
Unto the (Data) Breach
Read Full Article (PDF)
Since the early 2000s, U.S. courts have begun hearing “data breach” liability cases, the inevitable result of a growing internetconnected technology infrastructure. The relatively recent development of case law signals a body of law in development, stunted by significant limiting factors that prevent the coalescence of legal principles. To date, no holistic empirical exploration of data breach cases has offered sufficient detail to explore these factors.
This descriptive empirical study analyzes, in detail, 225 data breach cases from 2005–2022, reviewing these cases over an extended period to descriptively identify key trends and changes within a bona fide data breach case’s life on the docket.
This study tests common perceptions of data breach litigation, including Article III standing challenges that have presented a
nearly insurmountable obstacle to data breach litigation. This study also identifies the type of plaintiff, settlement amounts, type and disposition of information compromised, claims, common motions, and key strategies most likely to result in a favorable plaintiff outcome, including key impediments. These results will provide crucial information for litigating parties, their counsel, judges, and policymakers.
Charlotte Tschider *
* Charlotte Tschider is an Associate Professor of Law at the Loyola University Chicago School of Law. I would like to thank David Schwartz, Josephine Wolff, Mark Lemley, Christopher Yoo, Mark McKenna, Bryan Choi, Brett Frischmann, Matthew Sag, Justin (Gus) Hurwitz, David Thaw, Steven Bellovin, and participants in the 2024 Junior Faculty Forum for Law and STEM for comments on various stages of this Article. A special thanks to Jay Edelson and Aaron Charfoos for their perspectives on data breach litigation and for offering their expertise with my classes on this topic. I would especially like to thank Annalisa Kolb for her exceptional research skills generating and validating cases in this study. For access to the full data set, please contact me at ctschider@luc.edu with the subject “Data Breach Study.”