When Fast Is Too Slow: Notification Compliance Following Target’s Data Breach

On December 19, 2013, Target publicly announced that computer hackers had stolen data from as many as 40 million credit and debit cards of shoppers who visited its stores from November 27 to December 15. On that same date, Target also emailed shoppers explaining that it uncovered the problem on December 15, and that it had informed authorities and financial institutions once it became aware of the breach.[1] Notably, news of the breach was first published by a blogger (Brian Krebs of http://krebsonsecurity.com/) on or about December 18, 2013, and the breach was widely reported by multiple news services on December 19, 2013. This was before Target had made any attempt whatsoever to notify affected customers thus creating the appearance that Target was dragging its feet.

As the news broke on December 19, Target released a statement from its CEO concerning the data breach. Target posted the message from its CEO on its corporate website instead of the shopping site regularly accessed by customers, leaving an opening for the allegation that the message was not designed to notify affected customers directly. The statement confirmed “that the information involved in this incident included customer name, credit or debit card number, and the card’s expiration date and CVV (the three-digit security code).”[2] A later press release further explained that the company was withholding additional details at the request of law enforcement and that the Department of Justice was investigating the security breach.[3]

This article addresses the ramifications of delay in notifying consumers, including (i) the state-level notification requirements; (ii) best practices in how a company should respond; and (iii) the risks of delay, whether the product of intentional delay or compliance with law enforcement requests.

1. Notification Requirements

Forty-six states and the District of Columbia have enacted legislation requiring notification of security breaches involving personal information.[4] Though state notification laws differ as to the manner of disclosure and individuals or entities that must be notified, most states uniformly require companies to notify customers of a breach when their personal information has been compromised.

Most states’ data breach statutes are vague about the timeliness of when a company must notify consumers of a data breach. In 29 states, disclosure of a breach must be made “in the most expedient time possible” and “without unreasonable delay.”[5] Six states require notification of the breach to be made “as soon as possible,” “as quickly as possible” or “as soon as practicable.”[6] The 12 remaining states impose a simple reasonableness requirement and require notice to be made “without unreasonable delay.”[7] The ambiguity of these terms may cause confusion for companies attempting to comply with states’ laws in the aftermath of a breach. So far, only Connecticut, Florida, Ohio and Vermont have mandated that notification be made within a specific time period, i.e., within 45 days of discovery of the breach.[8]

All states permit a reasonable delay in notifying affected customers where notification will impede a criminal investigation, and delay is permitted in order to comply with the legitimate needs of law enforcement.[9] Laws differ on whether the burden is on the law enforcement agency to request that the company delay the notification.

2. Responsiveness In Times Of Breach

The common theme among the states is that, if an entity is breached and personal information is taken, the breached entity has a duty to notify those potentially affected. A delay may be reasonable where it is necessary to discover the scope of the breach or in response to a request from law enforcement where disclosure would impede an investigation.

Where a large-scale data breach occurs, as in the case of Target, however, a company may be required to do more than the law requires in order to manage the public perception of responsiveness and mitigate attendant risks. From the public’s perspective, timely notification is critical to allow consumers the fair opportunity to secure their data through fraud alerts, credit freezes and communication with credit card companies. Timely disclosure also supports consumer confidence. In the case of Target’s breach, the apparent leak allowed public and media outlets the opportunity to react to the breach before an official announcement from Target. This created an appearance of impropriety. In turn, this apparent failure spurred dozens of lawsuits only days after news of the breach.

To ensure timely and effective notice to affected individuals, companies should immediately contact law enforcement agencies, such as the Federal Bureau of Investigation, the United States Secret Service and local police. In the case of a large-scale breach such as Target’s, many states also require that the business entity report the breach to the state’s attorney general and credit reporting agencies.[10] Notification also should be given to the affected individuals as fast as possible and in the manner in which normal communication is given, i.e., first class mail or email, if permitted. Where the identity of individuals affected by a breach is known, the company should notify all those persons. In order to mitigate legal and reputational risk for the company, the process for notification and all public disclosures relating to the same should be managed by a multidisciplinary team of privacy professionals assisted by competent outside counsel.

