The bill is specifically trying to limit when class action lawsuits can be filed following a data breach.
What happened
The bill, LB241, introduced by Senator Bob Hallstrom, allows private entities that experience a data breach to not be liable in class action lawsuits, unless the breach was caused by the entity’s “willful, wanton or gross negligence.”
The bill would include private entities like corporations, religious organizations, associates, businesses and nonprofits. It also defines a cybersecurity event as “one that leads to unauthorized access to, disruption or misuse of nonpublic information, such as Social Security or driver’s license numbers or financial account information, security codes or passwords.”
The bill recently advanced from general file on Feb. 12th.
What they’re saying
Bob Hallstrom said the bill is designed to address the “surge” in class action lawsuits stemming from data breaches. He argues that these suits can clog the courts and are focused, often, on “potential losses” like identity theft, rather than actual monetary losses. He believes that the rise of lawsuits is hurting companies without helping individuals who are victims of breaches.
“Even with the existence of reasonable precautions – patches, updates [and] things that are taken care of by businesses on a regular routine basis – they still face hackers and ransomware…The bad actors are always a step ahead of them,” Hallstrom said.
Senator Robert Clements also supported the bill saying, “Even though we’re really trying hard, if we did have a breach, I think we could probably face a lawsuit in the millions of dollars and it could shut down my business.”
Others expressed concerns, saying that state and local level consumer protections are important now more than ever. Senator George Dungan said that the bill would limit a victim’s ability to seek redress, as willful neglect can be extremely challenging to prove. Senator Danielle Conrad said the bill would “favor big business over hardworking Nebraskans…LB241 provides a license to corporations large and small to act unreasonably – to act negligently – and to thus evade accountability through class action in state court.”
The big picture
The bill is now moving forward to a second round of debates. While the bill remains contentious, it could lay the groundwork for how other states handle future class action lawsuits regarding data breaches. Currently, lawsuits are seen as a reason for organizations to step up their cybersecurity practices, encouraging these businesses and nonprofits to prioritize data safety. Yet attacks remain frequent, serving as a reminder that organizations need to be constantly vigilant. Ultimately, it’s highly debatable if reducing class action lawsuits will increase breaches or keep numbers the same.
Abby Grifno
