What are my rights?
That is what a majority of people want to know when they receive a letter in the mail from their bank, credit card company, hospital, etc., that states their personally identifiable information ("PII") has been compromised. Most likely, the answer is – NOTHING! Oh, you can take the 1 year credit protection that the company has offered, but what happens after that one year? Does your social security number magically change? According to the Ponemon Institute, only about 7% of people actually eperience some sort of actual, or direct, harm as a result of a data breach. So, is data governance something we should really care about?
Until very recently, the Plaintiffs’ Bar has done a poor job of identifying what the true issues are, as they relate to data governance protection and breach, and defense counsel has been extremely effective in placing impossible hurdles for the plaintiffs’ to climb. However, a crack in those defenses may start to be appearing. No, we have not arrived at those days when people are able to prosecute civilly a company/government entity that has improperly managed our data, but we are getting closer.
A case out of the U.S. District Court, for the District of Maine, called In Re Hannaford Brothers, Co., was recently handed down, and while the results were the same – plaintiff’s, those who had their PII hacked into, lost – the legal arguments by plaintiff’s counsel show that they might actually start to make some headway in this area of precedents. How can this be? The judge in the case "punted" (this is a very technical term) the issue when he could. The art of "punting" occurs when one side makes a well-reasoned, legally-based, and practical argument to the Court, but the precedent does not quite cover the argument. The judge knows the side making the argument is right, but does not want to be "that" person who opens the floodgates of other litigation.
My hat is off to the attorney’s who prosecuted this case on behalf of the Plaintiff’s. It shows that there is some headway being made, but that there is still a long way to go. Business owners should take heed the importance of a data governance program NOW! The winds are starting to shift, and changing sails in the middle of a storm, while not impossible, is extremely difficult.