On January 18, 2011, Vermont Attorney General William Sorrell announced a settlement with HealthNet, Inc. and Health Net of the Northeast, Inc. over allegations that the company violated the state’s data breach notification law when the company waited over six months to notify state residents of the loss of a portable hard drive that contained their unencrypted personal information. The Attorney General’s settlement is an important reminder that the unpleasantness of a security breach is only compounded by a poor response. If you have not already done so, the time for establishing a comprehensive breach response plan is now!
Data Breaches
5 Strategies For Avoiding Wiki Situations
By Kristen J. Mathews on
Want to know how you can protect your company from Wikileaks debacles the likes of which have been faced by the U.S. government as well as private companies. Check out this recent article by Proskauer’s Dan Winslow and Kristen Mathews.
Proskauer Litigators Notch Another Victory for The Bank of New York Mellon in “Identity Exposure” Lawsuit
By Proskauer Rose on
On June 25, 2010, Judge Richard Berman of the U.S. District Court of the Southern District of New York granted summary judgment to The Bank of New York Mellon Corp. in Hammond v. The Bank of New York Mellon Corp., dismissing in its entirety a putative class action lawsuit arising from the loss of backup tapes containing personal information in the spring of 2008. Judge Berman’s dismissal represents yet another in a long, and still growing, line of cases standing for the proposition that without more, the mere exposure of personal information is not an adequate basis for a lawsuit.
…
Geez Ruiz: 9th Circuit (Probably) Ends Long-standing Data Breach Litigation Against Gap, Inc. and Others
By Proskauer Rose on
On May 28, 2010, in an unpublished decision, the U.S. Court of Appeals for the Ninth Circuit affirmed the California district court’s dismissal of a class action lawsuit against retailer Gap, Inc. because, among other things, the plaintiff failed to show that the loss of his personal information harmed him in a legally cognizable way. The Ninth Circuit’s decision echoes those issued in every “identity exposure” lawsuit to date: an increased risk of identity theft does not a lawsuit make!
…
Heartland Payment Systems Enters into its Third Settlement Agreement Arising from 2008 Data Breach
By Proskauer Rose on
Heartland Payment Systems, Inc. reached a settlement with MasterCard on May 19, 2010 for losses resulting from Heartland’s massive 2008 data security breach.
…
It’s Not Too Late to Come to the Party: Mississippi Joins 45 Other States by Enacting a Security Breach Notification Law
By Andrew Hoffman on
Mississippi’s new law is consistent with other states’ security breach notification laws in many respects, but deviates in at least one potentially significant way.
…
Lack of Standing Argument Wins Against Supposed Data Breach Victim
By Scott Carpenter on
data breach, class action, injury-in-fact, speculative, standing, Pisciotta, increased risk of harm
…
2009 Ponemon Institute “Cost of a Data Breach” Study Released
By Natalie Newman on
This past week, the Ponemon Institute announced their publication of the results of their fifth annual study on the costs of data breaches for U.S.-based companies. The study was sponsored by the PGP Corporation. A similar report for U.K.-based companies was also released. This year’s report, entitled 2009 Annual Study: Cost of a Data Breach, displays the results of the Ponemon Institute’s research of data breach incidents occurring in 2009.
Overall, as with previous years, the study found that U.S. organizations continue to experience increased costs associated with the data breaches they experience.
…