Data Breaches Increase Seven-Fold In One Year

According to a report by California’s attorney general, 18.5 million Californians were victims of cyber intrusions or data breaches in 2013. Remarkably, this was up from 2.5 million in 2012, a seven-fold increase. (Note that two major data breaches at Target and LivingSocial account for much of the increase.) A copy of the report is linked below, and this article summarizes the report.

The study breaks down the cause of the various breaches, with 53% caused by cyber incursions (e.g., hacking and malware), 26% arising from physical loss or theft, and the remainder coming from unintentional errors or deliberate misuse.

This report is yet another sign that the threat of data loss continues to increase dramatically. While the report focuses on breaches affecting consumer information, it has broader application to companies seeking to protect their proprietary information. Measures necessary to enhance data security and protect trade secrets overlap. Network security is at the heart of these efforts, and companies need to be willing to invest significant resources to keep their networks safe.

But network security is not the only area of concern. This report shows that the loss or theft of computers and other storage media presents another significant risk. For companies seeking to protect their trade secrets, this problem presents on various fronts. For example, companies need to make sure that company-issued computers, smartphones, and media have sufficient protections in case they are lost or stolen. Also, and more problematic, companies need to understand how their employees are using company documents and information on their personal devices. Similarly, companies need to keep tabs on how third parties, like vendors and consultants, are protecting shared proprietary documents.

I have frequently written about the need for companies to implement a trade-secrets policy. This policy would address these issues. For example, it could require that all proprietary documents are encrypted. And it could make sure that these documents are disseminated narrowly, to those employees who need them to do their jobs. For those companies that fail to implement and enforce necessary restrictions, the loss of proprietary information may be inevitable.

2014 California Data Breach Report

Slightly Off Topic: Major Opinion Changes the Standard for Unfair Trade Practices Claims in Florida

I’m going to take a brief detour from trade-secrets issues today, and instead wander in to the world of the Florida Deceptive and Unfair Trade Practices Act (FDUTPA). This statute, like many state consumer-protection laws, prohibits unfair trade practices, among other things.

Prior to this week, Florida courts have defined an unfair trade practice as one that is immoral, unethical, oppressive, unscrupulous, or substantially injurious to consumers. (The definition of consumer includes just about all individuals and business entities.) This broad standard allowed FDUTPA to serve as the Swiss Army Knife of claims, since it could apply to diverse types of bad acts. For example, I obtained a judgment for violating FDUTPA where my client’s former independent contractor started a competing business using my client’s proprietary information. (So there’s at least some connection between FDUTPA and trade secrets, since FDUTPA claims could be brought in a misappropriation action.)

But this week, in Porsche Cars North America, Inc. v. Peter Diamond, Florida’s Third District Court of Appeal changed the standard. Now, an unfair trade practice is one that causes injury to a consumer that (1) must be substantial, (2) must not be outweighed by any countervailing benefits to consumers or competition that the practice produces, and (3) must be an injury that the consumers could not reasonably have avoided.

This revised definition, and the third prong in particular, will make it more difficult to bring unfair-trade-practice claims.

As a result of this decision, there is now a district split on this issue. It will be interesting to see if this case gets appealed, and if so, whether the Florida Supreme Court settles the issue.