TOPIC
Cite as: Derek A. Bishop, To Serve and Protect: Do Businesses Have a Legal Duty to Protect Collections of Personal Information?, 3 Shidler J. L. Com. & Tech. 7 (Dec. 4, 2006), at <http://www.lctjournal.washington.edu/Vol3/a007Bishop.html>
© 2006 Derek A. Bishop
Commercial, governmental, and nonprofit organizations are more frequently reporting instances of data security breaches. This has, in turn, raised fears of identity theft. In some limited instances, companies that maintain large amounts of personal information — such as credit reporting agencies — have been subject to statutory duties to protect that personal information. In some instances, such legislation has also permitted a private cause of action for breach of these duties. Legislatures have expanded these statutes to encompass, at least to a limited degree, all business entities that collect personal information. Recent precedent indicates that courts may follow this trend by declaring security breaches generally foreseeable, and finding a common law duty on the part of companies to protect their data. The ability of a plaintiff to prove compensable harm from the negligent release of personal information, however, may be more difficult than showing the existence of a duty.
Introduction
The Expansion of Personal Data Use and Misuse in the Information Age.
Statutory Duties Imposed on Collectors of Personal Data
Duty to Protect Personal Data under the Common Law
Foreseeability of Data Collection Resulting in Data Theft
Establishing Standards of Care for Data Security
Conclusion
Practice Pointers
<1> On February 15, 2005, Choicepoint, a commercial data aggregator,2 informed 145,000 people that thieves had improperly accessed their personal data.3 Within the week, a putative class of 145,000 people filed a class action lawsuit against Choicepoint.4 The plaintiffs alleged, in part, that Choicepoint had negligently released credit reports to unauthorized parties in violation of the Fair Credit Reporting Act ("FCRA"). 5 The FCRA prohibits disclosure of consumer reports from a credit-reporting agency except where requested by the consumer, a law enforcement agency, a court order, or a business for a legitimate business need.6
<2> Plaintiffs allege that Choicepoint violated the FCRA by failing to take and maintain reasonable measures in screening the companies that access the plaintiffs' personal data.7 Then in June, CardSystems, Inc., a credit card processor, acknowledged that thieves had accessed files containing 40 million individuals' credit card information.8 Soon thereafter, a putative class of 40 million people filed suit against the credit card processor.9 This lawsuit alleges that CardSystems, Inc. was negligent by failing to adequately secure the personal data.10 CardSystems has a policy that requires notifying individuals only if thieves misuse the stolen personal information. The plaintiff class alleges that this policy violates California law, because under that state's law, all breaches require notification to affected consumers.11
<3> These incidents are part of a broader trend.12 There were 130 reported security breaches exposing the personal information of 55 million Americans in 2005.13 Congress, through legislation such as the FCRA, the Health Insurance Portability and Accountability Act ("HIPAA") and the Gramm Leach Bliley Act ("GLBA"), has imposed an affirmative duty on specific industries to protect personal data. State legislatures, by contrast, recently began enacting legislation that impacts most businesses, but imposes a less onerous duty — the duty to notify individuals in the event of a security breach.
<4> Like legislatures, courts are signaling some willingness to impose a common law duty of care to protect personal information. For a court to hold a company liable for negligence under the common law, a plaintiff must prove four elements: the presence of a duty, a breach of that duty, causation, and damages resulting from the breach that are legally compensable.14 The rise of computer use affects whether companies have a duty to protect personal information, and whether injuries from the release of personal information are compensable.15
<5> The imposition of a duty in tort requires that the risk be foreseeable by the party. Illegal acts, such as data theft, are less foreseeable than simple negligence.16 Recently, courts have begun to acknowledge the foreseeability of data theft where the company has created a risk of data theft to the individual.17 Once a court acknowledges the foreseeability of this theft, it will likely impose a duty to protect personal information against the foreseeable risk of theft of such information.
<6> Personal information has gained value in the information age. Companies now collect and sell personal information for a wide range of purposes. These purposes include managing risk, market research, marketing, personalizing online shopping experiences and facilitating income tax withholding. However, this personal information can also be used for illicit purposes. A credit card number can be used illegally to make purchases online, or a social security number may be used to fraudulently open, and borrow on, a line of credit. With the emergence of electronic technologies, the opportunities to steal and illegally use personal information are increasing.18
<7> There are significant direct costs associated with the identity theft, and those costs are increasing every year.19 Direct costs of identity theft include losses stemming from fraudulent transactions, such as goods purchased with a fraudulent credit card. One report, prepared for the Federal Trade Commission, estimated the direct costs to individuals and financial institutions to be $50 billion per year.20 Actual losses are difficult to calculate because organizations are not required to report economic losses arising from security breaches to customers or other parties.
