The post In re: Target Corporation Customer Data Security Breach Litigation — instructive 8th Circuit case re class certification appeared first on The National Law Forum.
]]>
Jim Sciaroni v. Target Corporation Civil case – Class Action in Target Security Breach. The district court’s statement in the class certification order regarding Rule 23(a)(4)’s representation adequacy requirement are conclusions, not reasons, and on their own do not constitute the “rigorous analysis” of whether certification was proper in this case; the court has a continuous duty to reevaluate certification throughout the litigation and the court’s order rejecting an allegation of intraclass conflict made before final certification improperly refused to reconsider the issue solely because it had already certified the class; as a result the district court abused its discretion by failing to rigorously analyze the propriety of certification, especially once new arguments regarding the adequacy of representation were raised after preliminary certification, and the matter is remanded to the district court for it to conduct and articulate a rigorous analysis of Rule 23(a)’s certification prerequisites as applied to this case; “costs on appeal” for Rule 7 purposes include only those costs that a prevailing appellate litigant can recover under a specific rule or statute; as a result the bond set in this matter, which included delay-based administrative costs, is reversed and the matter remanded with directions to reduce the Rule 7 bond to reflect only those costs appellee will recover should they succeed in any issues remaining on appeal following the district court’s reconsideration of class certification. The panel retains jurisdiction over any remaining issues following the district court’s disposition on remand. The district court shall certify its findings and conclusions to this court within 120 days.
02/01/2017 Jim Sciaroni v. Target Corporation
U.S. Court of Appeals Case No: 15-3909 and No: 15-3912 and No: 16-1203 and No: 16-1245 and No: 16-1408
U.S. District Court for the District of Minnesota – Minneapolis
[PUBLISHED] [Shepherd, Author, with Benton, Circuit Judge, and Strand, District Judge]
Download In re Target Corporation Customer Data Security Breach Litigation
© Copyright 2017 Armstrong Teasdale LLP. All rights reserved
The post In re: Target Corporation Customer Data Security Breach Litigation — instructive 8th Circuit case re class certification appeared first on The National Law Forum.
]]>The post Rosa Parks Name and Likeness Free for Use? appeared first on The National Law Forum.
]]>Rosa and Raymond Parks Institute for Self Development v. Target Corp.
Addressing the balance between privacy rights and matters of public interest, the U.S. Court of Appeals for the Eleventh Circuit affirmed the district court’s dismissal of the plaintiff’s complaint, holding that the defendant was shielded by the First Amendment from a lawsuit claiming the retailer violated the publicity rights of civil rights icon Rosa Parks by selling various products that included the plaintiff’s picture.Rosa and Raymond Parks Institute for Self Development v. Target Corp., Case No. 15-10880 (11th Cir., Jan. 4, 2016) (Rosenbaum, J.).
Target Corporation (the defendant), a national retail chain, sold books, a movie and a plaque that included pictures of Rosa Parks, an icon of the civil rights movement who, in 1955, refused to surrender her seat to a white passenger on a racially segregated Montgomery, Alabama bus. The Rosa and Raymond Parks Institute for Self Development (the plaintiff) owns the right and likeness of Rosa Parks. The plaintiff filed a complaint against the defendant, alleging unjust enrichment, right of publicity and misappropriation under Michigan common law for the defendant’s sales of all items using the name and likeness of Rosa Parks. The plaintiff complained that by selling the products, the defendant had unfairly and without the plaintiff’s prior knowledge, or consent, used Rosa Parks’ name, likeness and image as used on the products. The plaintiff further argued that the defendant promoted and sold the products using Rosa Parks’ name, likeness and image for the defendant’s own commercial advantage. After the defendant filed a motion for summary judgment, the district court dismissed the complaint. The plaintiff appealed.
On appeal, the 11th Circuit, sitting in diversity, applied Alabama’s choice-of-law rules, which holds that the procedural law of the forum state should be applied, while the law of the state in which the injury occurred governs the substantive rights of the case. Accordingly, the 11th Circuit applied the procedural rules of Alabama and the substantive law of Michigan.
