- within Environment, Tax, Government and Public Sector topic(s)
- with Senior Company Executives, HR and Finance and Tax Executives
- in Canada
- with readers working within the Accounting & Consultancy, Automotive and Business & Consumer Services industries
On March 5, 2013 the California District Court1 dismissed a proposed class action against LinkedIn arising from hackers infiltrating LinkedIn’s computer system.
In June 2012 hackers infiltrated LinkedIn's computer system and posted approximately 6.5 million user passwords on the Internet. Following the breach, LinkedIn increased the security of its password encryption method from a "hashed" format, in which the passwords were converted into an unreadable encrypted format, by adding the additional step of "salting", in which random values were added to the passwords before they were "hashed". A class action was filed in November 2012 on behalf of LinkedIn's Premium Account holders, on the grounds that they had paid a fee for LinkedIn services which included a promise by LinkedIn that their information would be secured in accordance with industry standard protocols and technology. The Plaintiffs based their claim in contract and in negligence. LinkedIn filed a preliminary motion to dismiss the class action on the grounds that the Complaint filed by the Plaintiffs did not allege sufficient injury to establish the Plaintiffs' standing to advance the claim in U.S. Federal Court. The Court granted LinkedIn’s motion and identified a number of deficiencies in the proposed class action.
First, the Plaintiffs did not allege in the Complaint that they actually paid for the security services they alleged were not provided. The LinkedIn User agreement and Privacy Policy for the Premium Account holders was the same as for the non-paying basic membership. The Plaintiffs had not demonstrated that the alleged promise of a particular level of security was part of the contract and therefore could not establish a breach of contract. As the Plaintiffs based their claim in negligence on an alleged duty of care arising from the contractual duty to provide a certain level of security, the claim of negligence also failed.
Second, the Plaintiffs did not allege that they actually read the Privacy Policy that included the alleged misrepresentation with respect to the level of security provided and therefore could not have relied on the alleged misrepresentation in contracting with LinkedIn.
Finally, the Plaintiffs' Complaint did not included sufficient facts to establish that they suffered damages resulting from the system breach. The Plaintiffs alleged that they did not receive the security they contracted for and therefore suffered economic loss as a result of the system breach. However, the alleged economic loss occurred prior to the system breach and therefore could not be considered “resulting damage” from the breach. The Plaintiffs did not allege that they had suffered any actual harm as a result of the system breach, for example, theft of their personally identifiable information, nor did they allege that they were exposed to an increased risk of future harm in the form of identity theft or theft of personally identifiable information. Consequently, the Complaint did not allege the necessary element of resulting damage from the system breach and did not meet the threshold to maintain an action in U.S. Federal Court.
The dismissal of the Plaintiffs’ Complaint was on terms allowing the Plaintiffs to amend the complaint and, if possible, correct some or all of the deficiencies such that the Complaint could proceed in U.S. Federal Court.
Footnotes
1. In Re LinkedIn User Privacy Litigation, Case No.: 5: 12-CV-03088 EJD, U.S. District Court, Northern District of California,(San Jose), March 5, 2013.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
