Header graphic for print
HL Chronicle of Data Protection Privacy & Information Security News & Trends

Adam Cooke

Posts by Adam Cooke
Posted in Cybersecurity & Data Breaches, Privacy & Security Litigation

Cyber Investigations and Privilege: Court Finds Forensic Report not Covered by Work Product Doctrine

Last week, the U.S. District Court for the Eastern District of Virginia ordered Capital One to produce a forensic investigation report in multidistrict litigation arising out of the cyber incident Capital One announced in July 2019. The court found that the report was not protected by the work product doctrine because Capital One had not shown that “but for” the litigation the report would not have been prepared in substantially the same form. The opinion offers some lessons for companies entering into arrangements with forensic experts in advance of cyber events.

Posted in Consumer Privacy

COVID-19 and IT Service Provider Contracts: A Checklist for Force Majeure Events

COVID-19 has impacted organizations’ relationships with their IT service providers, who often play an important role in securing their data and systems. Under current conditions, some service providers may face challenges in performing this work. Potential non-performance has significant consequences for service providers and their clients alike. To prepare for these challenges, entities that have contracts with service providers—and service providers themselves—should carefully review their existing agreements and any force majeure-type provisions in particular. This post includes our COVID-19 service provider risk mitigation checklist.

Posted in Consumer Privacy, Privacy & Security Litigation

Court Trims FTC Complaint Asserting Deception and Unfairness Claims

Last week, the U.S. District Court for the Northern District of California dismissed three of six claims the Federal Trade Commission asserted against D-Link Systems related to its sale of routers and IP cameras and related software and services. The decision has implications for the pleading standards courts use to evaluate such claims at the motion to dismiss stage and for the FTC’s assertion of unfairness claims based on alleged likelihood of substantial consumer harm.

Posted in Cybersecurity & Data Breaches, Privacy & Security Litigation

8th Circuit Affirms Standing as Barrier in Data Breach Class Actions

The U.S. Court of Appeals for the Eighth Circuit has become the latest appellate court to enter the contested debate over Article III standing in data breach litigation. The Eighth Circuit held that 15 of 16 named plaintiffs who never alleged they had suffered identity theft or incurred fraudulent charges on their payment cards did not have standing to pursue claims based on alleged risk of future harm in the multidistrict action In re SuperValu, Inc. Customer Data Security Breach Litigation. The Eighth Circuit’s opinion comes on the heels of other decisions that found risk of future harm following a data breach sufficient to confer Article III standing on class action plaintiffs.

Posted in Privacy & Security Litigation

Supreme Court Grants Cert in Case That May Shed Light on Statutory Standing Limits in Consumer Privacy Lawsuits

Last week, the Supreme Court granted certiorari in Spokeo, Inc. v. Robins, a case that may significantly impact the ability of plaintiffs to sue in federal court based solely on an alleged infringement of statutory rights. Plaintiffs often allege violation of statutory rights in privacy cases where standing for common law causes of action has proven more difficult to demonstrate and dismissal more frequent. A ruling from Supreme Court could upend this strategy, forcing plaintiffs to allege more than just a statutory injury across all their claims.

Posted in Privacy & Security Litigation

LabMD Rulings May Shed Future Light on “Reasonable” Data Security Practices

Last week, the Administrative Law Judge handling the Federal Trade Commission’s complaint against LabMD issued a pair of rulings that will require the Bureau of Consumer Protection to testify about the information security standards on which the FTC intends to rely at trial in order to prove that LabMD’s data security practices were inadequate. The ALJ’s rulings open up inquiry into issues at the center of the debate surrounding the FTC’s authority under Section 5 of the Federal Trade Commission Act: what are the data security standards that the FTC expects companies to meet, and has the FTC given the private sector adequate advance notice of these standards?

Posted in Cybersecurity & Data Breaches, Privacy & Security Litigation

New Federal Court Decision Affirms the Standing Doctrine as a Critical Hurdle to Data Breach Actions

On Monday, a federal district court dismissed two related putative class action suits filed against Nationwide Mutual Insurance Company following a data breach at Nationwide in October 2012 that affected over 1 million individuals. The opinion shows that courts remain skeptical of plaintiffs’ ability to show any real injury from the fact that their personally identifiable information was compromised without some additional evidence of concrete harm such as identity fraud. The opinion also sheds important light on the ability of plaintiffs to overcome this standing barrier by alleging that their injury derives from the violation of a federal statute.