In Michigan, the common-law right of privacy protects against four types of invasions of privacy: intrusion upon the plaintiff’s seclusion or solitude, or into his private affairs; public disclosure of embarrassing private facts about the plaintiff; publicity which places the plaintiff in a false light in the public eye; and appropriation for the defendant’s advantage, of the plaintiff’s name or likeness. The right of privacy is not absolute, and Michigan courts have long recognized that individual rights must yield to the qualified privilege to communicate on matters of public interest.
Applying Michigan law, the Court affirmed the district court’s dismissal of the plaintiff’s complaint, concluding that “the use of Rosa Parks’ name and likeness in the books, movie, and plaque is necessary to chronicling and discussing the history of the Civil Rights Movement” and that these matters therefore are protected by Michigan’s qualified privilege. As the 11th Circuit noted, “it is difficult to conceive if a discussion of the Civil Rights Movement without reference to Rosa Parks and her role in it.”
© 2016 McDermott Will & Emery
The post Rosa Parks Name and Likeness Free for Use? appeared first on The National Law Forum.
]]>The post Target Faces First Ever Union appeared first on The National Law Forum.
]]>The Wall Street Journal reports the NLRB has rejected an appeal from Target Corp. seeking to invalidate an employee vote in favor of unionization. In September, a “micro-unit” of about one dozen pharmacy workers in Brooklyn, NY voted in favor of unionization. The company appealed, but the NLRB affirmed the vote yesterday.
As reported in the article, “The group of less than a dozen employees in Brooklyn, N.Y., would be the first union among Target’s nearly 350,000 employees, marking a significant milestone for a company that has fought to keep unions out of its stores.” The complete article can be found here.
© 2015 BARNES & THORNBURG LLP
The post Target Faces First Ever Union appeared first on The National Law Forum.
]]>The post Will Cyberinsurance Cover Target's $19 Million Mastercard Settlement? appeared first on The National Law Forum.
]]>
The post Will Cyberinsurance Cover Target's $19 Million Mastercard Settlement? appeared first on The National Law Forum.
]]>The post Will Cyberinsurance Cover Target’s $19 Million Mastercard Settlement? appeared first on The National Law Forum.
]]>
The post Will Cyberinsurance Cover Target’s $19 Million Mastercard Settlement? appeared first on The National Law Forum.
]]>The post Target Corp. v. Destination Maternity Corp., Final Written Decision IPR2013-00532 appeared first on The National Law Forum.
]]>
Takeaway: Where neither party provides an interpretation of a term that provides additional clarity, the Board will give the term its plain and ordinary meaning.
In its Final Written Decision, the Board found that Petitioner had shown by a preponderance of the evidence that all challenged claims (claims 1, 2, 5, 6, 10, 11, and 15-17) of the ’531 patent are unpatentable. The ’531 patent “relates to a garment worn during different stages of pregnancy and different stages of postpartum body changes.”
The Board addressed claim construction, stating that claims in an unexpired patent are given their broadest reasonable construction in light of the specification of the patent. The Board first analyzed the term “just beneath the wearer’s breast area.” Patent Owner argued that the term means “beneath the location of the breasts by a very small margin.” However, the term “very small margin” does not provide any further clarity. The Board determined that because neither party offered a construction that provides additional clarity, the plain and ordinary meaning will be given. Also, the Board determined that the term is a term of approximation and that a garment may satisfy claim 1 for one wearer but not another because of differences in the wearers’ body types.
The Board then analyzed the term “different body types” used in claims 2 and 17. Although Patent Owner did not propose constructions for this limitation, its patentability arguments advance an implicit construction of “different body types” that requires an unspecified amount of difference between said body types. The Board determined that the broadest reasonable construction of “different body types” means “two or more body types that are not identical.”
