Fourth Circuit Rules Omission Of Marriott's Data Vulnerabilities Not Actionable Because Challenged Statements Were Not False When Made

Key Points

• Fourth Circuit points to SEC guidance on "less is more" approach to cybersecurity disclosures, while finding such disclosures did not violate federal securities laws.
• Omissions of data vulnerabilities were not actionable because the challenged statements were not false when made.
• Although investors argued statements about the "importance" of data security to Marriott were false and misleading, the statements were not actionable because the Court held that Marriott did not "assign a quality to Marriott's cybersecurity that it did not have."
• Marriott's "sweeping caveats" regarding cybersecurity risks ensured no investor could be misled regarding the risks outlined.