<8> Legislatures play a crucial role in creating duties to protect consumers from data theft. Historically, only companies in fields that acquired and maintained large amounts of personal information as part of their ongoing relationship with consumers were subject to regulations requiring the protection of this data, (e.g., credit agencies,21 health care institutions,22 and state motor vehicles departments).23 The FCRA,24 HIPAA,25 and GLBA26 are examples of such regulation. These statutes do not generally provide an explicit private cause of action,27 but the specific duties they place on holders of personal information will likely impact any judicially-imposed duties of care for protecting personal information.28
<9> Congress passed the Privacy Act in 1974.29 It imposes duties only on federal agencies, not on state governments, thus limiting its scope significantly.30 The Privacy Act requires that federal agencies establish appropriate safeguards to protect personal information held by the agency.31 Unlike GLBA and HIPAA, it does not create a duty for a company to take specific actions to secure information. Instead it relies on a generic duty to protect.32 The Privacy Act also provides an explicit private cause of action in contrast to other federal privacy statutes.33
<10> More recently, Congress and state legislatures have begun to create affirmative duties for a broader class of organizations that maintain personal data. In most instances this consisted only of a duty to notify individuals whose information was exposed due to a security breach.34 However, some states, including California, have imposed an affirmative duty on a wide range of businesses to protect personal information.
<11> California is among the first states to enact legislation that imposes security duties on all organizations that maintain personal information.35 The two houses of its legislature passed two pieces of legislation, Senate Bill ("S.B.") 1386,36 and Assembly Bill ("A.B.") 1950.37 These laws create a series of affirmative duties to secure personal data for all companies that maintain the personal information of one or more California residents.38 These duties include notifying individuals when their information is released, either purposefully or inadvertently.39 It also requires companies to "provide reasonable security" for personal information, including developing and implementing "reasonable security measures" for protecting the information.40 It further requires that an organization's subcontractors also implement such measures. 41
<12> HIPAA creates a duty on healthcare providers and insurers to enact security procedures to protect the personal information of patients.42 As part of this regulation, HIPAA requires that companies and providers secure protected patient information, and guard against any reasonably anticipated threats or unauthorized uses.43 HIPAA is unique, however, because through its "Security Rule," the statute provides 18 different standards that constitute required protection.44
<13> GLBA, like HIPAA, is a comprehensive regulatory scheme that imposes a duty on financial institutions to implement reasonable security measures to protect personal information.45 The Federal Trade Commission has issued regulations, collectively referred to as the "Safeguards Rule," that lists required security measures which must be taken to comply with GLBA.46 The Safeguards Rule requires each covered organization to develop a written security program that addresses administrative, technical and physical safeguards that the company is taking to secure personal data.47
<14> In tort law, actors generally do not have an affirmative duty to act to protect others.48 However, an actor can be negligent if his actions create an unreasonable risk of harm to another through the conduct of a third person, even if that conduct is illegal.49 For example, the theft of "valuable property . . . left unguarded and exposed to the public view" is foreseeable; a duty thus exists to protect that property.50
<15> Courts are beginning to consider whether companies have an affirmative duty to protect personal data from release and subsequent illegal use. The New Hampshire Supreme Court considered this question in Remsberg v. Docusearch.51 In that case, a man obtained personal information from Docusearch, an information broker, which he used to stalk and kill a woman.52 The court considered whether an information broker owed a duty of care to the person whose information they sold when the information was ultimately used for an illegal purpose.53 The court found that Docusearch had a duty to protect the personal data that it collected from use in an illegal activity.54 This duty was created in large part due to the foreseeability that the information would be used for illegal purposes.55 The court specifically addressed the foreseeability of both stalking and identity theft.56
<16> At least one appellate court has found that a foreseeable theft of personal information may give rise to a duty of care to protect that information.57 In an unpublished opinion, Bell v. Michigan Council 25, the Michigan Court of Appeals held that a union owed a duty of care to its members to protect their personal information from theft.58 The union allowed paper files containing members' personal information to leave the premises, where the daughter of an employee stole the information contained within them.59 The court found that the theft of the information was foreseeable, and the failure to protect against that theft amounted to a breach of the union's duty of care.60 As a result of this breach, the court allowed the plaintiffs to collect $275,000.61
<17> In both Bell and Remsberg, the courts recognized that companies generally have no duty to protect against the illegal acts of third parties.62 In Remsberg, the information was used to stalk and kill the individual whose information was released.63 In Bell, the information was subsequently used to appropriate the plaintiffs' identities.64 Both the New Hampshire Supreme Court and the Michigan Court of Appeals held that the illegal use of personal information was foreseeable, and subsequently imposed a duty to protect this information from illegal activity.