The Board then analyzed the term “an elastic fabric that is contractible elastically to cover an abdomen during different stages of postpartum body changes” from claim 5. Although Patent Owner did not propose constructions for this limitation, the Board determined that its patentability arguments advanced an implicit construction that claim 5 requires a specific, yet unspecified, minimum amount of contractability. However, the specification does not specify any minimum amount of contractability and does not describe or identify any stages of postpartum body changes. Accordingly, the Board determined that the broadest reasonable construction of “during different stages of postpartum body changes” means “during any postpartum body change of any wearer,” which means that the fabric does not have to contract to cover postpartum body changes of every potential wearer or to cover all postpartum body changes of any wearer.
The Board next addressed the asserted grounds of unpatentability. Addressing anticipation based on a JC Penney catalog for fold-over panel jeans, the Board disagreed with Patent Owner’s assertion that the product shown in the catalog did not disclose a panel extending “high enough on the wearer’s body.” The Board found that the JC Penney catalog disclosed a panel substantially covering the belly region and noted that it was the belly region, and not the panel, that the claims require to extend to just beneath the wearer’s breast area. Thus, the Board was persuaded that claim 1 was anticipated by the JC Penney reference. Also, the Board disagreed with Patent Owner’s assertion that Petitioner has failed to prove that the panel of the JCP fold-over panel jeans stretches or expands enough to conform to different body types, because the claims do not require any quantified amount of stretching or expansion and the term “different body types” includes any two or more body types that are not identical. The Board was also not persuaded by Patent Owner’s argument that the panel of the JCP fold-over panel jeans is not described as being contractible as allegedly recited in claim 5. The Board indicated that contraction is always present where there is contraction, and the claims did not require any specific amount of contraction.
With respect to dependent claims 6, 11, 15, and 16, Petitioner asserted obviousness based on the JC Penney catalog applied to claim 1 in view of JC Penney Bootcut jeans. Patent Owner alleged nonobviousness based on the secondary consideration of commercial success. However, Patent Owner failed to link the alleged commercial success of the products to the inventions of claims 6, 11, 15, and 16. Specifically, Patent Owner’s witness conceded that the commercial success of Patent Owner’s products had nothing to do with the unique characteristics of claims 6 and 11, which add limitations directed exclusively to features of the garment lower portion.
Target Corp. v. Destination Maternity Corp., IPR2013-00532
Paper 76: Final Written Decision
Dated: February 12, 2015
Patent: RE43,531 E
Before: Jennifer S. Bisk, Michael J. Fitzpatrick, and Mitchell G. Weatherly
Written by: Fitzpatrick
Related Proceedings: Destination Maternity Corp. v. Target Corp., Case No. 2:12-cv-05680-AB (E.D. Pa.); IPR2013-00531; IPR2014-00508; IPR2013-00530; IPR2013-00533; IPR2014-00509
The post Target Corp. v. Destination Maternity Corp., Final Written Decision IPR2013-00532 appeared first on The National Law Forum.
]]>The post Target Wins Rehearing of IPR Joinder Decision with Expanded Panel appeared first on The National Law Forum.
]]>
Last fall, the Patent Trial and Appeal Board (PTAB or Board) interpreted the IPR joinder provision, 35 U.S.C. § 315(c), to require joinder requests by a non-party to an ongoing proceeding. (Target Corp. v. Destination Maternity Corp., IPR2014-00508 and IPR2014-00509.) Prior to that decision, the Board had interpreted § 315(c) to allow for issue joinder by the petitioner of the original proceeding (see, for example Microsoft v. Proxyconn, IPR2013- 00109). Of course, joinder was decided on a case-by-case basis, but had not previously been denied because the request was made by the petitioner of the original proceeding.
Target Corp. filed rehearing requests in both affected IPR proceedings in an effort to have the Board reconsider its interpretation of 35 U.S.C. § 315(c) with an expanded panel. Target’s arguments are quite clearly stated in its Motion for Rehearing. The Board granted Target’s rehearing request. In a 4:3 decision, the majority agreed that § 315(c) had been overly narrowly interpreted in the prior decision:
Turning now to the merits of the Request for Rehearing, the contention at the heart of Petitioner’s request for rehearing is that the denial of its Motion for Joinder was “based on an erroneously narrow interpretation of 35 U.S.C. § 315(c).” Paper 22, 1. We agree with Petitioner.
