It’s been said that bad facts make bad law. If that’s true then those who defend class action data breach cases better buckle down for some stormy seas. The facts surrounding the new Equifax breach couldn’t get much worse.

Equifax knew of the breach months in advance of when it announced it. It failed to take even the most simple precautions to prevent it. One key employee’s user name was reportedly admin. His password: you guessed it, admin. And some are claiming the breach was caused by the failure to keep the Equifax software up to date.

And the information held by Equifax was substantial. Names, addresses, health info, credit info, social security info. The most sensitive and valuable stuff. Not to mention the size: 140 million records were stolen.

And the fact that chief officers sold substantial stock in the company right before the breach certainly doesn’t help. Oh and by the way, if you go to the Equifax to check on your personal situation, you will be directed to a page where you can buy protection from…wait for it… Equifax.

All conduct that has received publicity. All conduct which could and will raise the ire of a judge looking at the case and deciding whether to allow it to proceed against Equifax as a class action.

The big issues is damage. Or better put, the lack thereof. In most data breach cases, its hard to find the more concrete, real damages that most courts are used to seeing in other kinds of cases

By way of background, Courts have been struggling with how to deal with data breach cases. The big issues is damage. Or better put, the lack thereof. In most data breach cases, its hard to find the more concrete, real damages that most courts are used to seeing in other kinds of cases. This makes determining whether standing for constitutional purposes exists a harder question for Courts to deal with.

Ever since the Supreme Court decided Clapper if not before, standing could be satisfied by a showing of actual damages or the “imminent threat” of actual damage. It is one the latter point that the federal circuits have split—some are more liberal and some more conservative. What is an imminent threat of harm when electronic records are stolen but not immediately used for fraud? Do the electronic records themselves and the resulting loss of privacy have value apart from any real use of them?

The plaintiffs argument is that we must force companies to be responsible when they put private records at risk. That privacy is a fundamental right. That its worth something. And that the mere theft of records by the bad guys itself shows the imminent harm—you wouldn’t steal the car keys if you weren’t going to drive the car.

The defense says that data breaches are inevitable and really can’t be stopped. How can you hold a company accountable for something that can’t be prevented? And not all hacks result in financial fraud or real damage. Indeed, so far none of the stolen Equifax information has appeared on hacker forums which could suggest that the breach may not be financially motivated.

And as the data breaches mount, as I recently wrote, more and more Courts seem willing to side with those whose personal information has been purloined even if its not used. And certainly, the more heinous the conduct, the more likely Courts will allow actions to proceed: it just doesn’t seem fair or right that a case against an entities like Equifax should simply be dismissed and that they not be called on to account for their conduct.

the more heinous the conduct, the more likely Courts will allow actions to proceed: it just doesn’t seem fair or right that a case against an entities like Equifax should simply be dismissed and that they not be called on to account for their conduct.

So the pressure on the judiciary, even federal judges appoint for life, will be extraordinary. Can you imagine the news headlines if claims against Equifax are dismissed? The editorial comment? The backlash?

So for all these reasons, this is a situation where bad facts may result in a decision that wouldn’t otherwise be made. Once again, the judiciary will be called upon to make the square peg of technology and what it can do fit into the round hole of existing precedent, even though it doesn’t fit very well. And the solution is not obvious since unlike most disrupters, the bind of precedence it particularly tight on judges and lawyers, making a more creative resolution–perhaps one that stops short of full blown standing but recognizes the potential risk of harm– hard to implement.

Photo Attribution: GotCredit via Flickr.

What  do we call (what I shudder to mention as) “non lawyers”?

One of the interesting by products of the increased use of technology, collaboration and disruption is the panoply of business professionals now serving the legal profession from MBA’s, marketing experts, IT folks and innovators. These professionals and others play an integral role in and for many lawyers either as employees or outsourced resources.

Given the innovation and creativity now required to succeed, these folks will be even more valuable in the future.

Ahh but notice I didn’t use the dreaded term “non lawyers” or the slightly less offensive term “staff” in describing these folks.

Continue Reading So What’s In A Name, Anyway?

NetDocuments, the popular web-based document and email management service and premier cloud storage platform, may be sitting on a hidden treasure. I chatted with Leonard Johnson, NetDocuments Product Director, over drinks at the recent International Law Technology Association Conference in Las Vegas. We had planned to talk about NetDocuments’ recent product announcements (I was covering the Conference as a lawyer but also as a contributor to the Lawyerist. But Johnson said something that was intriguing: due to its popularity, NetDocuments is sitting on a ton of unstructured data from emails to memos to pleadings and briefs to all sorts of contracts and formal documents. Continue Reading NetDocuments and Standard Oil

It was on a dreary night of November that I beheld the accomplishment of my toils. … It was already one in the morning; the rain pattered dismally against the panes, and my candle was nearly burnt out, when, by the glimmer of the half-extinguished light, I saw the dull yellow eye of the creature open; it breathed hard, and a convulsive motion agitated its limbs.

Today’s the birthday of Frankenstein. Sort of. It’s actually the birthday of Mary Wollstonecraft Shelley, the creator of creature which is at the center of the story.(In an interesting twist of fate, in the book, it’s is the creator who is actually named Frankestein, not the creature). For those of you who never read the book (I didn’t until recently), it’s the story of the creation of a being and the torment of both the creator and the created as a result. Once he created the being, the creator became frightened and repulsed, not understanding what he had done and what the impact might be. He fled, thus setting both creature and creator on a long bad journey that doesn’t end well for either.

Its often been cited as symbolic of the struggle with and dangers of technology although its really less about that than the struggle of the creator/created. But I guess in a way that struggle is similar to the struggles that we, as a society and as lawyers, in particular, are having with the technology we have created and are creating. We fear it, we fear its impact, we hate it and are repulsed by it. We love it.

“AI is a fundamental existential risk for human civilization, and I don’t think people fully appreciate that”. Elon Musk

Somewhat like the creator in the book, Elon Musk, who himself is responsible for technogy in electric cars and space rockets is sounding the alarm about AI saying, “I think people should be really concerned about it,” Musk said. “I keep sounding the alarm bell.”

Similar fears are echoed by Stephen Hawking who says bluntly, “The development of full artificial intelligence could spell the end of the human race”. Ironically, Hawking is using a new system developed by Intel to speak that’s based on program that learns how the professor thinks and suggests the words he might want to use next. In other words, AI.

Technology and AI. We fear it. We hate it. We love it.

And this love hate relationship is even more evident in the legal profession. Some lawyers treat technology like Frankenstein. I don’t need it, I don’t want it, I don’t understand  it. In other words, I fear it and I ain’t going to learn about it. Some lawyers-often more experienced ones-are so empathic about this that they proudly and publicly brag to everyone their lack of knowledge. As if being a Neathandral is impressive to clients and others. (P.S. It’s not.).

Perhaps its no wonder we have this love-hate relationship with technology: we generally confuse the creator (the Frankenstein of the book) with the created (which is generally called and thought of as “Frankenstein”). The same is true of technology-we create it and then damn the very thing we had created confusing what we are with what we have created. Ruled by fear and remorse, Frankenstein’s creator fled once he created his “creature” without considering what his fear and ignorance would cost in the end. Or what good could come from his creation.

The technology genie (or, if you prefer, the technology “Frankenstein”) is already out of the bottle. Its been created and will continue to develop. As a profession, we can’t flee it or ignore it. We can only embrace it.

Photo Attribution

Photo 1: Insomnia Cured Here via Flickr

Photo 2: IowaPolitics.com via Flickr