<18> Recently, in Poli v. Mountain Valleys Health Centers, Inc65 ., the U.S. District Court for the Eastern District of California considered the existence of HIPAA and common law causes of action for the release of personal information. Poli's employer, Mountain Valleys Health Centers, was investigating Poli for possession of non-prescribed prescription medication.66 As part of this investigation, Rite Aid released plaintiff's medical records to Mountain Valleys Health Centers without Poli's permission.67 The plaintiff asserted causes of action against Rite Aid for violating HIPAA and for common law negligence.68 The court granted defendant Rite Aid's motion to dismiss the claim for a violation of HIPAA, holding that HIPAA does not create a private cause of action.69 However, the court refused to dismiss the common law negligence claim.70 Regarding that claim, the court held that the plaintiff's allegation that a duty existed was sufficient to survive the motion to dismiss.71
<19> The most significant factor to consider in determining whether a duty to protect personal information exists is the foreseeability of the harm to the plaintiff.72 In general, actors are not expected to predict the illegal acts of third parties.73 However, misconduct is foreseeable when a company acts "with the knowledge of peculiar conditions [that] create a high degree of risk of intentional misconduct."74 In Remsburg v. Docusearch, Inc., the court held that the risk of criminal misconduct is sufficiently foreseeable to impose a duty of care.75 In coming to this conclusion, it recognized the increasing incidence of both stalking and identity theft, and the public policies that resulted from that increase.76 Although the opinion addressed a situation where a company intentionally released this information, the court's holding was not limited to those facts but instead hinged on the foreseeability of the illegal actions.77
<20> Both the Supreme Court of New Hampshire and the Court of Appeals of Michigan have acknowledged the foreseeability of harm in a negligence context. Tribunals at all levels have begun to acknowledge the foreseeability of harm from security breaches in related contexts.78 For example, the Maine Public Utilities Commission found that the disruption of computer service due to a computer virus was foreseeable.79 Because it was foreseeable, Verizon's failure to protect its network did not excuse its inability to meet the promised performance metrics.80
<21> Similarly, as part of the ongoing Cobell v. Norton litigation, the U.S. Court of Appeals for the District of Columbia Circuit has acknowledged the foreseeability of data theft. 81 This litigation attempts to make the United States government account for billions of dollars held in trust accounts for more than 500,000 Native Americans.82 To do this, the federal government created a database containing personal information of these citizens. The government was originally enjoined from connecting this database to any network, until they could prove that it was secure. Although the D.C. Circuit lifted the injunction on narrow procedural grounds, it acknowledged that the government had a duty to protect the personal information from outside attack.83 Although these cases do not directly address questions of negligence, by acknowledging the foreseeability of data theft, the cases may indicate a possible change in the common law that imposes greater duties on companies to protect data stored with them in electronic form.
<22> The collection of personal data in large databases and the subsequent theft of that information are still relatively new phenomena. As such, there are few fixed standards of care for data security. However, the guidelines of federal agencies tasked with enforcing statutory duties, as well as customer and trade practice, may be indicators of how standards of care for data protection will be shaped.
<23> A court may review standards of care adopted by Congress and other state legislatures to determine the appropriate standard of care for new common law duties. GLBA and HIPAA have several areas of overlapping requirements that a court may find especially significant in determining the appropriate standard of care. For example, both require that only authorized employees have access to personal data.84 In addition, each requires that data, including electronic data on workstations, be disposed of properly.85 Covered entities can also establish an auditing program that is able to detect and repair any unauthorized changes or release of personal information.86 A review of HIPAA and GLBA may be effective in creating a plan to comply with the emerging duty of care that may be imposed on holders of personal information.
<24> Courts have also provided some guidance as to what precautions are reasonable. For example, in Bell, the court found that the union's actions in allowing its member's files to leave the premises helped make the theft of that data foreseeable.87 If the union had secured the information on the premises, it may have prevented the loss and the ensuing liability. In other cases, courts have found that a provider of personal information, rather than conducting a cursory investigation, should take proactive steps to ensure that the information is going to be used for a legitimate purpose.88 Another court mandated that a collecting agency create a security plan before having the right to connect to the Internet.89 These cases instruct that a company would be wise to design a security plan, secure all personal data files, and carefully regulate those who have access to such data.
<25> The area of tort liability for security breaches of personal data is still in relative infancy. Legislatures are moving more rapidly than courts in safeguarding personal information by imposing protective duties on several industries that deal with personal data commercially. Other wider-ranging duties have been legislatively proposed. In a recent turn of events, courts have indicated that they may follow suit by finding that companies have a duty to protect private information if the theft of that information is foreseeable.90 This is largely because data theft and misuse have become increasingly foreseeable,91 thereby fulfilling a classic prong in tort law. Even if plaintiffs can overcome the duty hurdle, they must prove physical (or other compensable) damages. This second possible hurdle to a claim notwithstanding, companies should safeguard their customers' private information or risk paying damages for negligence.