4 Steps to Safeguard Against Individual Liability for Data Security Failures

With cyberattacks on the rise and class actions arising from cyberattacks being filed at an increased rate, executives and board members increasingly face the risk of being individually targeted in lawsuits brought by class action plaintiffs and governmental bodies alleging individual liability for data security failures. Typically, such suits allege that the individuals made misrepresentations about their companies’ cybersecurity risks and practices and took or failed to take certain actions in connection with data security incidents.
This article identifies recently emerging trends in such varied but similar lawsuits, including two currently being prosecuted in U.S. district courts, draws common threads, and discusses four best practices that executives and board members should consider to mitigate the risk of individual liability for data security failures: don’t make any alleged misleading statements about cybersecurity risks and practices; don’t conceal cybercrimes or obstruct proceedings; disclose use of website advertising technology; and implement reasonable data security practices.