Sign up for a complimentary subscription to Today's General Counsel digital magazine.
By Peter Selvin
April 4, 2023
Peter Selvin is a partner with the Los Angeles firm of Ervin, Cohen & Jessup. He practices in the areas of commercial litigation and insurance coverage and recovery. [email protected]
Originally published in Today’s General Counsel, April 2023
Over the last several years several companies, including Marriott, Yahoo and Volkswagen, have been victimized by hackers breaking into a company’s computer network. In some cases, they have put confidential information on the internet. In others, the hackers have held the company’s information hostage through ransomware.
While companies are rightly concerned about the security of their own networks, there is another risk. Recent court cases are testing the liability of companies and their directors for data breaches suffered by their vendors or service providers.
This is not surprising. Companies often need to share confidential information with their vendors or service providers. An example is where a company outsources its payroll management to an outside vendor. In that case, the vendor will have the names, Social Security numbers and other private information of the company’s employees. If the payroll vendor suffers a data breach, this private information may be disseminated, causing harm to the company’s employees.
In such a case, it is a virtual certainty that lawsuits will not only be filed against the payroll vendor but also against the company itself. The legal claim will be principally based on negligence — the concept that the company did not take due care in selecting the vendor or monitoring the vendor’s computer network security system.
A recent case in Delaware took this a step further. In that case Laboratory Corporation of America (LCA) contracted with a vendor to assist in collecting past due accounts. The vendor suffered a data breach which resulted in the disclosure of the private health and financial information of over 10 million LCA patients. As a result, LCA was subject to a class action on behalf of a class of patients whose personal information was compromised because of the data breach.
LCA’s legal jeopardy did not end there. Following the filing of the class action suit, a shareholder of LCA brought an action against the company’s directors. In his suit, the shareholder asserted that LCA’s directors had allowed the company to provide personal healthcare and financial information to a vendor with deficient cybersecurity and data breach detection. The shareholder also asserted that the directors had failed to ensure that the vendor utilized proper cybersecurity safeguards to adequately secure patient information.
These liability risks mean that companies must not only focus on their own cybersecurity and data breach safeguards, but they must also be concerned about these safeguards in respect to their own vendors. The following are some risk-management ideas:
Liability for a data breach involving a company’s or its employees’ confidential information cannot be shifted by contract. Because a company runs the risk that it will be sued if its third-party vendor or service provider experiences a data breach, it should implement the risk management techniques described above.
Sign up for a complimentary subscription to Today's General Counsel digital magazine.
Sign up for our free daily newsletter for the latest news and business legal developments.