Growing Class Action Threat: Breaches of Consumer Personally - PowerPoint PPT Presentation

Presenting a live 90-minute webinar with interactive Q&A Growing Class Action Threat: Breaches of Consumer Personally Identifiable Information Minimizing Litigation Risk and Maximizing Insurance Coverage TUESDAY, MARCH 18, 2014 1pm Eastern | 12pm Central | 11am Mountain | 10am Pacific Today’s faculty features: Linda D. Kornfeld, Partner, Kasowitz Benson Torres & Friedman , Los Angeles Tracy D. Rezvani, Shareholder, Rezvani Volin & Rotbert , Washington, D.C. Donna L. Wilson, Partner, Manatt Phelps & Phillips , Los Angeles The audio portion of the conference may be accessed via the telephone or by using your computer's speakers. Please refer to the instructions emailed to registrants for additional information. If you have any questions, please contact Customer Service at 1-800-926-7926 ext. 10 .

FOR LIVE EVENT ONLY Sound Quality If you are listening via your computer speakers, please note that the quality of your sound will vary depending on the speed and quality of your internet connection. If the sound quality is not satisfactory, you may listen via the phone: dial 1-866-869-6667 and enter your PIN when prompted. Otherwise, please send us a chat or e-mail sound@straffordpub.com immediately so we can address the problem. If you dialed in and have any difficulties during the call, press *0 for assistance. Viewing Quality To maximize your screen, press the F11 key on your keyboard. To exit full screen, press the F11 key again.

FOR LIVE EVENT ONLY For CLE purposes, please let us know how many people are listening at your location by completing each of the following steps: In the chat box, type (1) your company name and (2) the number of • attendees at your location Click the SEND button beside the box • If you have purchased Strafford CLE processing services, you must confirm your participation by completing and submitting an Official Record of Attendance (CLE Form). You may obtain your CLE form by going to the program page and selecting the appropriate form in the PROGRAM MATERIALS box at the top right corner. If you'd like to purchase CLE credit processing, it is available for a fee. For additional information about CLE credit processing, go to our website or call us at 1-800-926-7926 ext. 35.

FOR LIVE EVENT ONLY If you have not printed the conference materials for this program, please complete the following steps: • Click on the ^ symbol next to “Conference Materials” in the middle of the left - hand column on your screen. • Click on the tab labeled “Handouts” that appears, and there you will see a PDF of the slides for today's program. • Double click on the PDF and a separate page will open. • Print the slides by clicking on the printer icon.

Growing Class Action Threat: Breaches of Consumer Personally Identifiable Information Presented by Donna L. Wilson dlwilson@manatt.com Tracy D. Rezvani trezvani@rvrlegal.com March 18, 2014

Roadmap 6  Article III standing – actual vs. future damages  Trends – alternative theories of damages, liability  Enforcement – by FTC, state AGs  Class certification issues  Privacy settlements – sufficient relief to class members  Statutory claims  Google – a case study  California legislative spotlight  Takeaways

Standing in Data Breach Litigation 7  Differences among circuits re: sufficiency of injury for purposes of standing (present v. future injuries)  Game Changer? - Clapper v. Amnesty International USA , 133 S. Ct. 1138 (Feb. 26, 2013) – Threatened injury must be “certainly impending” to constitute injury -in-fact – The Court, however, re-affirmed Monsanto Co. v. Geertson Seed Farms , 130 S. Ct. 2743, 2754- 55 (2010) (“reasonable probability” or “substantial risk” sufficient for standing)  Effect of Clapper on data breach litigation – Plaintiffs have taken the position Clapper is limited to the facts. Defendants have relied upon Clapper to challenge standing based upon possibility of damages, steps taken to prevent future damages (i.e., future risk of identity theft, incurring costs for credit monitoring services)  In re Barnes & Noble Pin Pad Litigation , No. 12-cv-8617, 2013 WL 4759588 (N.D. Ill. Sept. 3, 2013) – relying on Clapper , dismissing class action for lack of standing. Rejected various theories of injury, including Barnes & Noble’s failure to promptly notify plaintiffs of security breach; increased risk of identity theft; and time and expenses incurred to mitigate risks of identity theft.  Polanco v. Omnicell, Inc ., 2013 WL 6823265 (D.N.J. Dec. 26, 2013)- relying on Clapper , dismissing class action for lack of standing. Plaintiffs did not allege either misuse of plaintiffs’ PCI or PHI and court rejected theories of injury including increased risk of identity theft and time and expenses incurred to mitigate risk of identity theft.

