If a company has told you your personal information was exposed, the notice by itself does not give you a right to money. Whether any compensation is possible depends on the law that applies and the conditions it sets.
You may be holding a letter or email saying your name, Social Security number, account numbers or medical details ended up in someone else's hands. It is natural to wonder whether the law treats the breach as a wrong done to you, and what, if anything, it does about it. This page explains where federal law and one California statute address data breaches, how class actions work under Federal Rule of Civil Procedure 23, and which steps official sources describe after a breach.
What Data Breach Compensation Means Under U.S. Law
A data breach is unauthorized access to, or acquisition of, personal information held by a company or organization. The exposure is the event. Whether anyone owes you anything for it is a separate question, and it depends on the law that applies and the conditions it sets.
The legal routes discussed on this page fall into two groups:
- Federal statutes, where one covers the company and the data involved.
- State laws, which differ from state to state.
A class action, covered below, is a way of bringing claims on behalf of a group.
Federal Statutes That Can Apply to a Data Breach
The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., governs consumer reporting agencies, furnishers and users of consumer reports. A consumer reporting agency is a company, such as a credit bureau, that assembles information about consumers into reports. A furnisher is a company that sends account information to a consumer reporting agency. Congress stated the FCRA's purpose in 15 U.S.C. § 1681(b). It is to require consumer reporting agencies to "adopt reasonable procedures," with regard to "the confidentiality, accuracy, relevancy, and proper utilization" of consumer information. The FCRA has its own remedy provisions. What they make potentially available depends on the conditions the statute sets, and whether the FCRA applies to a particular breach depends on its facts. Those provisions are covered on the page about consumer rights remedies.
The Federal Trade Commission Act, 15 U.S.C. § 45(a)(1), declares "unfair or deceptive acts or practices in or affecting commerce" unlawful. Section 45(a)(2) states that "The Commission is hereby empowered and directed to prevent" those practices.
State Law on Data Breaches
States have their own data breach notification laws, and their requirements differ from state to state.
California's rule is one example, and it is California's alone; other states differ. Under Cal. Civ. Code § 1798.150(a)(1), a consumer whose nonencrypted and nonredacted personal information, as defined in that section, or whose email address in combination with a password or security question and answer that would permit access to the account, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, may institute a civil action. The section lists these kinds of relief: damages in an amount not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater (the amounts are adjusted under § 1798.199.95(d)); injunctive or declaratory relief; and any other relief the court deems proper. These are what the statute allows a court to award, and only where its conditions are met.
Section 1798.150(b) adds a condition for statutory damages: before a consumer starts an action for statutory damages on an individual or class-wide basis, the consumer must provide the business 30 days' written notice identifying the specific provisions of the title the consumer alleges have been or are being violated. If a cure is possible and, within the 30 days, the business actually cures the noticed violation and gives the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual or class-wide statutory damages may be started against the business. The section states that implementing and maintaining reasonable security procedures and practices following a breach does not constitute a cure with respect to that breach, and that no notice is required before an individual consumer starts an action solely for actual pecuniary damages.
How Class Action Lawsuits Work in Data Breach Cases
A class action is a lawsuit brought by one or more named plaintiffs on behalf of a larger group of people. Everyone in the group has similar claims against the same defendant.
Under Federal Rule of Civil Procedure 23(a), one or more members of a class may sue as representative parties on behalf of all members only if:
- The class is so numerous that joining everyone individually is impractical.
- There are questions of law or fact common to the class.
- The named plaintiffs' claims are typical of the class.
- The representative parties will fairly and adequately protect the interests of the class.
Rule 23(c)(1)(A) directs the court to decide by order, at an early practicable time, whether to certify the action as a class action, which means allowing it to proceed on the group's behalf. Rule 23(b) then lists the types of class action that may be maintained once Rule 23(a) is satisfied.
A class settlement does not take effect on the parties' agreement alone: under Rule 23(e), the claims of a certified class may be settled only with the court's approval. If the proposal would bind class members, the court may approve it only after a hearing and only on finding that it is fair, reasonable, and adequate. This page states no typical amount; what a class member receives, if anything, depends on the terms of the settlement the court approves.
For a class certified under Rule 23(b)(3), the notice to class members must state that the court will exclude from the class any member who requests exclusion, and the time and manner for requesting exclusion. A member who does not request exclusion is covered by the class judgment (Rule 23(c)(3)(B)). The stages of a consumer lawsuit are laid out in how consumer lawsuits work.
The Role of the FTC
The Federal Trade Commission acts under 15 U.S.C. § 45. Under § 45(b), when the Commission has "reason to believe" that a company is using an unfair or deceptive act or practice, and a proceeding would be in the interest of the public, it issues and serves a complaint with notice of a hearing. If, after the hearing, the Commission is of the opinion that the act or practice is prohibited, it issues an order requiring the company "to cease and desist" from it. Section 45(a)(4)(B) states that all remedies available to the Commission for unfair and deceptive acts or practices are available for the acts and practices involving foreign commerce described in that paragraph, "including restitution to domestic or foreign victims."
The FTC also runs IdentityTheft.gov. Its credit freeze and fraud alert guidance describes completing an "FTC identity theft report at IdentityTheft.gov."
Steps a Consumer Can Take After Receiving a Data Breach Notice
Official sources describe several options available to a consumer after a breach. The FTC's page refers to completing an identity theft report at IdentityTheft.gov.
A credit freeze. According to the CFPB, a freeze "prevents prospective creditors from accessing your credit file." A consumer may freeze and unfreeze for free at each of the three nationwide credit reporting companies, contacting each one separately. A freeze placed by telephone or secure electronic means must be in place within one business day. A freeze requested by mail must be in place within three business days of receipt.
A fraud alert. The FTC describes an initial fraud alert as telling businesses to check with you before opening new credit. It lasts one year and can be renewed. You contact one bureau, and that bureau must tell the other two. An extended alert lasts seven years. It is available to people who have experienced identity theft and have completed an FTC identity theft report at IdentityTheft.gov or filed a police report.
Free credit reports. Under 15 U.S.C. § 1681j(a), the nationwide consumer reporting agencies must give a free disclosure once in any 12-month period on request. For the nationwide agencies described in section 1681a(p), the request must go through the centralized source, and the report must be provided within 15 days of receiving it. Section 1681j(c)(3) also provides a free disclosure once in a 12-month period to a consumer who certifies in writing a reason to believe the file is inaccurate due to fraud. Errors found on a report can be disputed under the FCRA, as the page on wrong late payments explains.
If You'd Like a Consumer Rights Case Review
Breach cases turn on details a general page cannot weigh. This page explains how U.S. law treats data breaches generally. It does not evaluate any one person's facts.
A reader may request a consumer rights case review through Federal Consumer Rights.
