Jury Reply

I’m studying and need help with a Business Law question to help me learn.

Doing the Data Breach Lawsuit

Facts

An infidelity website, Madison Ashley and its parent company, have been sued in federal court by a man who claims that the companies failed to adequately protect clients’ personal and financial information from theft, saying he suffered emotional distress.

The lawsuit accuses Madison Ashley (MA) and parent company of negligence and invasion of privacy, as well as causing emotional distress. The lawsuit follows a breach of the Madison Ashley website by a group called the Impact Team, which downloaded “highly sensitive personal, financial, and identifying information of the website’s 37 million users.

The lawsuit follows a breach of the MA website by a group called the Impact Team which had threatened to publish the “stolen personal information” if the MA website was not shut down. This information included millions of email addresses for U.S. Government officials, UK civil servants and high-level executives at European and North American corporations.

At Trial

The Plaintiff argues that the data breach could have been avoided if the company had taken “necessary and reasonable precautions to protect its users’ information”. MA knew of several technical issues that could had led to a data breach but did nothing. The defense argues that their damages must be proven and, as there is no indication of credit card fraud or illegal use of the information, there is no basis for the case. Additionally, their website contains this sentence “We cannot ensure the security or privacy of information you provide through the Internet.”

Questions

1. Do individuals who subscribe to and visit this site have a reasonable expectation of privacy? Why or why not?
2. Are there facts that would support a tort action and, if so, what tort(s)?
3. Are there any other defendants besides MA? If so, why sue just MA?

Data Breach Lawsuit

1) I do believe that the subscribers to the Madison Ashley website were owed a reasonable amount of security for their personal information. Regardless of the fact that the website is one which promotes infidelity & is obviously immoral, a contract still existed between MA and its customers. When a person paid money to MA for a subscription to their website, a contract was formed between the two parties. The person puts forth money in exchange for future services to be given via the website. Just because MA puts forth the claim in writing that, ‘We cannot ensure the security or privacy of information you provide through the Internet’, doesn’t make it true or valid. In our textbook an unconscionable contract or clause is explained as something which “…is so unfair that it is rendered void (Business Law 9th ed., pg. 146).” The text goes into further detail in describing exculpatory clauses. The text states, “Closely related to the concept of unconscionability are exculpatory clauses. These are clauses that release a party from liability in the event of monetary or physical injury, no matter who is at fault. Indeed, some courts refer to such clauses in terms of unconscionability. Exculpatory clauses are often held to be unenforceable (Business Law 9th ed., pg. 147).” So as this case goes to court, I would expect either MA to lose the case as their ‘no privacy clause’ would be deemed unenforceable or MA would eventually settle with its customers.

2) There are definitely facts here that would support a tort, specifically a tort of negligence. Entering into a contract with Madison Ashley, the customer relinquishes information such as their full name, address, credit/debit card numbers, email addresses, phone numbers, etc. in order to obtain a subscription. Like virtually all other major websites though, there exists the reasoable expectation that this vital information will be protected from any third parties. So MA had a duty to handle their customers billing information, and personal information with a reasonable amount of security once they were entrusted with it. Having allowed this data to get hacked and fall into the hands of a third party, MA caused harm to its customers by allowing their personal & financial information to leak. Among many other things, many customers might have had expensive divorces as a result of MA’s negligence. MA would have a difficult time successfully defedning against a tort of negligence here.

3) The prompt actually says, ‘An infidelity website, Madison Ashley and its parent company, have been sued in federal court‘. So MA is being sued, but also its parent company is being sued. In this case, Madison Ashley and its parent company would be co-defendants. Both entities are responsible for the website itself which was negligently operated as so to allow its users data to be breached. Its pretty clear that both MA and its parent hold the blame here for the negligence, and it makes sense for the man to be suing both and not just the one.