The majority read § 315(c)’s reference to “any person who properly files a petition under section 311” in conjunction with § 311′s requirement that the petition filer not be the patent owner, to broadly interpret § 315(c) to include any person except the patent owner. This interpretation is at odds with the dissent’s analysis, which reads § 315(c)’s reference to “may join as a party” to literally require a new party for joinder:
The statute under which Petitioner seeks relief provides:
(c) JOINDER.—If the Director institutes an inter partes review, the Director, in his or her discretion, may join as a party to that inter partes review any person who properly files a petition under section 311 that the Director, after receiving a preliminary response under section 313 or the expiration of the time for filing such a response, determines warrants the institution of an inter partes review under section 314.
35 U.S.C. § 315(c) (emphasis added). The statute does not refer to the joining of a petition or new patentability challenges presented therein. Rather, it refers to the joining of a petitioner (i.e., “any person who properly files a petition”). Id. Further, it refers to the joining of that petitioner “as a party to [the instituted] inter partes review.” Id. Because Target is already a party to the proceeding in IPR2013-00531, Target cannot be joinedto IPR2013-00531.
While the majority decision does align with panel decisions on joinder prior to Target, one must ask whether this issue is finally resolved by this expanded panel decision. For example, what happens if another panel does not follow this interpretation § 315(c)? Or suppose this decision is appealed; would the Federal Circuit reverse a Board decision on joinder as it relates to institution given its recent interpretation of 35 U.S.C. § 314(d) in In re Cuozzo Speed Technologies? (“We conclude that § 314(d) prohibits review of the decision to institute IPR even after a final decision. . . . Section 314(d) provides that the decision is both ‘nonappealable’ and ‘final,’ i.e., not subject to further review. 35 U.S.C. § 314(d).”) Would a Federal Circuit appeal have to be in the form of a petition for writ of mandamus? If so, how would that square with the mandamus decisions in In re Dominion Dealer Solutions, LLC, 749 F.3d 1379, 1381 (Fed. Cir. 2014)(mandamus relief not available to challenge the denial of a petition for IPR) and in In re Proctor & Gamble Co., 749 F.3d 1376, 1378–79 (Fed. Cir. 2014)(mandamus relief not available to provide immediate review of a decision to institute IPR)?
The post Target Wins Rehearing of IPR Joinder Decision with Expanded Panel appeared first on The National Law Forum.
]]>The post Consumer Claims Survive Motion to Dismiss in Target Data Breach Class Action appeared first on The National Law Forum.
]]>
A recent ruling by Federal District Judge Paul Magnuson will permit most of the consumer claims in the Target data breach litigation to survive Target’s motion to dismiss. This most recent ruling follows on the heels of the court’s December 2 decision partially denying Target’s motion to dismiss consolidated complaint of the banks that issued the credit and debit cards that were subject to the breach. The late 2013 data theft that gave rise to the consumer and issuer bank claims was caused by malware placed by hackers on Target’s point-of-sale (“POS”) terminals. The malware allowed the hackers to record and steal payment card data as customers’ credit or debit cards were swiped. In the consolidated consumer complaint, 117 named plaintiffs allege that Target wrongfully failed to prevent or timely disclose the data theft. Plaintiffs also contend that Target failed to disclose the purported insufficiency of Target’s data security practices. The consumers assert claims under the laws of 49 states and the District of Columbia for negligence, breach of contract, breach of data notification statutes and violation of state unfair trade practice statutes. The consumer complaint also purports to assert those claims on behalf of a putative plaintiff class consisting of every Target customer whose credit or debit card information was stolen in the data breach.The court’s latest ruling rejected arguments by Target as to standing and damages that would have required dismissal of the consumer claims in their entirety. The court did state, however, that Target can revisit the question of whether plaintiffs had sustained actionable injuries after discovery has concluded. And, even though most of the consumer Plaintiffs’ claims survive, the court did rule that that certain of the claims alleged under particular states’ laws should be dismissed. As is true of the court’s denial of Target’s motion to dismiss the issuer banks’ consolidated complaint, the denial of the motion to dismiss does not resolve the merits of the surviving consumer claims. Like the surviving issuer bank claims, the consumer claims that were not dismissed will now be the subject of extensive discovery and further motion practice relating to class certification and summary judgment.