Standing in Data Breach Litigation 8  Yunker v. Pandora Media, Inc., 2013 US Dist LEXIS 42691 (N.D. Cal. Mar. 26, 2013) – Court found diminution in the value of PII is insufficient to confer standing. Plaintiff argued that because Pandora allegedly sold the plaintiff’s personally identifiable information, that information is now less valuable. The court granted MTD because of the highly speculative nature of this alleged harm.  Redressability – Frank v. Neiman Marcus Grp., LLC, 2:14-cv-00233 (E.D.N.Y. February 12, 2014) – Defendant challenges standing, in part, on the theory that Plaintiff cannot meet Article III’s redressability requirement. Defendant argues that the complaint fails to allege facts showing how Plaintiff’s past injuries can be remedied by a judgment in her favor due to Franks’ card issuer’s assurance of zero fraud liability.  Target breach litigation – Standing will be a hurdle for claimants  Plaintiffs will have to show injury in fact i.e. identity theft  Plaintiffs will have to show a strong enough link between Target hacking and injuries suffered – Target has promised to pay for credit monitoring services – Similar issues for Michaels Stores and Neiman Marcus Security Breaches

Trends in Data Breach Litigation 9  Alternative theories of damages? – i.e., “benefit of the bargain theory”, not getting what was paid for  In re Linked In User Privacy Litig. , 932 F. Supp. 2d 1089 (N.D. Cal. 2013). MTD granted for plaintiffs’ lack of standing. Plaintiffs had alleged their paid premium memberships promised security.  Expansion of who may be held liable for a data breach? – Employers of a rogue employee?  Kiminiski v. Hunt, et al. , No. 13-cv- 208 (D. Minn. Sept. 20, 2013). State defendants’ MTD DPPA claim granted because, inter alia, plaintiffs failed to allege that defendants knowingly gave the former employee database access for an impermissible purpose. – In the absence of a contractual relationship?  Lone Star Nat’l Bank, N.A. v. Heartland Payment Sys., Inc. , 729 F.3d 421 (5th Cir. 2013). Reversed district court’s dismissal of negligence claim arising from hackers’ breach of Heartland’s data systems. Held that economic loss doctrine did not bar negligence claim. Payment card issuing banks had sued payment processor; Visa and MasterCard had contractual agreements with the issuing banks.

Trends in Data Breach Litigation (continued) 10  Focus on statutory claims, rather than common law claims? – In re Zappos.com, Inc. , No. 12-cv-325, 2013 WL 4830497 (D. Nev. Sept. 9, 2013). Court granted MTD in part. Dismissed most of common law claims, allowed MDL to proceed on most of the state statutory claims and negligence claim. – Standing based simply on the availability of statutory injury and damages?

Data Breach Enforcement Actions 11  FTC jurisdiction to regulate privacy and data security in the private sector – Many FTC settlements under Section 5 of the FTC Act  FTC v. Wyndham Worldwide Corp. , No. 13-cv-1887 (D.N.J.) – motions to dismiss pending, parties asked to submit supplemental briefing regarding FTC Commissioners’ testimony at a subcommittee hearing that Section 5 enforcement is “vague” and “formal guidelines” are needed. Wyndham contends that Section 5 does not authorize the FTC to regulate data security standards for the private sector. – Rare challenge to FTC’s enforcement authority – Potential impact on the breadth of FTC authority in the future  Closely followed. See, e.g., In the Matter of LabMD, Inc. , FTC Docket No. 9357 – in answer, respondent asserted that the FTC lacks subject-matter jurisdiction  On the horizon in 2014 – FTC to focus on data security, big data, mobile technologies  State AGs – Example: Connecticut AG reached a $55,000 settlement with Citibank N.A., where Citibank allegedly delayed in fixing vulnerability and notifying customers.  Civil penalties, third party information security audit, maintenance of reasonable security procedures and practices, free credit monitoring for two years for any individual affected by future security incidents