Children's Online Privacy Protection Act

IntroductionWe live in a world controlled more than ever before by the cybersphere. The amount of data stored on networks has increased exponentially in recent years,1 changing the way people interact and conduct business.2 Much of this data is personal information, which consumers must provide for even basic transactions.3 As a result, "the intimate details of our dresses, birth dates, Security numbers, and credit card and bank account information-are now stored in online databases.4Frequently exchanging personal information can lead to significant consequences.5 As the amount of online data has increased, so have instances of computer hacking and theft of consumers' personal information.6 Hacking incidents aside, breaches often follow simple mistakes by employees.7 As a result, breaches now occur several times a week.8 Indeed, a recent report by 1. an organization that compiles information about confirmed data breaches showed that the organization tracked a record number of breaches in 2014-18 percent higher than the previous record, and an increase of more than 27 percent from 2013.9 Data breaches have thus risen to unprecedented levels during "the [d]ecade of the [d]ata [b]reach."10In light of these broad risks, companies have had to fundamentally reorient their approaches to data security. Some have done just that, increasing investments in security technology or creating data-breach response plans.11 But two factors reduce the impact of those changes on data breaches. First, failure to frequently review and update data-breach response plans often renders them ineffective.12 Second, new technologies present new opportunities for data breaches, and companies may not be able to properly account for these developments.13 Moreover, many other businesses still remain in denial about the threat of data breaches, either failing to implement any data-security changes or making only nominal modifications.14Customers suffer enormous harms because of data breaches, including increased risk of identity theft.15 They have a limited ability, however, to seek redress for these injuries or to compel businesses to provide better data security. There are no unified federal data-security regulations, so state breach-notification statutes are the primary means for holding businesses accountable for their role in the breaches.16 Yet differences between the state requirements create a "patchwork" that varies by state,17 making results unpredictable and inconsistent. This statutory scheme thus provides limited protection for consumers in the wake of data breaches.As a result, consumers have increasingly turned to litigation against the companies responsible for protecting their information-from retail stores to data-storage companies-to address their injuries. These cases are usually class actions since individual consumers incur only small monetary damages.18 Consumers may assert common law claims like negligence or breach of contract, or claims that arise under consumer-protection statutes.19 Those claims are based on injuries related to consumers' increased risk of identity theft, with damages including costs for credit monitoring purchased to guard against identity theft.20Courts have disagreed on whether increased risk of identity theft is an injury-in-fact sufficient to create standing, and the Supreme Court has not yet addressed the issue. Departing from an initial trend in district courts to deny standing based on increased risk, the Seventh and Ninth Circuits-in Pisciotta v. Old National Bancorp21 and Krottner v. Starbucks Corp.,22 respectively-recognized standing based on increased risk.23 The Third Circuit rejected that approach in Reilly v. Ceridian Corp.,24 which the Supreme Court appeared to indirectly approve through its discussion of future harm in Clapper v. Amnesty International USA.25 Yet Clapper's applicability is unclear, given its different factual context.26 Indeed, district courts apply Clapper to data-breach cases inconsistently,27 clouding the future status of increased risk standing. …

/pdf/a-day-in-court-for-data-breach-plaintiffs-preserving-3jl0of5ua1.pdf

A Day in Court for Data Breach Plaintiffs: Preserving Standing Based on Increased Risk of Identity Theft After Clapper v. Amnesty International USA

/pdf/giving-consumers-a-leg-to-stand-on-finding-plaintiffs-a-hgl1gm3ccd.pdf

Patricia Cave

Papers

Giving Consumers a Leg to Stand on: Finding Plaintiffs a Legislative Solution to the Barrier from Federal Courts in Data Security Breach Suits