Talk about adding insult to injury! After Schletter Group, a worldwide manufacturer with headquarters in North Carolina, fell for a phishing scam when it sent its employees’ W-2 information in response to a phony email, it was sued by its employees for invasion of privacy and other tort claims. The employees claimed the company ignored the risks identified in a 2015 FBI warning and a 2016 news article about the scam and did not take appropriate steps to protect its employees’ private data. While the company initially offered credit monitoring services, the employees sought additional remedies, including monetary damages. Although the company sought to dismiss the employees’ claims on the basis that the employer had no intent to make the disclosure, the company’s motion failed. The court ruled, at least at the early stages, that the company’s arguments that it did not intentionally disclose its employees’ data were not enough to toss the suit out of court. The court accepted the employees’ argument that this was a disclosure and not a breach and therefore, the element of intent was satisfied at the pleading stage.
Savvy employer takeaways: Encrypt employee data, place strict limits on who has the ability to disclose it, train employees on the risks of cyber scams, and pay attention to FBI and news media warnings.
For more information, including news, updates and links to important information pertaining to legal developments that affect businesses ranging from cyber security liability arising from electronically-stored information to evolving issues with employees, subscribe to my blog, or follow me on Twitter @AdamGersh.
When a business experience’s a data breach, after calling the CIO, its second call is going to be to its counsel, as it should be. Inevitably the business wants to know two things: what have you done to protect me from this exposure and what is my total exposure. Counsel better be prepared with a good answer to both, and I do not mean the standard lawyer response; “it depends.”
First, Counsel should have instituted policies and procedures to mitigate this exposure and should be in a position to reassure the victimized business. These policies include: (i) retaining only the most essential customer/employee information to minimize the risk of exposure; (ii) encrypting data; (iii) using outside vendors who are insured and can provide some cover; (iv) instituting policies to limit employee’s access to confidential information; and (v) instituting state-of-the-art data protection procedures. If counsel has done this, counsel can paint a picture of exposure that is favorable and limited.
Second, counsel must assess and, even more importantly, limit the total exposure. This means analyzing the type of data compromised and taking the appropriate steps to report the breach. Were customer account numbers stolen? If so, and the business is not a bank, the effect of the breach may be minimal and manageable. Did the hackers access highly confidential information like social security numbers, health data, trade secrets, sales data, bank account/credit card numbers, or other personal identifiers? If so, the business needs to act accordingly. Is the data from foreign entities? If so, counsel needs to have a plan to address foreign compliance.
Of course, unless you are a lawyer practicing in this area, you may not know the answers or solutions off the top of your head, but, at minimum you need to know the questions to ask:
- What type of data was compromised?
- How many accounts/people are effected?
- Is the data in a form that it cannot be readily accessed (e.g., encrypted)?
- What is the source of the data?
- What states’ and/or countries’ laws might apply?
Questions? Let me know.