dataBreachclaSSactionSareontheriSe
Technology Section Chairs : JohnMullen – PhelpsDunbarLLP & KurtSanger – BuchananIngersoll & RooneyPC
whatcanwedotoprotect ourclientsandourselves ? Firstandforemost , prioritizedataprotection .
Data breaches are nothing new . In fact , we ’ ve almost come to accept that they are bound to happen , and our social security numbers are likely already floating around the deep web . But recently , we are seeing more and more data breach class actions being filed . The defendants are oftentimes big , deep-pocketed corporations , but the prevalence of data breaches , combined with the desire to “ punish ” entities that suffer from such breaches , have brought on some unexpected lawsuits .
For example , in February 2024 , a class action was filed against Big Brothers Big Sisters of America , a not-for-profit organization that is much better known for its work supporting mentoring relationships than the depth of its pockets . In April 2024 , the Eastern District of New York dismissed , without prejudice , a class action lawsuit against the American Bar Association after it suffered a data breach in March 2023 .
In the last two years , class actions and government enforcement lawsuits have generated roughly $ 113 billion in settlements . 1 It ’ s no wonder , then , that the class action plaintiffs ’ bar is eager to translate data breaches into lucrative settlements . This is amplified by generative AI , which is moving quickly to streamline litigation tasks
such as discovery , class member communications , and even drafting pleadings . Indeed , many of the recently filed data breach class actions show little variations , indicating either a copy-and-paste approach , or GenAI ’ s involvement .
While plaintiffs in data breach class actions often face challenges in demonstrating injuries from the alleged data breach , securing class certification , and proving the defendants were at fault for the breach , the threat of a lengthy , expensive , and potentially imagedamaging class action continues to spur many defendants to settle — thus encouraging the filing of even more class actions .
And law firms are not immune . Most recently , in May 2024 , Gunster , Yoakley & Steward , PA was named as the defendant in a data breach class action . And over the past year , such class actions have been filed against the law firms of Smith , Gambrell & Russell International LLP , Houser LLP , and Orrick , Herrington & Sutcliffe . As lawyers , we are entrusted with a tremendous amount of personal or sensitive information , often including financial information , corporate secrets and proprietary documents , medical records , family records , and other confidential documents . A data breach compromises not only our clients ’ sensitive documents , but those of opposing parties produced in discovery .
What can we do to protect our clients and ourselves ? First and foremost , prioritize data protection . It can be easy to procrastinate on this sometimes-tedious task , especially when we are busy tending to a client ’ s emergency — which can be virtually every day . But importantly , as a result of many states ’ — including Florida ’ s — lack of specific statutes on this subject , most data breach lawsuits employ a negligence standard . By prioritizing data protection , engaging appropriate vendors , installing advanced software , running simulated phishing tests , and taking other proactive measures , we can reduce the chances ( albeit , complete prevention is improbable ) of both a data breach and a lawsuit . n
1
Duane Morris Class Action Review – 2024 : A Comprehensive Analysis of Class Action Litigation , https :// www . duanemorris . com / pressreleases / duane _ morris _ class _ action _ review _ 2024 _ comprehensive _ review _ class _ action _ litigation _ 0124 . html
Author : Ella Shenhav – Shutts & Bowen LLP
5 6 J U l - A U g 2 0 2 4 | H C B A l A W Y E R