Court rejects Target’s arguments on standing and injury: As is common in data breach cases, Target’s primary ground for seeking dismissal of the consumer claims was lack of standing due to the absence of actionable consumer injury. In its motion to dismiss, Target argued that none of the plaintiffs had alleged a present injury sufficient to establish “case or controversy” standing under Article III of the United States Constitution. Specifically, Target contended that none of plaintiffs’ alleged present injuries either constituted a present harm to plaintiffs or was fairly traceable to the theft of payment card data. Target’s central argument was that allegations that unauthorized charges had been made on plaintiffs’ payment cards did not plead actionable injury because plaintiffs did not – indeed, likely could not – allege that such charges had not been or would not be reimbursed by the card issuing banks. Target further argued that other alleged injuries could not fairly be traced to theft of payment card data because they could only have arisen from unrelated conduct (such as identity theft resulting from a plaintiff’s stolen social security number) or were not fairly traceable to the data theft itself (such as loss of access to funds based on plaintiffs’ own voluntary closing of accounts).
The court gave these arguments cursory treatment. Judge Magnuson disagreed with Target’s injury analysis, finding that “Plaintiffs have alleged injury” in the form of “unlawful charges, restricted or blocked access to bank accounts, inability to pay other bills, and late payment charges or new card fees.” Target contended that such alleged injuries are insufficient to confer standing because “Plaintiffs do not allege that their expenses were unreimbursed or say whether they or their bank closed their accounts . . . .” The court rejected this argument, stating that Target had “set a too-high standard for Plaintiffs to meet at the motion-to-dismiss stage.” In so ruling, however, Judge Magnuson merely deferred to another day a decision on whether the injuries alleged were indeed fairly traceable to the alleged wrong doing. Despite concluding that Plaintiffs’ allegations were “sufficient at this stage to plead standing,” the court nonetheless stated that, “[s]hould discovery fail to bear out Plaintiffs’ allegations, Target may move for summary judgment on the issue.” Thus, it remains open to Target to show that neither Plaintiffs nor putative class members suffered injuries fairly traceable to the data breach.
The court’s finding that Plaintiffs had alleged actionable injuries also supported its denial of Target’s request that the Court dismiss claims asserted under 26 state consumer protection laws that required allegation of pecuniary injury. Similarly the court rejected Target’s argument that Plaintiffs’ negligence claims should be dismissed for failure to allege cognizable damages.
Court dismisses some state consumer protection law claims; most survive. Plaintiffs brought unfair or deceptive trade practice claims under the consumer protection statutes of 49 states and the District of Columbia. The court dismissed claims under Wisconsin law because the subject statute contains no private right of action. The court also dismissed claims asserted on behalf of absent class members under the consumer protection laws of Alabama, Georgia, Kentucky, Louisiana, Mississippi, Montana, South Carolina, Tennessee and Utah, finding that the laws of those states, which preclude the assertion of consumer protection claims by means of a class action, “define the scope of the state-created right” and preclude certification of a class to pursue such claims (quoting Shady Grove Orthopedic Assocs. v. Allstate Ins. Co., 559 U.S. 393, 423 (2010)). Otherwise, as noted above, Judge Magnuson found that plaintiffs’ allegations, including their allegations of injury, asserted actionable class and individual claims under the remaining states’ consumer protection statutes, and declined to dismiss such claims.
