Tag Archives: Litigation

Northern District of Illinois Dismisses Barnes & Noble Data Breach Lawsuit

▪ Written by
Earlier this month, the United States District Court for the Northern District of Illinois entered an order dismissing with prejudice a putative class action concerning a security breach affecting PIN pad devices at numerous Barnes & Noble locations.  The lawsuit, In re Barnes & Noble Pin Pad Litigation, No. 12-cv-8617 (N.D. Ill.), was brought by consumers who had used credit and debit cards at Barnes & Noble during the time period of the breach. The operative complaint pleaded several causes of action against Barnes & Noble, including breach of implied contract and the violation [...] Read more

France adopts new regime for privacy class actions

▪ Written by
A few weeks ago, France passed the Digital Republic Act which significantly enhances French citizens’ rights to privacy by offering new avenues to exercise rights and granting new powers to the French data protection authority. A recent amendment to the Data Protection Act, adopted November 18, 2016, goes a mile farther and introduces a new type of class action for privacy-related matters. Class actions were introduced into the French Consumer Code quite recently, in 2014. Although largely inspired by the U.S.-style class action, class actions in France have a slightly different scope: [...] Read more

Supreme Court Holds Congress Cannot Confer Automatic Standing By Statute

▪ Written by
The Supreme Court has issued its much anticipated opinion in Spokeo Inc. v. Robins, No. 13-1339, 578 U.S. ___ (2016) (click here for a prior post detailing the procedural history and case background).  The Supreme Court granted certiarori in Spokeo to determine whether a bare violation of a statute – the Fair Credit Reporting Act (“FCRA”) – is sufficient to confer Article III standing, which requires that an injury be both (a) concrete and particularized and (b) actual or imminent.  Below the Ninth Circuit held that Robins’ allegation of an FCRA violation were sufficient, but the Supreme [...] Read more

FTC and Wyndham Settle Data Security Allegations

▪ Written by
On December 9, 2015, the Federal Trade Commission announced that Wyndham Worldwide Corp., Wyndham Hotel Group LLC, Wyndham Hotels and Resorts, LLC, and Wyndham Hotel Management, Inc. (“Wyndham”) had agreed to settle FTC charges that the company’s security practices unfairly exposed the payment card information of consumers to hackers in three separate data breaches between April 2008 and January 2010.  Wyndham initially challenged the FTC’s authority to regulate private companies’ cybersecurity practices under Section 5 of the FTC Act’s unfairness prong which resulted in litigation [...] Read more

FTC’s Ability to Regulate Data Security Potentially Limited in FTC v. LabMD

▪ Written by
A November 13, 2015 decision from the Federal Trade Commission’s Chief Administrative Law Judge, D. Michael Chappell, calls into question FTC enforcement in the data privacy space.  The case began when the FTC filed a complaint on August 28, 2013 after an employee of LabMD, a cancer detection laboratory, downloaded peer-to-peer (“P2P”) software that exposed patient information on the file sharing network (also known as “1718 File”). An online security firm named Tiversa found this file on a peer-to-peer file-sharing network in 2008 and used it to solicit work protecting LabMD’s data. The [...] Read more

Third Circuit Affirms FTC’s Authority to Regulate Data Security

▪ Written by
On August 24, 2015, the Third Circuit affirmed U.S. District Court Judge Esther Salas’ April 2014 ruling in FTC v. Wyndham Worldwide Corp., et al. (“Wyndham”) that the FTC has the authority to regulate private companies’ cybersecurity practices under Section 5 of the FTC Act. (Prior blog posts on this case can be found here and here).  In this highly anticipated precedential opinion, the Court decided that Wyndham’s cybersecurity practices as alleged by the FTC fit the definition of “unfair” when compared with its stated security policies.  In doing so, the Court rejected Wyndham’s [...] Read more

Target, MasterCard Settlement Allowed to Proceed

▪ Written by
The court in In re: Target Corporation Customer Data Security Breach Litigation (D. Minn. MDL No. 14-2522) today entered an order denying the plaintiffs’ motion to enjoin a settlement between MasterCard and Target stemming from the 2013 security breach of Target’s systems.  The parties had agreed that Target would pay MasterCard $19 million for damages arising out of the security breach.  As part of the agreement, MasterCard would compensate financial institutions who issued MasterCards in exchange for the financial institutions releasing their claims against Target in the MDL.  The Target [...] Read more

Third Circuit Questions FTC’s Data Security Authority

▪ Written by
On March 3, 2015, the Third Circuit heard oral argument in FTC v. Wyndham Worldwide Corp., et al. (“Wyndham”) on the issue of whether the FTC has the authority to regulate private companies’ data security under Section 5 of the FTC Act. This appeal arises out of the District Court’s holding that the unfairness prong of Section 5 provides the FTC with the authority to regulate data security in the private sector.  (Previously reported here).  In its appellate briefs and at oral argument, the FTC argued that the district court got it right, noting that the FTC Act’s legislative history [...] Read more

TD Bank NA Settles Data Breach Lawsuit with Mass. AG

▪ Written by
TD Bank North America (“TD Bank”) and the Massachusetts Attorney General announced an agreement on December 8 to end a data breach lawsuit brought against TD Bank by the Massachusetts Attorney General. The lawsuit alleged that TD Bank failed to properly protect and encrypt personal customer information contained on two server backup tapes that it lost. The suit also alleged that TD Bank did not promptly notify the Attorney General of the breach as required by Massachusetts law. The data breach in question occurred after a set of unencrypted server backup tapes containing the personal information [...] Read more

District Judge Upholds Decision Requiring Microsoft to Provide Irish Data to U.S. Investigators

▪ Written by
On July 31, Federal District Judge Loretta A. Preska (Southern District of New York) upheld the decision of a magistrate judge requiring Microsoft to turn over the contents of customer email stored in Ireland to U.S. investigators. The magistrate’s April decision was previously discussed on this blog. Federal investigators had obtained a warrant for the email content under the federal Stored Communication Act (“SCA”). Microsoft sought to quash the warrant with respect to the production of customer emails stored on a server in Dublin, Ireland, arguing that the enforcement [...] Read more