Litigation
Cite as: Derek A. Bishop, No Harm No Foul:Limits on Damages Awards for Individuals Subject to a Data Breach, [4] Shidler J. L. Com. & Tech. [12] (5/23/2008), at <http://www.lctjournal.washington.edu/Vol4/a12Bishop.html>
Recently, TJX, Inc. announced that computer hackers breached several of TJX’s databases containing the driver’s license and credit card numbers of over 47 million customers. Within a month, a class action lawsuit attempting to hold TJX responsible for losing control of this information was filed. In the past, class action lawsuits based on the release of consumer’s personal data have failed because the plaintiffs have not alleged sufficient harms. This article examines legal claims relating to the release of personal data by companies during security breaches. To date, courts have refused to find individuals harmed by the negligent release of information, without proof that the information has been misused by a third party. In addition, courts have not found a substantial enough causal link between the release and the fraudulent use. This article also examines several doctrines which may in the future be used to limit potential defendant liability from class action claims stemming from the release of personal information.
<1>In January 2007, the parent company of T.J.Maxx and Marshall’s department stores, TJX, Inc., revealed that hackers had accessed areas of their computer system containing retail transaction data dating from 2003.2 TJX indicated that there were several breaches of their system between July 2005 and January 2007.3 TJX has not specified which databases were breached, but it is believed that the hackers accessed information about transactions involving approximately 45.7 million credit cards.4 Within two weeks, attorneys filed a class action lawsuit in U.S. District Court for the District of Massachusetts.5 The plaintiffs seek monetary damages and an order requiring TJX to pay for credit monitoring.6 In addition, several banks filed a lawsuit against TJX, attempting to recoup costs incurred in replacing the credit cards of those affected by the breach.7 The Federal Trade Commission and the Attorneys General of several states began a civil investigation into the breach and TJX’s security procedures.8 Most recently, TJX announced they incurred $12 million in expenses in the first quarter of fiscal year 2008, offsetting what was otherwise strong growth.9 As computer data breaches become more common, it becomes more important to properly determine whether companies or organizations face tort liability for such breaches when customer information is released during those breaches.10
<2>The plaintiffs’ allegations in the TJX case and other recent class action lawsuits share two important similarities. The plaintiffs allege that a business collected their personal information for the business’ purposes, and then allowed a third party to improperly access that personal information. The purpose for collecting the plaintiff’s information has varied, but has generally been unimportant. Likewise, the method used by the third party to gain access to the information has ranged from cases where the information was taken without an indication they were targeting the information, to cases where the information itself was targeted. Although the circumstances establishing these allegations vary greatly, these elements are at the core of each of the negligence class actions brought to date.
<3>A plaintiff bringing a negligence lawsuit must allege every element of the common law tort of negligence. These elements are the presence of a duty, the failure of the defendant to meet that duty, and damage to the plaintiff that is a cause and result of the failure to meet the duty.11 Plaintiffs have had difficulty establishing that the defendant has a duty to protect their information, and that they have suffered some compensable damage from that release.12 Courts have begun to define the contours of compensable damage to a plaintiff stemming from the release of their personal information.13 To date, plaintiffs have been unable to demonstrate compensable harm from the release of information, which has led courts to dismiss the cases for lack of standing or for failure to state a claim. If a plaintiff is able to demonstrate compensable harm, any award should be limited by the doctrine of avoidable consequences.
<4>Plaintiffs have been unable to collect damages from class action lawsuits stemming from negligent protection of personal data. In previous cases, plaintiffs have failed to demonstrate compensable damage due to the release of the information.14 Some courts have found that the unauthorized release of personal information itself is not a cognizable harm, instead requiring plaintiffs to provide evidence that the information was misused. Courts have also dismissed claims by plaintiffs who have suffered harm, when the plaintiff has not provided sufficient evidence the harm was caused by the release of information. Even if the court finds the plaintiff has suffered a compensable harm, a court may disallow recovery under the economic loss rule, which disallows compensation in tort for purely economic harms.15
<5>A threshold issue in figuring potential tort exposure is determining what constitutes harm from the inadvertent release of personal information. This issue arises in two ways. First, courts have dismissed, or remanded, claims for lack of subject matter jurisdiction where plaintiffs have failed to allege harm sufficient to sustain standing.16 Second, plaintiffs must demonstrate a cognizable harm as an element of a prima facie case for negligent release of their information. In either event, the court is likely to dismiss the claims for lack of jurisdiction or for failure to state a claim.17
<6>In cases where a negligent release of information has led to physical harm, courts have permitted a lawsuit to proceed. In Rembsberg v. Docusearch, a man used false pretenses to obtain a woman’s personal information from a data broker.18 The man used this information to stalk and eventually kill the woman.19 The court held the woman suffered harm sufficient to support the lawsuit, and the claim presented sufficient evidence to show that the release of information caused that harm.20 This unfortunate set of facts demonstrates the potential harm an individual can suffer as a result of the unauthorized release of one’s personal data.
<7>In the more typical case, however, an individual’s information is released, but there is no evidence that the information was misused. Courts have held the release of information alone, without evidence of misuse, does not cause damage to the plaintiff.21 These courts have held the risk of some undefined future harm to the plaintiff is too speculative to sustain a lawsuit.22 Courts will generally dismiss or remand these cases either based on a lack of standing,23 or for failure to allege the damage element of the prima facie case24 depending on the procedural posture and the context of the case. In either instance, the court uses the same analysis to determine what constitutes damage.
<8>In Giordano v. Wachovia Securities, L.L.C., the U.S. District Court for the District of New Jersey considered whether a release of plaintiffs’ personal information, with no evidence of misuse, was sufficient to grant plaintiffs standing.25 The Giordano plaintiffs were customers of Wachovia Securities, L.L.C., a financial services company providing advisory, brokerage and asset management to customers.26 Defendant sent a list containing financial information, including names, addresses and social security numbers of thousands of customers, via UPS.27 UPS subsequently lost the package in transit, and defendant believed that the package was damaged in transit and destroyed.28 The named plaintiff failed to allege that her identity was stolen or the data misused.29 The court found the loss of data, without allegations of misuse, failed to provide the plaintiffs with standing to bring the suit.30 The court found the loss of plaintiff’s financial data and costs incurred by the plaintiff in credit monitoring did not create a concrete and particularized harm.31
<9>Courts have since expanded the reasoning in Giordano in two similar class action lawsuits.32 In these cases the plaintiffs alleged that the defendants allowed a third party to access their information.33 The courts held the plaintiffs lacked standing, even where the information was accessed purposefully and illegally.34 Both of these cases, Key v. DSW, Inc. and Acxiom Corp. v. Bell, held that a plaintiff lacked standing where the plaintiff was unable to prove that the information was used fraudulently.35 Both of these courts granted the defendant’s motion to dismiss based on the plaintiff’s lack of standing.36
<10>The Seventh Circuit has most recently considered the question in Pisciotta v. Old National Bancorp (ONB).37 ONB collected personal information from individuals seeking banking services such as loans and accounts.38 The data of tens of thousands of ONB’s site users was breached and ONB subsequently notified the individuals of the breach.39 The plaintiffs filed a class action lawsuit on behalf of the individuals whose information was released.40 Notably, the claim failed to allege that any plaintiff suffered any direct financial loss or was the victim of identity theft.41 The Court of Appeals held the increased risk of harm stemming from the release of the personal information was sufficient to give plaintiffs standing, even where no actual injury was shown.42 However, the Court of Appeals upheld the dismissal because it held Indiana state law did not recognize this increased risk of injury as a compensable harm.43 It is unclear how widely accepted this reasoning will become in future cases.
<11>The tort element of damage is a closely related, but distinct, concept from standing. Most significantly, standing is a jurisdictional requirement to maintaining a suit in federal court,44 whereas proving damages is an element of a negligence claim. Courts have found that plaintiffs suffer no tort damages when a security breach leads to a release of personal information, using the same rationale and authority as the courts finding a lack of standing.45
<12>In an effort to establish compensable damages, several plaintiffs have alleged injury based on their need to protect themselves from identity theft. In these cases, plaintiffs have analogized the release of personal information to exposure to a pathogen in fear of illness cases. In fear of illness cases, courts allow plaintiffs to collect damages based either on the emotional distress caused by a well grounded fear of contracting an illness, or for the costs incurred by medical monitoring to prevent future illness.46 Through this analogy, plaintiffs’ claim that their “fear of identity theft” gives rise to damages either by causing emotional distress in the form of plaintiff’s worry about identity theft or by causing the plaintiff to incur costs for monitoring their credit reports to prevent identity theft. Courts have rejected this analogy in each case to date.
