Yes, You Are My Data's Keeper

A recent decision from the Southern District of Indiana, however, cut through these issues by allowing a class action claim to proceed on a theory of liability often proposed by commentators as a solution to the data breach liability conundrum but until recently almost uniformly rejected by courts: the common law theory of bailment. See, Krupa v. TIC International Corp., 2023 WL 143140 (S.D. Ind. Jan. 10, 2023). If other courts around the country follow Krupa's lead, it could represent a major shift in how data breach claims are litigated, and companies that maintain Personally Identifiable Information (PII) belonging to consumers or employees should be watching closely.

Bailment-Based Liability for Data Breach: Attractive In Theory, But Mostly Rejected by Courts

The elements of a bailment action, and even the question of whether the claim sounds in contract or tort, vary from state-to-state. The underlying concept is a simple one, however; as the court in Krupa recognized, "[e]trusting your stuff to others is a bailment." Krupa, 2023 WL 143140, at *3. More formally, a bailment relationship is "created by the delivery of personal property by one person to another in trust for a specific purpose, pursuant to an express or implied contract to fulfill that trust." 8A Am. Jur. 2d Bailments §1 (2018). When one who holds property on behalf of another fails to take appropriate care to protect it and the property is "damaged, lost or stolen, the bailor may bring an action for recovery of damages from the bailee" based on that harm. 46 Am. Jur. Proof of Facts 3d 361.