The Weekly Privacy Rewind - November 26, 2018

Class Actions

Pennsylvania Supreme Court Declares Employers Have Affirmative Duty to Protect Employee Personal Information

• According to a recent opinion by the Pennsylvania Supreme Court, "an employer has a legal duty to exercise reasonable care to safeguard its employees' sensitive personal information stored by the employer on an internet-accessible computer system."
• The putative class action stems from a 2014 data breach that exposed personal information of 62,000 employees and former employees of the University of Pittsburgh Medical Center. According to the original complaint, the data, which included names, birth dates, Social Security numbers, addresses, tax forms and bank account information, was used to file fraudulent tax returns on behalf of some of the employees.