Privacy Class Action – Theories Of Liability – 2013 Year In Review

One hot area of data privacy litigation over the past several years has been data breach class actions brought under the California Confidentiality of Medical Information Act ("CMIA"),1 which provides that a person may recover $1,000 "nominal" damages against a healthcare provider who has negligently "released" the person's medical information. Until recently, no California appellate court had directly analyzed what constitutes a "release" of medical information under the CMIA. The court in The University of California v. Superior Court (Platter)2 addressed this question for the first time in 2013 and held that the mere loss of possession of computer equipment containing medical information was not sufficient to constitute a release of the information itself. Instead, the court held, a plaintiff must be able to plead, and ultimately prove, that an unauthorized person actually accessed the plaintiff's medical information. The Platter decision will protect defendants from CMIA liability in instances in which a computer or other device is lost or stolen and never recovered but where there is no evidence to suggest that anyone ever looked at the information contained on the device after the loss or theft.

In another influential decision involving statutory claims under both California and federal law, the U.S. District Court for the District of Delaware dismissed a complaint against Google in In re Google Inc. Cookie Placement Consumer Privacy Litigation3for its alleged act of circumventing the privacy settings on Apple's Safari web browser in order to place web cookies on the user's hardware that tracks web browsing activity. In addition to holding that the plaintiffs lacked Article III standing in the absence of proof of a statutory violation, the court dismissed a variety of state and federal claims, including claims brought under the Electronic Communications Privacy Act, the Stored Communications Act, the Computer Fraud and Abuse Act, and various state laws.

The results were more mixed in Bell v. Blizzard Entertainment, Inc.,4 where the U.S. District Court for the Central District of California dismissed most, but not all, state law causes of action brought against a video game manufacturer after hackers gained access to users' account information. The court dismissed the plaintiffs' claims for unjust enrichment based on the theory that the defendant benefited from the sale of products without protecting their data security because the...