1E9Ct5D

V. A Brief Survey of Litigation and Enforcement Actions.In 2013, Researchers at Temple University analyzed 230 federal cases involving databreach incidents and found more than 80 causes of action used. 51Commonly seenclaims included breach of contract or implied contract, negligence, and statutory causesof action. 52New types of actions, including claims by issuing banks forced to deal withcancelling and reissuing credit and debit cards following a data breach, are also beingbrought. Shareholder derivative claims for breach of duties, waste, andmismanagement against a company’s board of directors are also gaining momentum.Moreover, the FTC and states’ attorneys general may bring their own enforcementactions where appropriate following a data breach. We discuss below how a companymay face litigation and enforcement actions on various fronts following a data breach:A. Consumer Class Actions and Standing.One of the major obstacles for consumer class actions following a data breach—alongwith overcoming differences in state laws—is pleading and proving injury necessary forstanding. 53Although the general trend has historically been for courts to dismissconsumers’ claims absent evidence of actual harm (e.g., identity theft or fraud), some51 Sasha Romanosky, David A. Hoffman, Alessandro Acquisti, Empirical Analysis of Data BreachLitigation, Temple University Legal Studies Research Paper No. 2012-30 (April 6, 2013).52 See Maxfield and Latham article at 32, cited supra at note 49.53 See Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1143 (2013) (holding that plaintiffs “cannotmanufacture standing merely by inflicting harm on themselves based on their fears of hypotheticalfuture harm that is not certainly impending.”); see also Galaria v. Nationwide Mutual Ins. Co., No. 2:13-cv-118, 2014 U.S. Dist. LEXIS 23798 (S.D. Ohio Feb. 10, 2014) (dismissing plaintiffs’ claims for lack ofstanding).March 6, 2015 27 © 3-6-2015 ALFA International Business Litigation P.G.