Certain data breach notice claims survive motion to dismiss. Plaintiffs asserted claims against Target under the date breach notification statutes of 38 states, alleging that Target had failed to disclose the data breach as soon as required under those laws. As with plaintiffs’ other claims, the court rejected as premature Target’s argument that plaintiffs had not alleged any actionable damages flowing from alleged violations of state data breach notification statutes. Certain of Target’s arguments for dismissal based on statutory language prevailed. Plaintiffs conceded that the data breach statutes in Florida, Oklahoma, and Utah did not permit a private right of action, and voluntarily withdrew those claims. Where the applicable statutes provided only for enforcement by the state attorney general (as is true in Arkansas, Connecticut, Idaho, Massachusetts, Minnesota, Nebraska, Nevada and, Texas), the court dismissed Plaintiffs’ claims. Where the remedies available under other states’ laws were non-exclusive or ambiguous –as was the case in Colorado, Delaware, Iowa, Kansas, Michigan and Wyoming – the court declined to dismiss Plaintiffs’ claims. Where applicable state laws were silent as to the authority to enforce the enactment, the court inferred a private right of enforcement in all states except Rhode Island, where controlling authority holds that if a statute does not expressly provide for a private cause of action, such a right cannot be inferred. As to all other states, the court agreed with plaintiffs’ argument that there is either a permissive cause of action or that there is a private right to enforce data breach notification statues under applicable state consumer protection statutes.
Negligence claims survive where not barred under the economic loss doctrine: Actual damages is a required element of a common law negligence claim. The court’s rejection of Target’s argument that Plaintiffs had failed to allege actionable injury precluded dismissal of Plaintiffs’ negligence claims in their entirety for failure to plead damages. Under certain states’ laws, however, the so-called “economic loss doctrine” requires dismissal of claims for negligence where the alleged injury consists solely of economic loss rather than personal injury or property damage. Following state authority, the court invoked the economic loss doctrine to dismiss negligence claims based on the economic loss rule under Alaska, California, Georgia, Illinois, Iowa and Massachusetts law. The court declined to dismiss negligence claims under District of Columbia, Idaho and New Hampshire law, holding that precedent in those jurisdictions required additional factual development to determine whether there exists any special duty that would vitiate the economic loss doctrine. Finally, the court held that the facts pleaded in the Complaint satisfied the exception to the economic loss doctrine applicable under New York and Pennsylvania law where there is a duty to protect from the specific harm alleged.
Breach of implied contract claims survive: Judge Magnuson held that the existence of an implied contract turns on issue of fact that cannot be resolved at the motion to dismiss stage because “a jury could reasonably find that a customer’s use of a credit or debit card to pay at a retailer may include the implied contract term that the retailer “will take reasonable measures to protect the information” on those cards (citing In re Hannaford Bros. Customer Data Sec. Breach Litig., 613 F. Supp. 2d 108, 119 (D. Me. 2009)).
Breach of contract claim dismissed without prejudice: The Complaint alleges that Target violated the terms of the card agreement for the Target REDcard, in which Target states that it “use[s] security measures that comply with federal law.” The Complaint, however, fails to specify the federal law with which Target purportedly failed to comply. Accordingly, the court dismissed that claim without prejudice, allowing Plaintiffs leave to replead that claim to specify, if possible, the state law that had been violated.
Bailment claim dismissed: A common law bailment claim consists of wrongful failure to return tangible property entrusted to another. Plaintiffs, however, do not and cannot allege that stolen payment card information was given to Target with expectation of return. Therefore, the court dismissed Plaintiffs’ bailment claim with prejudice.
Unjust enrichment claim survives: Plaintiffs claim that Target is liable for unjust enrichment because it knowingly received or obtained something of value which in equity and good conscience it should not have received. This claim is based on two theories. The first is an “overcharge” theory claiming that Target charges an unearned premium for data security. The second theory states that class members would not have shopped at Target had Target disclosed alleged deficiencies in its data security. The court rejected the first theory as unsupported as a matter of law, but concluded, without citation to authority, that the “‘would not have shopped’ theory . . . is plausible and supports their claim for unjust enrichment.”
