Economic Analysis of Financial Institution Claims in Data Breach Class Actions

Data breaches—that is, the unauthorized access to, or disclosure of, personal data—are quickly becoming a reality of doing business for many companies. Many corporate data breaches are now also closely followed by class action lawsuits against the breached company. While much of the analysis in this area of litigation has focused on consumer cases—brought by the customers of the breached businesses—courts in those cases typically grapple with the issue of legal standing for plaintiffs. Less analysis has been done of institutional cases, for example involving banks filing a suit after information on payment cards they issued is disclosed in a breach.

In this article, published in the American Bar Association’s Information Law Journal (Winter 2016, Volume 7, Issue 1), Edgeworth Partners Michael Kheyfets and Matthew Milner, along with Andrew Sand, discuss economic analysis as it applies to litigation matters filed by financial institution classes. The authors first summarize the types of harms plaintiffs typically claim in these matters and focus on how the characteristics of financial institution cases might differ from their consumer counterparts. Subsequently, the authors present an economic framework for the evaluation of financial institutions’ damages claims in data breach cases and highlight important considerations relating to economic analysis of these cases in the class action context.