The Storm of Data Security Class Actions Will Only Intensify

In a Q&A interview conducted by Steve Lasky, editorial director at SecurityInfoWatch, attorney Darren Craig explains that the evolving regulatory landscape, along with greater challenges for data security officials, are contributing to a profusion of data security class actions. Craig is a partner at the law firm Frost Brown Todd.

Another factor is greater consumer awareness of privacy rights and more readiness to pursue data security class actions and related litigation. Privacy litigation can result in some very large settlements, the most recent being Apple’s agreement to pay $95 million in a proposed class-action in Lopez v. Apple, Inc., in the Northern District of California. In that case, plaintiffs alleged the company’s voice-responsive assistant “Siri” was essentially eavesdropping on users without their consent.

Craig notes that that was not the largest settlement in this kind of litigation. That distinction goes to a case brought by the Texas Attorney General, who alleged that Meta was collecting biometric data violating a Texas statute. The settlement was for $1.4 billion.

Other factors: The amount of data available to companies and cybercriminals has increased dramatically. Even without being hacked, companies may be subject to allegations that they are profiting by using customer data without consent.

Craig lists a number of actionable steps companies can take to mitigate their risks, including:

• Following industry standards, such as those from the National Institute of Standards and Technology (NIST)
• Conducting frequent security audits
• Training employees and conducting simulation exercises
• Assessing the data security, breach notification standards, and insurance requirements of your third-party vendors.