data breaches can lead to a potpourri of claims

In re Blackbaud, Inc., Customer Data Breach Litig., No.
3:20-mn-02972-JMC, MDL No. 2972, 2021 WL 3568394 (D.S.C. Aug. 12, 2021)

Query whether this kind of case will come out differently as
TransUnion v. Ramirez gets further assimilated into the law.

Blackbaud (good name!) “provides data collection and
maintenance software solutions for administration, fundraising, marketing, and
analytics to social good entities such as non-profit organizations,
foundations, educational institutions, faith communities, and healthcare

It stores both PII and Protected Health Information from its
customers’ donors, patients, students, and congregants. Plaintiffs “represent a
putative class of individuals whose data was provided to Blackbaud’s customers
and managed by Blackbaud,” thus they weren’t direct customers of Blackbaud.

In early 2020, “cybercriminals orchestrated a two-part
ransomware attack on Blackbaud’s systems,” copying plaintiffs’ data and holding
it for ransom. The cybercriminals then attempted but failed to block Blackbaud
from accessing its own systems. “Blackbaud ultimately paid the ransom in an
undisclosed amount of Bitcoin in exchange for a commitment that any data
previously accessed by the cybercriminals was permanently destroyed.” [Um. That
commitment seems … hard to believe?]

Plaintiffs alleged that the attack resulted from Blackbaud’s
“deficient security program” and failure to comply with industry and regulatory
standards. Its forensic report found that “names, addresses, phone numbers,
email addresses, dates of birth, and/or SSNs” were disclosed in the breach but allegedly
improperly concluded that there was no credit card data taken. Plaintiffs also
alleged that Blackbaud failed to provide them with timely and adequate notice
of the attack and the extent of the resulting data breach. In its July 2020
disclosures, Blackbaud asserted that the cybercriminals did not access credit
card information, bank account information, or SSNs. But its September 2020
Form 8-K with the Securities and Exchange Commission said that SSNs, bank
account information, usernames, and passwords might have been taken. This
litigation followed.

This opinion addresses certain statutory claims, highlighting
variation around the country in both specific data breach and general consumer
protection claims.

California Consumer Privacy Act :


provides a private right of action
for actual or statutory damages to “[a]ny consumer whose nonencrypted and
nonredacted personal information … is subject to an unauthorized access and
exfiltration, theft, or disclosure as a result of the business’s violation of
the duty to implement and maintain reasonable security procedures and practices
appropriate to the nature of the information to protect the personal

Blackbaud argued that it was not a “business” regulated by
the Act. Short answer: it was adequately alleged to be one.

California Confidentiality of Medical Information Act: One
plaintiff plausibly alleged that her “medical information” was disclosed during
the attack, and that Blackbaud plausibly qualified as a “medical provider”
under the CMIA despite its lack of direct contact with her.

Florida Deceptive and Unfair Trade Practice Act: Monetary
recovery requires “(1) a deceptive act or unfair practice; (2) causation; and
(3) actual damages.” Blackbaud’s alleged bad practices were failing to adopt
reasonable security measures and adequately notify customers and Plaintiffs of
the data breach; misrepresenting that certain sensitive PII was not exposed
during the breach, that it would protect Plaintiffs’ PII, and that it would
adopt reasonable security measures; and concealing that it did not adopt
reasonable security measures. However, the Florida plaintiffs failed to sufficiently
allege actual damages, which under FDUTPA are “economic damages related solely
to a product or service purchased in a consumer transaction infected with
unfair or deceptive trade practices or acts.” A plaintiff may not recover for
“damage to property other than the property that is the subject of the consumer
transaction.” Here, Blackbaud’s data management software was “the property that
is the subject of the consumer transaction,” not the data itself. And these
plaintiffs didn’t allege damage to that property, only to their own bank
accounts, emotional well-being, and data.

