Could Identity Theft be Considered a Personal Injury?

In a recent Connecticut Supreme Court case, the Court determined that IBM could not recover any compensation from the data management company or the logistics company who lost personal information on hundreds of thousands of its employees. There are a few issues to consider, and this case highlights one of the biggest ones issues facing those who have had their identity stolen; in certain types of cases, in order to receive compensation for damages related to identity theft, a plaintiff must prove that they have suffered some sort of specific economic loss as a result of the theft.

The case in question revolved around stolen personal information of more than 500,000 IBM employees. IBM hired Recall Total Information Management to transport and store computer tapes containing the personal information of IBM employees. Recall Total then subcontracted to Executive Logistics, who actually handled those computer tapes.

In February 2007, Executive Logistics was moving computer tapes from IBM’s facility in New York to another facility. However, during transportation, some 130 tapes fell out of the van and were never found.

The information contained social security numbers, names, birth dates, and contact information for past and present IBM employees. IBM then spent over 6 million dollars in mitigation measures to protect the identities of their employees and IBM sought to be compensated for those costs by Recall Total and Executive Logistics.

Recall Total and Executive Logistics then filed suit against their insurance companies when their policies failed to cover the loss of the tapes. They claimed that the loss of the tapes was covered under the personal injury portion of their insurance policy, which was defined as an injury caused by an offense of electronic, oral, written or other publication of material that violates a person’s right of privacy.

Why wasn’t the loss of the tapes a personal injury?

Looking through the court records, although the computer tapes were stolen and never recovered, there was no evidence that that tapes were actually accessed. Further,  because the tapes were never accessed, no IBM employees were injured. Still, identity theft is a real issue and it seems unfair that IBM would not be compensated for their efforts to make sure their employees’ private information was safe, especially when they were not the ones who lost the private information in the first place.

However, in this situation, the trial court determined that this case was outside of the scope of the insurance policy which covered Recall Total and Executive Logistics. The court reasoned that because there was no publication of the private information, there was no injury at all. Without an injury, there could be no compensation.

Recall Total and Executive Logistics appealed the ruling, hoping the district court would rule differently. Unfortunately for them, the district court upheld the ruling. After appealing to the highest state court, the Connecticut Supreme Court agreed with the lower court’s rulings, determining that in this case, there was no injury because no private information was published.

Interestingly, another (completely separate) recent legal decision seems to give a contradictory message. On June 15th, 2015, a federal judge ruled that employees of Sony Pictures Entertainment, whose personal information was exposed in last year’s Sony hack scandal, do have standing to file a lawsuit even if they can’t prove that the information stolen was used by the criminals.

U.S. District Judge R. Gary Klausner, of the Central District of California, ruled that plaintiffs do not need to allege actual identity theft. Klausner says that he is satisfied with the “injury” they showed via money spent in the aftermath of the breach to monitor credit issues, protect passwords, and freeze their credit.

Why is this significant?

In certain situations, once a case has been litigated, it cannot be re-litigated in the future. This is called res judicata (AKA claim preclusion) and it exists to prevent frivolous and unnecessary lawsuits. In a situation such as this, the possibility exists that a case relating to stolen information could be ruled against a plaintiff because there had been no publication of the stolen information. That information could later be published and it could injure IBM employees. Recall Total and Executive Logistics may be unable to bring a similar suit against their insurance companies in the future because of the concept of claim preclusion. In that case, they would be unable to receive insurance coverage at all.

Why does the economic loss rule exist?

While this case is based on the specific language of an insurance policy, in general tort claims involving stolen identity, plaintiffs must similarly prove that they suffered some economic loss in order to recover compensation. This rule exists in order to narrow the scope of liability in such cases. Further, this rule is meant to strengthen the ever-growing idea that damages must not be speculative and must be proved with a certain degree of certainty.

But what types of economic loss will courts consider? Well, as stated above, the losses must be determinable with certainty, which is why most courts will not allow damages related to a drop in credit caused by identity theft. While plaintiffs would argue that many missed economic opportunities can result from bad credit, courts believe that such damages are too speculative even though the harm in those situations could be huge. Valuing such economic loss would be close to impossible, however, which is why courts generally decline to go into that type of economic analysis. Courts wish to differentiate tort recovery from recovery for breach of contract, and breach of contract claims can often lead to recovery for lost opportunities. In cases where a breach of contract causes a party for miss out on an employment opportunity, often that party can be compensated for that loss.

Hopefully this gives a brief overview of issues related to tort claims relating to stolen personal information. The case law on this issue continues to grow as hackers find new ways to infiltrate the personal lives of hardworking Americans.