1E9Ct5D

punishing companies that do not secure consumers’ credit- and debit-cardinformation.” 61Clearly, the decision expands Target’s liability by hundreds of millions ofdollars and is an important decision for companies facing data breaches.C. Shareholder Lawsuits Give Plaintiffs Another Option.The Target data breach further resulted in derivative suits against Target’s directors andofficers by shareholders on behalf of the company. The derivative suits allege breach offiduciary duty, breach of the duties of loyalty and care, corporate waste, grossmismanagement, and abuse of control. Similarly, shareholders of Wyndham WorldwideHotels brought a derivative action against Wyndham’s board of directors following adata breach. 62As such, companies and their board members should be aware ofpotential shareholder derivative suits following a data breach incident.D. State Enforcement Actions: Timely and Adequate Notice.Regulatory enforcement is often triggered by mandatory breach notificationrequirements, and regulators will look to see whether the company provided timely andadequate notice following a breach. For example, in early 2014, Kaiser FoundationHealth Plan, Inc. agreed to pay the California Attorney General $150,000 to settleclaims that Kaiser’s notification to California residents regarding a breach of theirpersonal information was unreasonably delayed because Kaiser failed to make any61 Id.62 Palkon v. Holmes, No. 2:14-cv-01234-SRC-CLW (D.N.J. Oct. 20, 2014) (dismissing case for lack ofevidence that board’s refusal to bring suit constituted bad faith).March 6, 2015 31 © 3-6-2015 ALFA International Business Litigation P.G.