$3,000,000 settlement reached in data breach lawsuit

It amazes me that such small almost incidental actions can result in huge corporation wide disasters.  Yet, almost every day we see data breaches which are the result of small errors or carelessness.  It might be a dropped USB drive or laptop left in a bar.
Closer to home for me is the massive quantity of discarded data left on unwanted devices.  In studies carried out by academia I have seen over 50% of hard drives sold on eBay still containing data.  I have also seen a large increase in both mixed work and home data suggesting that more and more users are using machines for both; either home (BYOD) machines used for work at home or work machines used for personal purposes. This mix of data type is a real challenge.  I have seen some personal interest which includes a fascination with sadomasochism and extreme political parties on devices.  I have seen details of affairs senior staff have been having with their employees.  All sensational stuff but in the wrong hands it’s an open invitation for blackmail. Controlling what data is where is a difficult task at the best of times.  It can slip through your fingers like sand and once outside of a controlled environment it can sit there like a time bomb waiting to be discovered.  Bang does your sensitive data.

• Shook Hardy & Bacon LLP
• Alfred J. Saikali
• USA
• October 22 2013

Author page »

How much of a headache can a couple of stolen laptops cause your organization? How about a $3 million headache?? That is the amount of a settlement proposed in an Unopposed Motion in Support of Preliminary Approval of Class Action Settlement in Resnick/Curry v. AvMed, Inc., No. 1:10-cv-24513-JLK (S.D. Fla.), a data breach lawsuit pending in the Southern District of Florida.

Background

Resnick involved the theft of two unencrypted laptops from a conference room in the defendant’s corporate office. Unfortunately, the laptops contained personal information of approximately 1.2 million customers/insureds (“the plaintiffs”). The plaintiffs filed a class action lawsuit claiming that AvMed failed to adequately secure the plaintiffs’ personal information.

The District Court dismissed the lawsuit in July 2011, finding that the plaintiffs had failed to show any cognizable injury. The 11th Circuit, however, reversed the trial court, holding that the plaintiffs had in fact suffered cognizable injuries.

Of particular note was the portion of the 11th Circuit’s opinion addressing the plaintiffs’ unjust enrichment count. The plaintiffs had argued that a portion of their insurance premiums was ostensibly for the defendant’s administrative costs in implementing safeguards that protected the plaintiffs’ information. The plaintiffs contended that, as evident by the stolen unencrypted laptops, a portion of those costs should be returned because their information was ultimately compromised and the defendant had not adopted reasonable security measures to protect their information. The 11th Circuit agreed, and held that the unjust enrichment count (among other counts) could proceed on remand.

The Settlement Terms

The $3 million settlement fund is to be disbursed as follows:

1. approved premium overpayment claims – class members can receive up to $10 per year for each year they paid the defendant for insurance before the data breach, subject to a $30 limit. These are the unjust enrichment damages.
2. approved identity theft claims – class members who suffered any unreimbursed monetary losses as a result of identity theft related to the breach are eligible to have those amounts reimbursed.
3. settlement administration expenses – these are the costs for providing notice to the settlement classes and the costs of administering the settlement. At first blush these may seem small, but remember that there are potentially 1.2 million individuals involved.
4. class counsel’s attorney’s fees and costs – $750,000 to class counsel (Edelson LLC, one of the few plaintiffs’ firms that has demonstrated a pattern of success in privacy and data security litigation).
5. plaintiff’s incentive awards – $10,000 to be split evenly amongst the class representatives.

Perhaps the most valuable part of the settlement for those of us who advise clients about privacy and data security legal matters is the portion relating to what the defendant has agreed to do in the future, which reads a little like an FTC consent order:

1. mandatory security awareness and training programs for all company employees;
2. mandatory training on appropriate laptop use and security for all company; employees whose employment responsibilities include accessing information stored on company laptop computers;
3. upgrading of all company laptop computers with additional security mechanisms, including GPS tracking technology (this latter part seems a bit much, its usefulness is questionable, and it could lead to other privacy issues related to employee location tracking);
4. new password protocols and full disk encryption technology on all company desktops and laptops so that electronic data stored on such devices would be encrypted at rest;
5. physical security upgrades at company facilities and offices to further safeguard workstations from theft; and,
6. the review and revision of written policies and procedures to enhance information security.

Lessons To Be Learned

Why are the prospective measures so important? They provide a roadmap for what companies should do to minimize the risk of similar litigation. They also make good business sense and are likely compatible with the expectations of a company’s consumers. They are safeguards all companies should consider. Had the two laptops in Resnick been encrypted, one has to wonder whether a lawsuit would have been filed at all.

Another lesson — what are you saying in your consumer-facing policies and notices about the security safeguards your company has adopted to protect consumer information? Such statements, though useful and sometimes required, could expose your organization to the same unjust enrichment argument that the plaintiffs made in Resnick.

Finally, this is the second data breach lawsuit that has resulted in a substantial settlement for the plaintiffs and both were filed in the Southern District of Florida. (The other was Burrows v. Purchasing Power, which I blogged about here, and resulted in a settlement of approximately $430,000). The settlements are in sharp contrast to the vast majority of cases that have been dismissed for lack of standing and damages. It will be interesting to see what impact these recent settlements will have on future data security and privacy litigation.

10/26/13 UPDATE: The Southern District of Florida wasted no time considering the unopposed motion seeking preliminary approval of the class action settlement. On October 25th, just four days after the motion was filed, the court granted it and set the Final Approval Hearing for February 28, 2014.