---
title: Privacy and Data Breach Liability
description: An overview of legal principles and standards governing privacy and data breach liability in the United States.
keywords: 
  - privacy
  - data breach
  - liability
  - tort
  - negligence
category: law
---

## Introduction to Privacy and Data Breach Liability

Privacy is a fundamental right recognized under the common law and various state and federal statutes in the United States. The right to privacy encompasses an individual's interest in controlling the collection, use, and dissemination of their personal information. Data breaches, which involve the unauthorized access, acquisition, or disclosure of sensitive personal data, can give rise to liability for the entity responsible for safeguarding that information.

The legal principles governing privacy and data breach liability are rooted in tort law, with a focus on the duties owed by entities that collect and maintain personal data. Plaintiffs alleging privacy violations or data breach harms may bring claims sounding in negligence, breach of contract, or other common law or statutory causes of action. The specific elements, burdens of proof, and available remedies vary depending on the jurisdiction and the nature of the claim.

## Common Law Privacy Torts

Under the common law, several distinct privacy torts have been recognized, including: (1) intrusion upon seclusion, (2) public disclosure of private facts, (3) false light invasion of privacy, and (4) appropriation of name or likeness. See Restatement (Second) of Torts §§ 652A-652E. These torts impose liability on individuals or entities that violate an individual's reasonable expectation of privacy.

To establish a claim for intrusion upon seclusion, a plaintiff must show that the defendant intentionally intruded, physically or otherwise, upon the plaintiff's solitude or seclusion in a manner that would be highly offensive to a reasonable person. See Restatement (Second) of Torts § 652B. In the data breach context, this tort may apply where an entity's lax security measures enable the unauthorized access of sensitive personal information.

The tort of public disclosure of private facts requires the plaintiff to demonstrate that the defendant publicly disclosed a private fact about the plaintiff, the disclosure would be highly offensive to a reasonable person, and the matter disclosed is not of legitimate public concern. See Restatement (Second) of Torts § 652D. This cause of action may arise where a data breach results in the public dissemination of an individual's private information.

## Statutory Privacy and Data Breach Laws

In addition to common law privacy torts, federal and state legislatures have enacted various statutes to govern the collection, use, and protection of personal information. For example, the Health Insurance Portability and Accountability Act (HIPAA) imposes strict privacy and security requirements on covered entities that handle protected health information. See 45 C.F.R. Parts 160, 164. Entities that fail to comply with HIPAA's mandates may face civil and criminal penalties. See 42 U.S.C. § 1320d-5, 1320d-6.

Similarly, the Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide notice to consumers about their information-sharing practices and to implement safeguards to protect the security and confidentiality of customer information. See 15 U.S.C. §§ 6801-6809. Violations of the GLBA can result in enforcement actions by federal regulatory agencies. See 15 U.S.C. § 6805.

Many states have also enacted data breach notification laws that require entities to provide timely notice to affected individuals and, in some cases, state authorities, following a data breach incident. See, e.g., Cal. Civ. Code § 1798.82; N.Y. Gen. Bus. Law § 899-aa. These statutes aim to empower consumers to take steps to mitigate the potential harms associated with the unauthorized access or acquisition of their personal information.

## Negligence-Based Data Breach Claims

In the absence of a specific privacy or data breach statute, plaintiffs may bring common law negligence claims against entities that fail to adequately safeguard personal information in their possession. To establish a negligence claim, the plaintiff must prove: (1) the defendant owed a duty of care to the plaintiff, (2) the defendant breached that duty, (3) the breach was the proximate cause of the plaintiff's injury, and (4) the plaintiff suffered actual damages. See Restatement (Third) of Torts: Liability for Physical and Emotional Harm § 6.

In the data breach context, courts have recognized that entities that collect and maintain personal information have a duty to exercise reasonable care in protecting that information from unauthorized access or disclosure. See, e.g., Sackin v. TransPerfect Glob., Inc., 278 F. Supp. 3d 739, 749 (S.D.N.Y. 2017). The breach of this duty, such as through inadequate security measures, can form the basis of a negligence claim if the plaintiff suffers cognizable harm as a result.

Plaintiffs in data breach cases often allege that they have suffered economic damages, such as the cost of credit monitoring services or the increased risk of identity theft or fraud. However, courts have been divided on whether this type of harm is sufficient to establish standing or satisfy the damages element of a negligence claim. See, e.g., Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010); Attias v. CareFirst, Inc., 865 F.3d 620, 628-29 (D.C. Cir. 2017).

## Contractual and Other Claims

In addition to tort-based claims, plaintiffs may assert contract-based causes of action arising from a data breach incident. For example, if an entity's privacy policy or terms of service create an express or implied contractual obligation to safeguard personal information, the breach of that obligation may give rise to a breach of contract claim. See, e.g., In re Adobe Sys., Inc. Priv. Litig., 66 F. Supp. 3d 1197, 1215-16 (N.D. Cal. 2014).

Plaintiffs may also bring claims for breach of fiduciary duty, unjust enrichment, or violations of state consumer protection statutes in the data breach context. The viability of these claims will depend on the specific facts and circumstances of the case, as well as the applicable state law.

## Remedies and Damages

Successful plaintiffs in privacy and data breach cases may be entitled to a range of legal remedies, including compensatory damages, injunctive relief, and, in some cases, statutory damages or penalties. Compensatory damages may cover economic losses, such as the cost of credit monitoring or identity theft protection, as well as non-economic harms, such as emotional distress. See, e.g., Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 639-40 (7th Cir. 2007).

Injunctive relief, such as an order requiring the defendant to implement enhanced security measures or to refrain from certain data collection or sharing practices, may also be available to address ongoing or future privacy violations. See, e.g., In re Target Corp. Customer Data Sec. Breach Litig., 64 F. Supp. 3d 1304, 1310-11 (D. Minn. 2014).

In cases involving statutory violations, plaintiffs may be entitled to recover statutory damages or civil penalties, which can provide a meaningful deterrent to data breach incidents and incentivize entities to prioritize data security. See, e.g., 15 U.S.C. § 45(m)(1)(A) (authorizing civil penalties of up to $43,792 per GLBA violation).