injury is purely economic

8 Class Action Defenses: Financial Institutions Key Issues to Consider - Role of the PCI-DSS Payment Card Industry Data Security Standards (PCI-DSS) Created by credit card companies, and agreed to by financial institutions and merchants Issuing banks have tried (mostly unsuccessfully) to use PCI-DSS to establish their contract and/or tort claims Recent Developments Shifting Liability To encourage implementation of chip-enabled card acceptance (EMV), credit card companies have instituted a liability shift Liability shifts to the party who used the lower level of security and compliance with the EMV standards Test Case? First Choice Credit Union v. The Wendy s Co., No. 2:16-cv (W.D. Pa. 2016)

9 Want More? The book The podcast Stewart Baker