UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 9.3 Free with a free account
What Companies and Individuals Face Legally After a Data Breach Occurs
Ethics in Technology · Chapter 9: Data Breaches, Digital Infections, and the Malware EcosystemSection 9.3 · lesson 44 of 11616 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: What Computer Viruses Are, How They Work, and the Best Ways to Protect Against Them →← Laws That Require Organizations to Tell You When Your Personal Data Has Been CompromisedNext lesson: What Computer Viruses Are, How They Work, and the Best Ways to Protect Against Them →
In this lesson
Private claims, regulatory enforcement, settlement design, and responsibility for individual conduct.
- Map several possible sources of legal exposure from one incident.
- Explain class actions and the federal standing requirements.
- Compare FTC, state, sector-specific, and international enforcement.
- Assess Equifax and individual cases without confusing allegations with judgments.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,921 words). Read along, or search it.
Chapter 9
Legal Consequences of a Data Breach
A breach can begin a legal aftermath that lasts much longer than the technical emergency. Several proceedings may address the same incident through different legal duties. We map private lawsuits, federal and state enforcement, foreign regulation, and individual consequences. A class action combines proposed claims but does not automatically prove liability. Federal standing requires a concrete injury, traceability, and redressability. Supreme Court decisions distinguish statutory violations, speculative risks, and recognized harm. FTC orders and sector-specific agencies use different authorities and remedies. Dated state settlements show money and security reforms responding to major incidents. Equifax illustrates both a large financial resolution and limits on individual compensation. Individual examples separate career changes, orders, allegations, convictions, and dismissed claims. Finally, a fictional retailer helps us connect legal exposure with evidence and truthful response.
Several Directions
One Incident Can Produce Several Independent Proceedings
Consumers, card issuers, and investors may assert different losses after the same incident. Federal regulators act within the legal authority and jurisdiction of their particular agencies. State attorneys general can investigate consumer protection, security, and notification duties. Applicable foreign laws can add privacy and security enforcement. Attackers, insiders, and people concealing wrongdoing may face criminal proceedings when the required elements exist. Individual orders and civil claims can coexist with separate job and reputational consequences. Being attacked does not automatically establish every legal violation. Each proceeding requires its own legal basis and supporting facts. Reasonable care, truthful promises, required disclosure, and later conduct all matter. A settlement resolves specified disputes or allegations, without necessarily admitting every allegation or producing a trial verdict. Investigation, repair, lost trust, and reputational damage can add costs alongside those proceedings.
Private Claims
A Class Action Combines Claims, but Does Not Automatically Establish Them
Named plaintiffs or class representatives seek to pursue claims for a proposed group. Pooling suitable claims may make litigation practical when individual losses are relatively small. Class certification has separate requirements, and a shared incident does not make every claim identical. Negligence examines an applicable duty, reasonable care, causation, and legally recognized harm. Contract claims examine whether a relevant enforceable promise existed and was breached. Consumer protection claims assess unfair or deceptive practices under the applicable law. Specific statutory claims require the statute's covered actors, data, conduct, and conditions. Investor securities claims have their own elements, including applicable mental state and loss causation. Banks can seek card replacement and fraud costs, while related cases may be coordinated or consolidated. California's limited security-breach private right does not extend to every CCPA violation. The adjusted statutory range, from two thousand twenty-five, is one hundred seven to seven hundred ninety-nine dollars. It applies per consumer per incident under the conditions; actual damages can be greater, and payment is not automatic.
Standing in Federal Court
Show a Concrete Injury, Traceability, and Redressability
Article Three standing determines whether a federal court can hear the plaintiff's particular claim. First, the injury must be concrete and particularized, and actual or sufficiently imminent. Second, it must be fairly traceable to the defendant's challenged conduct. Third, a favorable court decision must be able to remedy it. Standing is different from proving liability or certifying a class. Financial fraud is not the only possible concrete injury; recognized intangible harm may also matter. Courts consider exposed fields, misuse, attack context, and legally relevant response costs. Spending money on a speculative fear does not automatically convert the fear into standing. The governing decisions and requested remedy shape the assessment of supported future risk. Federal Article Three rules do not automatically describe every state court's requirements. The two thousand fifteen Remijas decision considered deliberate card theft, misuse, and mitigation when finding standing. Its fact-sensitive reasoning must be read alongside later Supreme Court decisions, rather than guaranteeing all breach plaintiffs a case.
