How to Win (or Lose) Your Data Breach Class Action

Size: px

Start display at page:

Download "How to Win (or Lose) Your Data Breach Class Action"

Erin Cox
8 years ago
Views:

1 Jay Edelson, Esq. Edelson PC Hon. James Holderman U.S. District Court, Northern District of Illinois Drew Sorrell, Esq. Lowndes, Drosdick, Doster, Kantor & Reed Kenneth Withers, Esq. The Sedona Conference How to Win (or Lose) Your Data Breach Class Action

Lowndes, Drosdick, Doster, Kantor & Reed Kenneth Withers, Esq.

2 In re MSTrust Bank Mississippi Trust Bank (MSTrust) is in growth mode 4 data security technicians and 2 regulatory compliance officers in Oxford, MS Acquired NOCred credit card division in full and part-time employees in Orlando, FL

compliance officers in Oxford, MS Acquired NOCred credit

3 In re MSTrust Bank Recommendations: Hire full-time data security and compliance employees Change passwords every 90 days Results: No new hires Passwords written in notebooks, on Post-it notes June 2014 air conditioning system failure Facility shut for repairs for seven days

hires Passwords written in notebooks, on Post-it notes June 2014 air

4 In re MSTrust Bank Fall 2014: NOCred employee Googles home address Finds personally identifying information on South Korean file sharing site Finds PII related to fellow employees, unknown individuals Attempts to notify supervisor Alerts national credit reporting service

sharing site Finds PII related to fellow employees, unknown

5 In re MSTrust Bank Supervisor reads report three days later, forwards to Oxford general box Security officers receives two days later, contacts Counsel All passwords immediately changed company-wide Cybersecurity forensics called in Crisis management firm called in

later, contacts Counsel All passwords immediately changed

6 In re MSTrust Bank Forensic investigation establishes: Unknown individuals are credit card customers Breach coincident with air conditioning repair 48 days from employee s detection of breach to first notification 52 days to federal class actions filed by credit card customer in Chicago and employee in Orlando

days from employee s detection of breach to first notification 52 days to

7 Plaintiffs Causes of Action Consumer Class (seeking damages and injunctive relief): 1. Breach of contract for failure to follow reasonable security protocols 2. Negligence in failing to prevent the breach and failing to timely notify of the breach Employee Class (seeking damages and injunctive relief) 1. Breach of fiduciary duty in failing to prevent the breach and failing to notify 2. Negligence in failing to prevent the breach and failing to notify of the breach

Negligence in failing to prevent the breach and failing to timely notify of the breach Employee Class (seeking

8 Rule 16 Conference Federal Rule of Civil Procedure 16: Pretrial Conferences; Scheduling; Management (c)(2) Matters for Consideration. At any pretrial conference, the court may consider and take appropriate action on the following matters: (A) formulating and simplifying the issues, and eliminating frivolous claims or defenses; (B) amending the pleadings if necessary or desirable; (C) obtaining admissions and stipulations about facts and documents to avoid unnecessary proof, and ruling in advance on the admissibility of evidence; (D) avoiding unnecessary proof and cumulative evidence, and limiting the use of testimony under Federal Rule of Evidence 702; (E) determining the appropriateness and timing of summary adjudication under Rule 56; (F) controlling and scheduling discovery, including orders affecting disclosures and discovery under Rule 26 and Rules 29 through 37; (G) identifying witnesses and documents, scheduling the filing and exchange of any pretrial briefs, and setting dates for further conferences and for trial; [...] (L) adopting special procedures for managing potentially difficult or protracted actions that may involve complex issues, multiple parties, difficult legal questions, or unusual proof problems; [...] (P) facilitating in other ways the just, speedy, and inexpensive disposition of the action.

amending the pleadings if necessary or desirable; (C) obtaining admissions and stipulations about facts and documents to avoid unnecessary proof, and ruling in advance on the admissibility of

9 Rule 16 Conference

10 Questions and Comments What is the role of the Electronic Records Management (ERM) professional? In preventing data breach... In responding to a data breach incident... In responding to a threat of litigation... In responding to discovery... As potential witness...

.. In responding to a data breach incident.

11 Jay Edelson, Esq. Edelson PC Hon. James Holderman U.S. District Court, Northern District of Illinois Drew Sorrell, Esq. Lowndes, Drosdick, Doster, Kantor & Reed Kenneth Withers, Esq. The Sedona Conference How to Win (or Lose) Your Data Breach Class Action

IN THE SUPERIOR COURT FOR THE STATE OF ALASKA THIRD JUDICIAL DISTRICT AT ANCHORAGE

IN THE SUPERIOR COURT FOR THE STATE OF ALASKA THIRD JUDICIAL DISTRICT AT ANCHORAGE In the Matter of a ) Uniform Pretrial Order ) ) Administrative Order 3AO-03-04 (Amended) UNIFORM PRETRIAL ORDER In order