As we head into the new week, here’s a quick summary of major data security developments from around the country.
Aetna Hit With Second “Envelope” Lawsuit
Aetna Inc. is now facing a second lawsuit over the disclosure of HIV-related prescription information that was “clearly visible” through a transparent window on envelopes sent to 12,000 policyholders in late July.
The most recent lawsuit – filed in Los Angeles Superior Court – claims that Aetna’s “utter failure to protect and safeguard” protected healthcare information (PHI) violated both state and federal law. The 22-page putative class action complaint was brought on behalf of an unidentified Los Angeles resident, referred to only as “S.A.” in the complaint, together with other California policyholders whose PHI was allegedly exposed in the incident.
“Aetna was privy, came into possession [of] and maintained plaintiff’s PHI, of which Aetna has a legal duty to ensure the confidentiality and security,” the complaint charged.
The complaint named Aetna, its California healthcare plan and John Does 1-10 as defendants.
Earlier last week, a similar putative class action was filed in Pennsylvania over the same mailing to policyholders. In the Pennsylvania lawsuit, a 52-year-old man claimed his sister learned that he was taking HIV medication after picking up the mail and seeing the prescription information through the envelope window.
The mailing was apparently made by one of Aetna’s fulfillment vendors. The Pennsylvania lawsuit also named the unidentified vendor as a defendant.
We blogged last week about the Aetna disclosures and the first lawsuit here and here.
Yahoo! Must Face Multi-District Data Breach Claims
And in the largest data breach reported in U.S. history which affected 1.5 billion user accounts, Yahoo! Inc. must answer a consolidated class action complaint in federal district court in San Jose.
In a 93-page ruling, U.S. District Judge Lucy H. Koh refused to dismiss the lawsuit and ruled that Yahoo users had standing to pursue claims against the Internet service provider based on their allegations of heightened identity theft risk and loss of value of their personal information.
“Plaintiffs alleged that, as a result of defendants’ law data security practices and the data breaches, hackers were able to continually access plaintiffs’ Yahoo email accounts and the sensitive information contained within plaintiffs’ Yahoo email accounts,” said Judge Koh. Accepting the allegations as true at the pleading stage, the judge held that “plaintiffs have sufficiently alleged a plausible chain of events that link defendants’ alleged misconduct with the injuries alleged ….”
The court let stand the claims against Yahoo! for breach of contract, breach of the covenant of good faith and fair dealing and for violations of California law. Additional claims were dismissed by the court with permission to cure pleading deficiencies in an amended complaint.
The lawsuit stems from Yahoo’s disclosures last year that cybercriminals had hacked into its systems in three separate incidents, compromising user information for 1.5 billion accounts.
8th Circuit Issues Split Decision in SuperValu Data Breach
Finally, another federal appellate court has weighed in on Article III standing in data breach cases. The U.S. Court of Appeals for the Eighth Circuit issued two rulings on the issue last week.
In its most recent post-Spokeo ruling, the Eighth Circuit reversed, in part, a lower court ruling that dismissed a consolidated class action complaint against SuperValu Inc., the retail grocery store group. The court held that a single instance of credit card fraud was sufficient to confer standing – although the court did not discuss whether reimbursement for the fraudulent charge should be a factor in the standing calculus.
“[A]llegations of misuse of [credit card information] were sufficient to demonstrate that he had standing; that is all that is required for the court to have subject matter jurisdiction over this action,” wrote the court.
SuperValu suffered two data breaches in 2014 in which customer information was stolen. Customers who shopped at the affected stores – in Missouri, Illinois, Maryland, Pennsylvania, Delaware, Idaho and New Jersey – brought putative class actions which were eventually consolidated in a multi-district litigation in Minnesota. The consolidated complaint, brought on behalf of sixteen plaintiffs, alleges that the hackers penetrated the SuperValu network and stole customer information including credit card numbers, card verification value codes and personal identification numbers because the grocery chain “failed to take adequate measures” to protect customer information.
The complaint alleged that each plaintiff “spent time determining if [his or her] card was compromised’ by reviewing information released about the breaches and the impacted locations and monitoring account information to guard against potential fraud.”
But one of the plaintiffs, David Holmes, alleged that his credit card information had been compromised. “Shortly after the data breach was announced, ‘Holmes noticed a fraudulent charge on his credit card statement and immediately cancelled his credit card, which took two weeks to replace.’”
The court held that Holmes’ claim of a fraudulent charge sufficed to establish Article III standing but noted that whether the allegations “are sufficient to state a cause of action … presents a different and distinct matter from standing.
The court affirmed the dismissal of the lawsuit with respect to the other 15 plaintiffs, holding that their allegations of enhanced risk were insufficient to get past the standing requirement.
And earlier last week, the Eighth Circuit handed down another data breach ruling, Kuhns v. Scottrade, and ruled that, although the plaintiff had established standing to pursue a claim against Scottrade, Inc., the regional brokerage firm, resulting from a data breach that occurred in 2013, the customer failed to sufficiently allege that the brokerage firm breached its contractual obligations and affirmed dismissal of the case. See our blog post on that ruling here.
The Eighth Circuit’s rulings in SuperValu and Kuhns came shortly after the U.S. Court of Appeals for the Ninth Circuit’s second look at Robins v. Spokeo, Inc., No. 11-56843 (9th Cir. Aug. 15 2017). On remand from the United States Supreme Court, the Ninth Circuit was instructed to determine whether an alleged violation of the Fair Credit Reporting Act (FCRA) constituted a concrete harm sufficient to satisfy the Article III injury-in-fact requirement. Plaintiff Thomas Robins alleged that Spokeo, Inc. published his consumer report containing inaccurate information and harmed his employment prospects at a time when he was unemployed. The Ninth Circuit ruled that Robins’ alleged injuries were sufficiently concrete for the purposes of Article III standing because the FCRA was established to protect consumers from the transmission of inaccurate information and Spokeo’s alleged violations were substantially likely to harm those concrete interests.
