On behalf of Wolf Popper LLP
Equifax is starting to experience the legal ramifications that are following the recent hack of its systems. This breach led to the exposure of personal information for over 145 million consumers.
News of the breach has left consumers confused and concerned. One of the biggest issues with this hack is the fact that it will likely result in a surge of identity theft issues. The consumer credit reporting agency is facing the threat of lawsuits from state attorneys general as well as individuals. But this still leaves the general population with questions. What does this mean for individual's personal information? Who exactly is at an increased risk of identity theft because of this breach?
Those who think they may be negatively impacted by the breach can benefit from a basic understanding of the legal channels that are available for relief. The following will provide some guidance on the claims likely present for state attorneys general as well as those that may be available for individuals that are impacted by this breach.
State laws may protect victims of data breaches.
Many states have laws that address data breaches such as this. A failure to follow the deadlines and requirements for consumer notification set by each state statute can come with serious penalties.
In this case, the penalties can be particularly severe as they are often applied per incident. Massachusetts state law sets a civil penalty that can reach $5,000 per violation and other states have penalties that can reach $10,000. Due to the magnitude of the breach, the financial ramifications of state penalties alone could be massive. As noted in a recent Market Watch piece, this portion of penalties could quickly exceed $700 billion.
Depending on which states' laws apply, state attorneys general may have the ability to file a lawsuit against Equifax to protect to rights of that state's citizens. Also, individuals who personally experience a large debt as a direct result of the hack may be able to file a lawsuit to hold Equifax accountable. This type of case would require that the injured person establish he or she was the victim of identity theft and that the information was gathered from the Equifax breach.
A class action may also be available, although some recent court cases have made these class claims difficult to prosecute. The class action process could allow injured individuals to seek action on behalf of a "class" of persons injured by Equifax's actions (or inactions) with respect to their personal data. Equifax had sought to avoid such class actions by including an arbitration clause (which precluded class actions) in its monitoring program. However, public pressure forced Equifax to agree not to enforce such a clause.
Certification is not an easy process. As noted in a previous publication by our firm, it requires that the motion to certify the class action meet all elements pursuant to Rule 23 of the Federal Rules of Civil Procedure. These claims also often face fierce opposition.
Equifax and legal woes: Just the beginning?
This may be the beginning for the legal woes Equifax will need to navigate as a result of this hacking incident. We will address other issues that will arise in future posts. Watch for our next post delving into an arbitration provision present on the agency's website.