Significant obstacles remain for consumer claims: The court’s refusal to accept Target’s injury arguments at the motion to dismiss stage does not eliminate Plaintiffs’ burden to prove that consumers suffered actionable losses. Because consumers generally do not have to pay for fraudulent charges on their payment cards, such activity will not provide a basis to establish cognizable damages. Nor is the cost of credit monitoring or other activities associated with avoiding identity theft or adverse credit history likely to provide grounds for proving actionable damages. A majority of courts that have addressed the issue have held that such costs are not actionable as a necessary and reasonable consequence of a payment card data breach. And even where fraud mitigation costs have been treated as cognizable injury – as was the case in Anderson v. Hannaford Bros. Co., 659 F.3d 151 (1st Cir. 2011) – the court nonetheless denied plaintiffs’ motion for class certificationbecause questions of whether individual consumers’ remedial actions were reasonable and what such actions reasonably should have cost could not be determined without taking testimony from every member of the class, thereby raising highly individualized issues of fact and law that would preclude trying class members’ claims through proof common to the class as a whole. The parties will have the opportunity to grapple with these issues after discovery has concluded.
The post Consumer Claims Survive Motion to Dismiss in Target Data Breach Class Action appeared first on The National Law Forum.
]]>The post Four Ways For A Financial Institution To Minimize Losses Related To A Data Breach appeared first on The National Law Forum.
]]>
The post Four Ways For A Financial Institution To Minimize Losses Related To A Data Breach appeared first on The National Law Forum.
]]>The post Target Becomes a Target: Proposed California Bill Aims to Make Retailers Liable for Data Breach Incidents appeared first on The National Law Forum.
]]>
Following a string of high-profile data breaches and new data suggesting that approximately 21.3 million customer accounts have been exposed by data breach incidents over the past two years, the California legislature has introduced legislation aimed at making retailers responsible for certain costs in connection with data breach incidents. If passed in its current form, Assembly Bill 1710, titled the Consumer Data Breach Protection Act, would have a substantial impact on retailers operating in California.
Among the major changes proposed in the bill:
- Stricter Notification Requirements. The proposed bill would create stricter time-frames and specific requirements for notification of affected consumers following a data breach incident. In addition to current requirements to notify consumers individually in the most expedient time possible, a retailer affected by a data breach will be required, within 15 days of the breach incident, to provide email notification to affected individuals, post a general notice on the retailer’s web page and notify statewide media.
- Retailer Liability for Costs Associated with Data Breach Incidents. A.B. 1710 would amend California’s Civil Code to make retailers liable for reimbursement of expenses incurred in providing the notices described above, as well as the cost of replacing payment cards of affected individuals.
- Mandatory Provision of Credit Monitoring Services. If the person or business required to provide notification under the Civil Code is the source of the breach incident, A.B. 1710 will require that person or business to offer to provide identity theft prevention and mitigation services at no cost to affected consumers for not less than 24 months.
- Prohibitions Against Storing Payment-Related Data. Under a new section to be added to the Civil Code, persons or businesses who sell goods or services and accept credit or debit card payments would be prohibited from storing payment-related data unless that person or business stores and retains the data in accordance with a payment data retention and disposal policy that limits retention of the data to only the amount of time required for business, legal and regulatory purposes. In addition, A.B. 1710 imposes further restrictions on the retention and storage of certain sensitive authentication information, such as social security numbers, drivers’ license numbers and PIN numbers.
- Authorization of Civil Penalties. As amended by A.B. 1710, the Civil Code would authorize a prosecutor to bring an action in response to a data breach incident to recover civil penalties of up to $500 per violation, or up to $3,000 for a willful or reckless violation.
Historically measures like A.B. 1710 have faced a difficult road. Similar bills passed by the California legislature were vetoed twice by Governor Schwarzenegger, and the proposal of A.B. 1710 has already caused the California Retailers Association to speak out against the bill. However, there may be a critical difference in the current climate because consumer awareness of the danger and reality of breach incidents has never been higher and, as shown by the recent Harris Poll, consumers overwhelmingly believe that merchants are to blame.
The post Target Becomes a Target: Proposed California Bill Aims to Make Retailers Liable for Data Breach Incidents appeared first on The National Law Forum.
]]>