Electronic Data Records Law | How to Win E-Discovery

Privacy | Data Leakage Law

Identity Theft Legal Damages

Must a data holder pay money if it is the victim of a data compromise?  To that question the Connecticut Attorney General has a novel answer.

Background on Legal Liability

Few judicial decisions hold data holders liable for damages suffered by data subjects after a security breach.  The best example of such a decision is Bell v. Michigan Council 25 AFSCME [Michigan Ct. of Appeals, unpublished op. 2/15/05].  It held a small labor union accountable to members who became victims of identity theft after a thief stole their Social Security Numbers (SSN) and other data from the union. The damages amounted to approximately a quarter million dollars.

That result required the union members to go to court and prove negligence.

Sometimes state legislatures enact a law that specifically requires a data holder to pay the costs of others in the wake of a breach.  A good example of such a special law is Minnesota’s HF 1758 (Plastic Card Security Act), which sometimes requires credit card merchants to reimburse the costs of card issuers when they replace cards after a breach at the merchant.

Politician Demands Liability ... and That's Not Necessarily Good or Bad

Now, in a breach at Countrywide Financial Corp (owned by Bank of America), the Connecticut state attorney general seeks liability without the support of a court decision or special legislation.  He did not sue in court.

It appears the AG has simply demanded, in public, that Countrywide agree it will compensate anyone hurt by the breach. Countrywide is a large company, vulnerable to public pressure like this. Countrywide has agreed, and the AG is seeking to get that agreement in writing.

A state attorney general is a politician charged with advancing the interests of consumers.  Here, Attorney General Richard Blumenthal is doing that not through traditional legal proceedings, but through his bully pulpit.

Background: Countrywide suffered a breach when an employee downloaded records on as many as 2 million Countrywide customers/prospects and offered them for sale to mortgage brokers who wanted them for sales leads. E. Scott Reckard, “Mortgage firm Countrywide, in response to alleged data breach, offers free credit monitoring,” Los Angeles Times, Sept. 10, 2008. Countrywide says it has no evidence that anyone has suffered identity theft from this incident.

Update: The expansion of legal liability for compromises of e-data security will be a deterrent to the adoption of electronic medical records (aka personal health records or PHRs).  As the new Obama administration promotes electronic healthcare records, doctor's offices and clinics will have reason to resist.  The reasoning of medical offices could go like this: "The Department of Heath and Human Services says that if I implement e-patient records, I must implement reasonable safeguards to protect patient data.  The implication is that if I make a mistake, I could be forced to pay money.   Why should I expose my business to punishment by innovative privacy advocates like the Connecticut Attorney General?  If a hacker invades or breaks into my e-records, an aggressive consumer advocate, like a plaintiff lawyer, might find a novel way to hold me liable.  I'm better off with paper.  If someone abuses my old-fashioned paper records, there is unlikely to be an audit trail of the incident (i.e., a smoking gun electronic log showing that the wrong person opened the file).  Furthermore, the compromise of paper records is less sexy and newsworthy than the hacking of electronic records.  Consumer watchdogs like the Connecticut AG are less likely to make a big deal out of a garden-variety story about an unauthorized person looking at paper records in a manila file folder."  The federal government has not yet proposed measures for protecting the security of PHRs.  Ben Worthen, "New Epidemic Fears:  Hackers," Wall Street Journal, Aug. 4, 2009.

–Benjamin Wright

Mr. Wright teaches computer investigation law at the SANS Institute.

Payment Card Issuers Over-reacted to TJX

Federal Trade Commission Misunderstands Card Data Privacy.

Rethink PCI Law.

The TJX credit card data break-in is reputed to be the largest in history. On the heels of the incident, many credit card issuers replaced cards believed to be compromised. To replace cards is expensive (not to mention disruptive to consumers), and many card issuers demanded, through lawsuits and otherwise, that TJX reimburse them. December 2007 TJX settled one class action lawsuit with issuers of affected VISA cards, agreeing to pay $41 million. Dow Jones Newswires, "TJX Gets Over 95% Acceptance Of VISA Settlement Agreement," December 20, 2007. May 2008 TJX said it had support for settlement with Mastercard issuers for $24 million.

The Federal Trade Commission concluded that TJX had maintained inadequate controls to protect credit card data and had therefore committed unfair trade practices. Consequently, the Commission has punished TJX by requiring it to adopt new controls (in the vein of the PCI - Payment Card Industry Data Security Standard) and file extensive paperwork with the government for years to show that the controls are in place.

That's the background. Now think about this . . . August 2008 federal authorities announced indictments of the ring of criminals at the heart of the TJX heist. The ring had stolen data from both TJX and many other retailers. According to authorities, the criminals used stolen data to withdraw tens of thousands of dollars at a time from automated teller machines. Their ATM withdrawals added up to hundreds of thousands of dollars.

Further, last year six people were convicted in Florida for using data, apparently stolen from TJX, to buy gift cards and goods worth AT LEAST ONE MILLION DOLLARS. Jon Swartz, "11 Charged in TJX Identity Theft," USA Today, August 6, 2008.

Do you see an imbalance here? TJX settles with VISA & Mastercard issuers for $65 million, whereas the actual reported fraud is only a tiny fraction of that amount. Further, when card issuers canceled all those cards, they alarmed and inconvienced millions of cardholders to excess.