Supreme Court Decisions
The Cases Shape Standing, but Are Not All Data Breach Cases
Clapper, decided in two thousand thirteen, involved a speculative chain of feared surveillance injury. The Court rejected the asserted risk and costs incurred to avoid that speculation as a standing basis. The opinion also discussed a substantial-risk standard; not every future-risk assessment uses identical facts. Spokeo, in two thousand sixteen, required concrete injury beyond a bare procedural statutory violation. It recognized that intangible harm can qualify, rather than requiring financial loss in every case. TransUnion, in two thousand twenty-one, considered credit reports and particular damages claims. Misleading reports for one thousand eight hundred fifty-three class members had been shared with third parties. Those people showed concrete reputational harm for the reasonable-procedures claim. The remaining six thousand three hundred thirty-two had internal files not shared during the specified period. They did not show concrete harm for that claim, within a class totaling eight thousand one hundred eighty-five. Future risk alone did not establish damages standing without another qualifying harm; forward-looking relief needs its own assessment. These decisions are not all breach cases, and they do not universally require completed identity fraud.
Federal Enforcement
FTC Orders and Sector Regulators Address Different Legal Duties
The FTC uses Section Five against unfair or deceptive practices within its jurisdiction. A material false security promise can support deception, subject to the required legal analysis. Unfairness involves substantial injury consumers cannot reasonably avoid, which countervailing benefits do not outweigh. An attack by itself does not prove either theory. Consent orders often impose lengthy security programs, independent assessments, and reporting obligations. They may last twenty years, with their actual terms controlling duration and required conduct. An initial standalone Section Five finding does not generally produce an automatic fine. Violating an order, a covered rule, or another statute can involve different monetary authority. AMG, in two thousand twenty-one, held that Section thirteen subsection b does not itself authorize equitable monetary relief. Other lawful remedies remain, so that decision did not remove every route to money or enforcement. HHS, CFPB, banking supervisors, and SEC act under applicable sector duties. Altaba, formerly Yahoo, agreed to a thirty-five-million-dollar SEC penalty in two thousand eighteen for misleading breach disclosure. The OCC imposed an eighty-million-dollar Capital One penalty in two thousand twenty, addressing risk and correction failures.
State and Foreign Enforcement
Compare Settlements by Their Date, Scope, and Required Reforms
State attorneys general can enforce applicable consumer protection, security, and notification laws. Massachusetts regulations and New York's SHIELD Act illustrate more specific security duties. Multistate coordination does not make all participating states' laws identical. Target's two thousand thirteen breach produced an eighteen-point-five-million-dollar settlement in two thousand seventeen. That agreement involved forty-seven states and the District of Columbia, plus security requirements. Uber's two thousand sixteen incident produced a one-hundred-forty-eight-million-dollar multistate settlement in two thousand eighteen. It addressed security and concealment allegations, with all fifty states and the District participating. Equifax's global resolution included one hundred seventy-five million dollars for states and territories. Marriott's two thousand twenty-four agreement involved fifty attorneys general, including the District, and fifty-two million dollars. Internationally, GDPR's higher tier can reach twenty million euros or four percent of the undertaking's preceding worldwide annual turnover. The higher applicable maximum controls, but the tier and facts matter; a breach does not automatically attract that maximum. British Airways received a twenty-million-pound ICO penalty in two thousand twenty over its two thousand eighteen incident.
Equifax: Incident and Resolution
A Known Weakness Can Lead to a Long, Multi-Party Legal Aftermath
Equifax's two thousand seventeen breach exposed information of approximately one hundred forty-seven million people. The FTC alleged failures concerning a known application vulnerability, patch verification, segmentation, and detection. Exposed fields included names, Social Security numbers, dates of birth, and addresses. Many people had not chosen the credit bureau as their service provider. The two thousand nineteen announcement combined consumer, state, and federal components. Initial consumer-benefit funding was three hundred million dollars. An additional amount, up to one hundred twenty-five million dollars, depended on the settlement conditions. The consumer maximum was therefore four hundred twenty-five million dollars, not a separate extra component. States and territories received one hundred seventy-five million dollars; the CFPB penalty was one hundred million. The announced overall financial range was five hundred seventy-five million initially, up to seven hundred million dollars. Security commitments and independent assessments also mattered; the maximum did not promise an identical cash payment to every victim.
