Mitigating Cybersecurity Litigation Risks: Polices, Procedures, Service Providers, Notification, Damages

Equifax, Home Depot, Capital One, Uber, Morgan Stanley, and Yahoo! are just a handful of data breach victims resulting in class action litigation and settlements in the hundreds of millions of dollars.

Counsel must prepare to address a security incident and know best practices to minimize the risk of class action lawsuits and other liability exposure. While technical preventative issues are often outside a legal department's purview, updating policies, procedures, and training can help alleviate data security risks.

Several states, most notably California, have instituted privacy laws that provide potential causes of action beyond common law torts. Companies should be aware of the cross-compliance aspects of these various laws. Counsel should work to ensure that contracts with service providers have clear timelines and notification requirements in the event of an incident. Agreements with service providers with access to data should address damages.

Companies must also review the issues with class certification. In 2021, the Supreme Court heard TransUnion L.L.C. v. Ramirez, which raised the bar for putative class members to establish standing under the Fair Credit Reporting Act (FCRA). Over 8,000 TransUnion customers brought a class action for violations of the FCRA, but SCOTUS found that only 1,853 plaintiffs, which had their credit reports distributed to third parties, had standing.

Listen as our authoritative panel discusses cybersecurity class actions and the best practices to mitigate claims risks and limit damages when classes are certified.