However, the Florida plaintiffs did state a claim for
injunctive relief, since FDUTPA makes “declaratory and injunctive relief
available to a broader class of plaintiffs than could recover damages,” as long
as a plaintiff is “a person ‘aggrieved’ by the deceptive act or practice.” Plaintiffs
alleged that Blackbaud’s misrepresentations and omissions about its security
efforts and the scope of the Ransomware Attack “prompted them to take
mitigation efforts out of fear that they were at an increased risk for fraud or
identity theft.”

New Jersey Consumer Fraud Act: Blackbaud argued that its
services weren’t within the scope of the NJCFA because it sells services to
sophisticated businesses and entities, not the general public. The NJCFA prohibits
a person from using an “unconscionable commercial practice, deception, fraud,”
or the like “in connection with the sale or advertisement of any merchandise or
real estate.” Merchandise is defined as “any objects, wares, goods commodities,
services or anything offered, directly or indirectly to the public for sale.” New
Jersey courts have said that the law’s applicability “is limited to consumer
transactions which are defined both by the status of the parties and the nature
of the transaction itself.” Although the NJCFA does not define “consumer,” New
Jersey courts have interpreted the term to mean “one who uses economic goods
and so diminishes or destroys their utilities.” A plaintiff does not qualify as
a “consumer” if they do not purchase a product for consumption. Thus, the NJ
plaintiffs weren’t “consumers” entitled to the protection of the NJCFA. Nor
were donations to the entities that transacted with Blackbaud enough. Donors
are not “consumers” under the NJCFA because they are “not being approached in
their commonly accepted capacity as consumers” and a donation “involves neither
commercial goods nor commercial services.” Plaintiffs didn’t allege that they
purchased or used Blackbaud’s services, knew Blackbaud existed, or perceived
that Blackbaud managed their data.

New York General Business Law § 349: This requires a
consumer-oriented practice, which occurs if it has “a broader impact on
consumers at large,” or “something more than a single-shot consumer transaction
or a contract dispute unique to the parties.” However, GBL § 349 does “not
impose a requirement that consumer-oriented conduct be directed to all members
of the public[.]” Unsurprisingly, the allegations here adequately established
consumer-oriented conduct.

Privity isn’t required under GBL § 349, so it was irrelevant
that the NY plaintiffs weren’t direct consumers of Blackbaud. Section 349(h)
specifically empowers “[a]ny person who has been injured by reason of any
violation of this section” to bring an action. GBL § 349(h). “The critical
question, then, is whether the matter affects the public interest in New York,
not whether the suit is brought by a consumer or a competitor.”

Pennsylvania Unfair Trade Practices and Consumer Protection
Law: The UTPCPL provides a private cause of action to “[a]ny person who
purchases or leases goods or services primarily for personal, family or
household purposes and thereby suffers any ascertainable loss of money or
property, real or personal, as a result of the use or employment by any person
of a method, act or practice declared unlawful” by the Act. “It is the
plaintiff’s burden to prove justifiable reliance in the complaint.” Again
unsurprisingly, the Pennsylvania plaintiff failed to sufficiently allege
reliance on Blackbaud’s misrepresentations and omissions. She instead alleged
that she was “required to provide her PHI to her healthcare provider as a
predicate to receiving healthcare services[,]” and didn’t allege that she knew
that Blackbaud maintained her data or was that she was exposed to
representations Blackbaud made to her or her healthcare provider. Her
allegation that she “would not have entrusted her Private Information to one or
more Social Good Entities had she known that one of the entity’s primary cloud
computing vendors entrusted with her Private Information failed to maintain
adequate data security” was merely conclusory. Courts sometimes presume
reliance, but only in cases involving life-threatening defects.

South Carolina Data Breach Security Act: The provision plaintiffs
sued under covered only entities that “own[] or licens[e] computerized data or
other data that includes personal identifying information,” requiring them to
notify South Carolina residents in the event of a data breach; Blackbaud didn’t
own or license the data; its possession was insufficient. True, a separate
provision of the law required someone “maintaining computerized data or other
data that includes personal identifying information that the person does not
own” to notify the owner or licensee after a data breach, but plaintiffs didn’t
assert claims under that provision.  

from Blogger

This entry was posted in Uncategorized and tagged , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s