Equifax: Benefits and Limits
A Large Total Does Not Tell You What One Person Receives
Consumer benefits included monitoring, eligible documented expenses and time, and identity restoration services. Eligible people who already had monitoring could request an alternative payment, up to one hundred twenty-five dollars. The relevant initial alternative-payment pool was capped at thirty-one million dollars. Heavy demand meant the advertised upper amount was not guaranteed for each person. The FTC warned about much smaller allocations in two thousand nineteen and encouraged the monitoring option. Monitoring can identify signs of misuse, but does not replace an exposed persistent identifier. It also does not erase every future risk or compensate every possible harm. Eligibility, proof, allocation, administration, and other remedies shape actual individual benefits. Separate shareholder litigation and the chief executive's two thousand seventeen retirement accompanied the global resolution. Those are distinct from consumer compensation and from a finding of criminal guilt. This is historical settlement analysis, rather than an invitation to rely on expired claim deadlines.
Individuals
Separate Job Consequences, Civil Orders, and Criminal Conduct
Individual consequences depend on each person's conduct and the required legal showing. Target's chief executive departed in two thousand fourteen; Equifax's retired in two thousand seventeen. Those career events do not themselves establish criminal guilt. Uber's Joseph Sullivan was convicted of obstruction and misprision in two thousand twenty-two, then sentenced to probation. A two thousand twenty-five amended appellate opinion affirmed the conviction arising from concealment during the FTC investigation. SolarWinds and Timothy Brown faced SEC allegations in two thousand twenty-three. Many claims were dismissed the following year; the remaining enforcement action was dismissed with prejudice in November two thousand twenty-five. That specific dismissal does not create universal immunity for security leaders. Drizly's CEO order was proposed in two thousand twenty-two and finalized in two thousand twenty-three, with specified future-role obligations. Jun Ying pleaded guilty to insider trading and received a four-month prison sentence in two thousand nineteen. Derivative oversight suits proceed on the company's behalf; attackers can face computer crime prosecution, including Capital One's convicted intruder. Four alleged Chinese military participants in the Equifax attack were charged in two thousand twenty; charges remain allegations. Concealment and trading add exposure, but no universal rule ranks every cover-up above every underlying security failure.
Worked Example
Map Northfield Outfitters’ Exposure Without Assuming the Outcome
Fictional Northfield Outfitters loses names, addresses, and card numbers for three million customers through an unpatched server. Its website had advertised industry-leading security. Customer claims would examine an applicable duty, concrete injury, causation, and relevant class requirements. Card issuers would examine whether actionable retailer conduct caused compensable replacement and fraud costs. An FTC deception inquiry could compare the material security promise with actual practice. State attorneys general could assess applicable security, consumer protection, and notification requirements. Executive scrutiny would require facts about individual knowledge, conduct, and the relevant legal elements. These fictional facts identify questions; they do not automatically prove every claim or guarantee an award. Preserve evidence and coordinate truthful, accurate response, notice, and disclosure. Investigate actual causal failures rather than assuming a security slogan proves the whole case. Different proceedings may address different questions, even while relying on some of the same incident evidence.
Review and Responsible Response
Ask About the Duty, the Evidence, the Remedy, and Individual Conduct
Begin by mapping private claims, applicable regulators, foreign duties, and possible individual proceedings. Standing, class certification, liability, and remedy are separate questions. Read each example at its actual procedural stage and date. An allegation, settlement, order, conviction, appeal, or dismissal has a different meaning. Future risk alone may be insufficient for federal damages standing without another qualifying harm. FTC authority has several routes and limits, rather than one automatic fine for every breach. Equifax combined consumer benefits, state payments, a CFPB penalty, and required security reforms. A large financial total does not automatically produce large compensation for each affected person. Uber's concealment and Ying's insider trading illustrate additional consequences arising from specific conduct after discovery. A security title alone does not establish personal guilt; actual authority, conduct, knowledge, and proof matter. Preventive care, honest response, protected evidence, and applicable legal duties together guide responsible accountability.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About What Companies and Individuals Face Legally After a Data Breach Occurs
Can you sue a company after a data breach?
What can the FTC do to a company after a data breach?
How much did the Equifax data breach settlement pay?
Can executives be held personally liable for a data breach?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →