Can You Sue When Personal Data is Disclosed in a Breach?
Two alumni of Ohio University didn't get far suing the school over a data breach that leaked their personal information. The victims weren't happy but the case makes a good distinction between what might happen with the stolen information and what actually happens. From the Athens News:
"It's frustrating," said attorney Marc D. Mezibov. In cases where hackers break into a computer network and access personal information, he said, "courts are reluctant to grant the proposition that when personal data is lost... there is harm," unless those whose data was accessed can clearly link the hacking to a later instance of identity theft.
This makes sense, my data was exposed in a bank breach a couple of years ago and it hasn't caused me any damage. I'm no lawyer but I don't think I can sue others over what I worry about but doesn't materialize. (Now, if there were violations of regulations then that's a different story and the government would have a case.)
The article goes on to note the same logic applies in the OU case:
The judge essentially agreed with OU's main argument, that while Kulpa and Neben might be afraid their personal data will be used to rob them, they haven't shown any specific damages they've suffered because of the computer hacking.
The alumni do make a good point that this breach will lead them to purchase some kind of credit monitoring service:
What this approach misses, the attorney argued, is that to avoid or minimize such theft typically involves a cost, to monitor one's credit."People have to spend money," he said.
He noted that the hacking of personal data from large computer networks seems to have become a common occurrence these days, and that courts may be hesitant to set the precedent that the owner of a network is responsible to pay for the impacts of a security breach.
This should be covered in legislation for this particular type of damage. We can't provide blanket coverage for every fear someone has in this society. If I'm afraid I'll get brain cancer from standing in front of my microwave, I don't expect Sears to cover the cost of medical tests. If Sears makes a defective product, I have laws to fall back on to protect my interests. The same should hold for victims of cybercrimes. These issues should be debated in legislatures and frameworks established so consumers and businesses have clearer ground rules.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