<13>In Stollenwerk v. Tri-West Healthcare, the U.S. District Court for the District of Arizona considered whether the fear of identity theft as a result of the release of personal information could establish the damages element of the plaintiff’s claim.47 In that case, burglars stole a hard drive containing the plaintiff’s unencrypted personal data from the defendant health insurer’s office.48 The court refused to recognize a fear of identity theft for three reasons. First, the loss of control of an individual’s data does not create a latent injury at the time of exposure.49 Secondly, the public health rationale underpinning the fear of illness cases does not apply where an individual’s personal data is released.50 Lastly, the court held that any injury resulting from identity theft could be remedied with financial damages.51 The court also noted that it was unable to locate a single case in which costs for monitoring were awarded without a risk to human health.52
<14>The Giordano court also considered and rejected fear of identity theft damages because the plaintiffs were unable to prove that their information was actually stolen. In the basic fear of illness case, the plaintiff must provide proof of exposure to a harmful level of pathogen.53 In Giordano, there was no evidence that the package of personal information was targeted or stolen, or that any third party intended to misuse the information.54 The court found the plaintiff failed to prove that he had a greater risk of identity theft due to the data release because they provided no evidence that the information was accessed.55
<15>Establishing that the Data Loss Caused the Plaintiff’s Damages
<16>Even where a plaintiff is able to show damage, the plaintiff must also provide proof that the damage was caused by the breach. A plaintiff has significant difficulty proving that the identity thief obtained the information via the breach.56 This difficulty is due in large part to the wide use of personal data in global commerce.57 A customer’s social security number or credit card details, for example, are stored with many organizations. A plaintiff is required to provide evidence that the identity thief obtained the information via a specific breach, or else risk dismissal of claims.58
<17>One of the plaintiffs in Stollenwerk was a victim of identity theft.59 Plaintiff provided evidence that a third party attempted to open credit accounts in his name on six separate occasions, all after the relevant data breach.60 The court held no reasonable jury could find the data breach caused the plaintiff’s identity theft absent evidence connecting the information used fraudulently with the lost information.61 The court specifically rejected, as post hoc ergo propter hoc, the argument that the temporal relationship of the events proved causation.62
<18>Under the traditional economic loss rule, tort law does not allow parties to recover damages for economic losses which are unaccompanied by some physical harm.63 The “economic loss rule” limits compensation in tort for economic damages because economic losses are speculative and unforeseeably wide ranging.64 In addition, economic losses are generally thought to be best allocated via contract.65 In a typical identity theft situation, identity thieves use others’ personal data without authorization to commit fraudulent acts.66 This fraud often takes the form of fraudulent credit transactions and not physical harm to person or property.67 A court strictly applying the economic loss rule would substantially reduce potential liability for companies releasing private information.
<19>Courts and legislatures may create an exception to the economic loss rule in cases of harm to consumers arising from security breaches.68 In the past, courts have created exceptions to the economic loss rule where the policies underlying the economic loss rule were not met.69 Some commentators believe that the underlying policies would not be advanced by the imposition of the economic loss rule in this case, and so courts may develop another exception.70
<20>If a plaintiff establishes damage from the negligent release of his personal information, the defendant can attempt to limit its liability for those damages. Under the doctrine of avoidable consequences, “any damages which could have been avoided by reasonable conduct on the part of the plaintiff” are not compensable in tort.71 The doctrine of avoidable consequences is widely accepted in a variety of factual contexts.72 In this context, the defendant might effectively use this doctrine to limit its liability under two separate theories. A defendant could pay the plaintiff’s credit monitoring costs, for example. A state’s credit freeze law might also serve to limit a plaintiff’s damages.
<21>If a company offers credit monitoring services to those whose information was released, it limits its liability to damages incurred at the time of the offer. Credit monitoring services provide individuals with a copy of their credit report periodically. This credit report will detail all of the accounts opened in the individual’s name. Individuals can immediately identify and close any accounts opened fraudulently, thereby limiting the damages suffered by the individual. Defendant’s liability would be limited to fraud taking place before the implementation of, or in spite of, the credit monitoring program.
<22>Credit freeze laws may also limit the amount of damages awarded to plaintiffs. To date, thirty nine states (and the District of Columbia) have enacted credit freeze laws, and the major credit agencies now offer a voluntary credit freeze upon request.73 Using a credit freeze, a consumer can prevent credit agencies from sharing one’s credit file with anyone, unless the consumer removes the freeze or otherwise specifically authorizes access.74 A credit freeze of this sort generally requires an individual to pay a small fee and make several phone calls.75 This process effectively prevents the use of an individual’s information to obtain credit, either legitimately or fraudulently.76 If an individual can be reasonably expected to use a credit freeze to protect himself from the possibility of identity theft, then a court might limit the defendant’s potential liability.
<23>Companies that collect large amounts of personal data face litigation if they lose control of that data. To date no court has found a plaintiff damaged by the mere release of the plaintiff’s information. Courts have not found plaintiffs damaged when their information was accessed illegally. Instead, courts have required that the information be used fraudulently. If a plaintiff can provide evidence that the plaintiff suffered an actual loss, they must still prove that this loss was caused by the breach. Lastly, plaintiffs must convince a court that the economic loss rule should not apply in the case of identity theft. If a court finds a plaintiff has suffered compensable damage, defendants can act to limit their potential liability. Defendants can offer credit monitoring services, or may rely on a state credit freeze law. In either event, if a court finds some portion of the damages could have been avoided through reasonable efforts, then this portion of the damages would not be attributable to the defendant.