Several former Yahoo! Inc. executives recently settled a
derivative action for US$29-million, following data breaches from
2013 and 2014 that compromised approximately three billion
accounts. These data breaches were the biggest known intrusions of
a single company's computer network at that time. Given the
absence of Canadian case law on director liability in the context
of a data breach, prudent directors may gain an advantage by
reviewing U.S. case law and adapting their strategy and approach to
data privacy and security.
LESSONS LEARNED FROM YAHOO'S DATA BREACH
In February 2017, Yahoo! Inc.'s shareholders filed a
shareholder derivative action in the United States District Court
for the Northern District of California against Yahoo! Inc.'s
board and senior managers for their handling of the 2013 and 2014
data breaches. Allegations consisted of Yahoo! Inc. officials
breaching their fiduciary duties by failing to protect Yahoo!
Inc.'s data, failing to implement
