Intellectual Property Law

Victims of Data Security Breaches Left High and Dry

By Michael Scott

As the number of data security breaches continues to increase, and the number of persons who have their personal information exposed reach over 100 million, you would think these victims would have some remedy for the time and effort they have to go through to get their lives back in order. Yet, the cases have uniformly held that they have no remedy against the companies which, due to lax security, allowed cybercriminals to get into their systems are rummage around in the personal information stored there.

The latest case is Piscotta v. Old National Bancorp., 2007 WL 2389770 (7th Cir. 2007). In that case, the plaintiff claimed that the hosting facility for a banking website had been hacked into and the plaintiff?s personal information was potentially stolen. The plaintiff sued, claiming that the lack of security caused plaintiffs [the suit was a class action] ?to suffer substantial potential economic damages and emotional distress and worry that third parties will use [the plaintiffs?] confidential personal information to cause them economic harm, or sell their confidential information to others who will in turn cause them economic harm.? The plaintiff claimed damages because they ?incurred expenses in order to prevent their confidential personal information from being used and will continue to incur expenses in the future.?

The trial court dismissed the action for failure to allege any compensable damages, and the Seventh Circuit affirmed. This case is in line with a growing string of decisions, holding that the victims of identity theft do not have a claim unless and until they can prove actual damages, and that those damages flowed from the specific security breach in issue. What is a victim to do? (More after the jump.)

Full post as published by Singularity on September 18, 2007 (boomark / email).