Allen v. Vertafore, Inc.

1 Analyses of this case by attorneys

  1. Lead Article: Private Data Breach Litigation Comes of Age

    Quinn Emanuel Urquhart & Sullivan, LLPFebruary 13, 2023

    wish to make against companies who, because of a breach, have failed to protect their PI. Some data breach plaintiffs have attempted to weaponize the DPPA, which provides for actual damages or liquidated damages in the amount of $2,500 (whichever is greater), punitive damages, reasonable attorneys’ fees, and a private right of action. However, courts thus far have been largely unreceptive to DPPA claims in the data breach context. Instead, they have distinguished the DPPA in two ways: (1) it “imposes civil liability only on a defendant who obtains personal information from a motor vehicle record, but not on a defendant who merely obtains information that can be linked back to (i.e., derived from) such a record,” Garey v. James S. Farrin, P.C., 35 F.4th 917, 927 (4th Cir. 2022); and (2) the statute is not triggered because the act of storing driver’s license information on unsecured external servers does not constitute “disclosure” within the meaning of DPPA, Allen v. Vertafore, Inc., 28 F.4th 613, 617 (5th Cir. 2022).Accordingly, due to the limitations of federal law, state statutory and common-law claims have been the primary focus of private data breach litigation to date.b) The Cornucopia of Options That State Law Provides to Private LitigantsData breach plaintiffs have pursued scores of disparate state statutory and common-law claims. Such plaintiffs often shoehorn as many as possible into their complaints, thereby adopting a blunderbuss pleading strategy to try to maximize their settlement leverage and preserve as many claims as possible. A court, in addressing these claims, often faces unique problems when undertaking the choice-of-law analysis—especially because the rise of data on the cloud obfuscates the location of the injury (i.e., the breach), which may play an important role in the choice-of-law determination. Further complexity is introduced by the fact that the court may have to juggle separate state contract claims governed by different choice-of-law rules (e.g., the place where th