Takeaway: This case reinforces the importance of employers taking appropriate steps to prevent the disclosure, including by way of data breach, of sensitive personal and confidential information from their employees. This duty becomes especially important when the employer requires the employee to provide such information and then makes a contractual promise to safeguard it.
In the event of a data breach, while it may appear that no harm occurred because the employee did not actually experience identity theft or fraud, circumstances exist where the harm may nevertheless be more than hypothetical and thus give the employee standing to bring claims against the employer.
When receiving sensitive data, employers must implement effective security measures. As personal information dwells increasingly in the digital realm, the risks will continue to multiply, and adequate preparation is essential.
The 3rd U.S. Circuit Court of Appeals held that a former employee of a biopharmaceutical company could sue the company for a data breach that resulted in the publication of her sensitive personal information on the dark web. Rejecting the company's argument that the absence of any actual harm to the former employee deprived her of standing, the court held that the risk of harm from the publication of the information and the former employee's alleged emotional distress and mitigation expenditures established injury sufficient to allow her to bring her claims.
The former employee had an...
During August 2026, a series of misleading, fabricated and falsely contextualised claims circulated across social media platforms and media accounts in Bharat. The claims covered electoral rolls, ...