U.S. City Suits: The Next Frontier Of Data Breach Actions

This article by privacy & cybersecurity partner Michelle Visser, counsel David Cohen, and associates Rebecca Harlow and Tom Wakefield was published by The New York Law Journal on February 21, 2018.

For over a decade, companies that have suffered data-security breaches have faced claims asserted by a dizzying array of adversaries, from the Federal Trade Commission and other federal agencies to state attorneys general to private plaintiffs such as consumers, employees, shareholders, and financial institutions. As if that were not enough, in late 2017 a new type of claimant has come to the fore: municipalities. Who are these new city plaintiffs, how do they fit into the existing landscape of data-breach litigation, and what can companies do to protect against the claims they bring? This article will de-mystify the new wave of city suits over data breaches and highlight some ways that organizations may be able to reduce their exposure to such suits.