While Target may have acted in a legally prudent manner, Target’s announcement came after an outside source leaked information about a possible breach. The placement of the CEO’s message on the non-consumer website further aggravated the problem. The barrage of consumer lawsuits resulting from these alleged missteps suggests that, in addition to complying with requests of law enforcement agencies, companies that are the victims of a data breach must do their best to proactively manage possible unauthorized leaks and public communications when a breach is suspected.

3. Risks Of Delay

At this point, it is not clear how much time elapsed between Target’s discovery of the security breach and when it officially notified consumers of the breach. In a statement posted to Target’s website on December 19, CEO Gregg Steinhafel claimed, “Target alerted authorities and financial institutions immediately after we discovered and confirmed the unauthorized access. . . .”[11] At least one court has held, however, that a retailer cannot “rely[] on self-serving statements from its website that it learned of the security breach the same week it notified consumers” in order to show that it timely notified customers.[12]

The question going forward will be whether Target was sufficiently responsive. In the days following news of the breach, more than a dozen Target customers filed lawsuits against Target. In a complaint filed in the District of Minnesota, the plaintiff claimed that Target “indicated that it began investigating the incident ‘as soon as (they) learned of it,’ but it did not contemporaneously disclose the breach to Plaintiff and putative class members,” and that Target had “not made efforts to directly notify individuals whose information was compromised.”[13] While most states do not provide for a private right of action for failure to comply with the notification requirements,[14] some permit an injured customer to “institute a civil action to recover damages.”[15] For example, in addition to allegations of individual states’ notification statutes, plaintiffs have brought claims for failing to timely disclose the breach on grounds of negligence,[16] consumer fraud,[17] breach of implied contract,[18] concealment,[19] negligent misrepresentation,[20] and invasion of privacy.[21]

In addition to the fact that Target exposed itself to consumer class actions, United States senators from several states have called for an investigation by the Federal Trade Commission and Senate Banking Committee.[22] Target also suffered a decrease in sales during the holiday shopping season.[23] Target was likely hoping to minimize the publicity damage in the middle of its busiest shopping season by offering a 10 percent discount and free credit-monitoring services; however, this may be too little, too late to overcome the loss in consumer confidence.

It appears that the Target data breach was the first in a potential tsunami of similar breaches directed at business-to-consumer companies, especially retailers. [24] JPMorgan Chase CEO Jamie Dimon predicts that these breaches will become more common unless banks, retail stores and similar consumer-facing companies begin working together to further protect consumer data.[25] Business-to-consumer entities are at greater risk because potential hackers know they gather and retain consumer personal information. By comparison, business-to-business companies typically store only employee and related party information.

While it is likely cost prohibitive for consumer-facing companies to guarantee 100 percent protection of personal information via increased physical and electronic security, it is reasonable for the consuming public to expect earlier detection and responsiveness. The pending lawsuits against retailers like Target, enhanced enforcement by state attorney general offices, and the push for new legislation[26] should serve to shift the cost-benefit analysis in favor of enhanced security for personal information, earlier detection of breaches, and more effective management of breach incidents. With better data protection and breach detection measures in place, consumer-facing companies will be able to better protect and notify consumers.

4. Conclusion

Companies have a legal responsibility to notify consumers about incidents that have caused their personal information to be acquired by unauthorized persons. Providing consumers with early notice that their personal information has been breached enables them to mitigate damages by canceling credit cards and alerting credit bureaus to prevent further fraud, and, in turn, will minimize any potential loss of consumer confidence. General counsel are well advised to consult outside counsel concerning data breach management, especially when balancing the interests of law enforcement with those of the consuming public. While Target appears to have complied with the law, the leak about the breach and apparent lag time in public notice to consumers appear to have created an otherwise avoidable risk.