ABSTRACT
Following a data breach or other cyberattack, the concept of reasonable duty is essential to nearly all of a plaintiff’s potential causes of action, such as negligence, negligence per se, breach of contract, breach of fiduciary duty, shareholder derivative, and any number of statutory claims. The impact of an organization’s discretionary choices, such as whether to take specific security steps for a system, may result in potential risk to an individual, another organization, or the organization itself. Although organizations regularly engage in risk analysis, organizations have no idea what security steps will be considered reasonable in a court of law and are therefore not able to make accurate calculations. Attorneys are likewise unable to confidently advise their clients on how to best avoid liability. This paper examines, in detail, potential sources of reasonably defining duty, and how organizations and attorneys might consider legal duty through the lens of cybersecurity risk management.
Specifically, I call for a two-part analysis of duty: static, or objective duty informed by industry practices, and dynamic, or subjective duty informed by situational risk. By offering a model for analyzing what cybersecurity duty ought to be, organizations can adequately understand how potential legal risk might be evaluated and implement practices to protect would-be plaintiffs and avoid liability. Moreover, courts can use this model to better inform whether organizations have made decisions that avoid real, foreseeable risk to the plaintiff. Indeed, amidst an increasing frequency and diversity of cyberliability claims, legal analysis informed by actual risk analysis ensures that reasonable, rather than perfect, cybersecurity can be developed precedentially over time.
Tschider, Charlotte, Locking Down ‘Reasonable’ Cybersecurity Duty (February 19, 2022).
First posted 2022-04-05 09:00:56
Leave a Reply