The document discusses standards, security, and audits regarding cyber litigation and compliance. It summarizes the legal landscape for data breaches, including class action lawsuits, shareholder derivative suits, and personal liability for directors. Examples of costs from data breach lawsuits and different types of allegations in class actions are provided. The document also discusses enforcement actions from government agencies and outlines strategies for companies to prepare and mitigate risks of litigation following a data breach.

1. Standards, Security, and Audit
The developing world of cyber
litigation and compliance

2. Vanessa Henri
Legal Counsel, Above Security – A Hitachi Group
Company
LL.B, LL.M, Ph.D. candidate
Contact Information
(450) 430-8166 ext. 8048
vanessa.henri@abovesecurity.com
www.abovesecurity.com
linkedin.com/vanessa.henri
@_vanessa_henri

3. What do we do? - Facts and Figures
3
Customers in
45 + Countries
Founded
1999
Headquartered
In Montreal, Canada
5 SOCs: Montreal, Dallas, TX,
Mexico City, Switzerland, Tokyo
Finance, Telecommunications, Healthcare,
Government, Energy and Retail
Acquisition by
Hitachi Systems,
Ltd. – 2015
Rebranding, July
2017

4. 4
It’s not a question of if you’ll be hit
with a data breach attempt, but
WHEN
… and if it’s successful, the
fallout litigation is just as
inevitable.

5. 5
Agenda
To be discussed today…
• The legal landscape
• Data breach class actions
• Shareholder derivative suits
• Personal liability of directors
• Securities fraud class actions
• Enforcement actions
• The concept of “reasonable” cybersecurity
• Is there a gap between legality and compliance?

6. 6
The Legal Landscape
Cybersecurity legal
framework
Proprietary
information
protection
System
protection
Data
protection

7. 7
Data breach lawsuits: which cost?
“Regulated industries, such as
healthcare and financial services, have
the most costly data breaches because
of fines and higher than average rate of
lost business and customers. The
healthcare organizations had an
average cost of $355 and in education
the average cost was $246. The
average total organizational cost in the
US was 7.01 million dollars.”
-Ponemon 2016 Cost of Data Breach Study

8. 8
Data Breach Class Actions
• Canada
• Changes in the legal landscape
• USA :
• 83 class actions were filed in 2015
• 5% of publicly reported data breaches led to class
actions lawsuits

9. 9
Data Breach Class Actions
Allegations in class actions (2016, USA)
6%
12%
4%
10%
41%
10%
10%
7%
Primary Legal Theories
Unfair Competition Breach of Contract Data Breach Notification Statute
FCRA Negligence Federal Privacy Act
State Consumer Protection Act State Privacy Law

10. 10
Data Breach Class Actions
How do you defend against a class action?
• Preparedness, detection, and breach response
• Causation issues
• Currently difficult to prove damages

11. 11
Data Breach Class Actions
Settlement cost

12. 12
Securities Fraud Class Actions
To recover from diminution in stock value following a data breach
• Based on misrepresentations (public statements, 10-K
reports, etc.)
• Contend is that the shareholders relied to their detriment
on a company’s material misrepresentations

13. 13
Shareholder Derivative Actions
A shareholder brings suit on behalf of the corporation against a
third party
• Against an insider, such as an executive officer, a board
member
• Alleging a breach of a fiduciary duty or a duty of care
• Recovery goes to the corporation
• High pleading standard

14. 14
Personal Liability of Executives/Directors
• Chief Compliance Officers:
• “Rising Personal Liability – Perception and
Reality: How to Best Manage Personal
Regulatory Risk” – Reuters
• Statutory liability
• Ancillary liability
• Indemnification of directors

15. 15
Enforcement Actions
From a variety of agencies
• Department of Justice
• Securities and Exchange Commission
• Federal Trade Commission
• Officer of the Privacy Commissioner of Canada
• Industry-based regulators (professional associations)

16. 16
Or… a combination of all these lawsuits
The target case study
• Class action lawsuit settlement: $10MUSD
• Visa lawsuit settlement: $67M
• Mastercard lawsuit settlement: $39M
• Shareholders derivative lawsuit against 13 officers and
directors
• Regulatory fines : $150M
Total est. cost of data breach: $1.4B USD

17. 17
How to prepare against litigation
Between compliance and legality

18. 18
Final Concerns
What future for data breach litigation?
• Vulnerability of small to mid-sized businesses
• Directors liability
• Need to mitigate personal risks
• Need for adequate trainings regarding IT security, privacy and
legal aspects
• Legal costs is important, even when lawsuits are dismissed
• Myriads of lawsuits on different front
• Increased importance of cyber insurance market to cover these risks

19. THANK YOU
?
(450) 430-8166 ext. 8048
vanessa.henri@abovesecurity.com
www.abovesecurity.com
linkedin.com/vanessa.henri
@_vanessa_henri