Credit-Monitoring Damages in Cybersecurity Tort litigation
![handle is hein.journals/gmlr19 and id is 115 raw text is: 2011]
CREDIT-MONITORING DAMAGES IN CYBERSECURITY
TORT LITIGATION
Vincent R. Johnson'
INTRODUCTION
When someone improperly accesses or discloses an individual's per-
sonal information, the subject of that data breach is often at an increased
risk of identity theft.' One way for an affected data subject to guard against
this risk is to subscribe to a credit-monitoring service. In this type of ar-
rangement, a business reviews information, generally on a daily basis, from
one or more of the major credit-reporting agencies.2 When a change in the
data subject's credit history occurs, such as the unauthorized opening of a
new account in the victim's name, the service alerts the data subject.' As a
result, the victim of a data-security breach can take prompt action to minim-
ize the consequences of identity theft and can, perhaps, avoid financial
ruin.4 Remedial steps may include closing an unauthorized account, placing
a fraud alert in a credit-reporting agency's files, freezing distribution of
credit reports, or obtaining a declaratory judgment that the data subject is
the victim of identity theft, which may aid the data subject in dealing with
law enforcement authorities.'
Professor of Law, St. Mary's University School of Law. Yale University, LL.M.; University of
Notre Dame, J.D.; St. Vincent College, B.A., LL.D. Professor Johnson's books include: STUDIES IN
AMERICAN TORT LAW (4th ed. 2009) (with Alan Gunn); MASTERING TORTS: A STUDENT'S GUIDE TO
THE LAW OF TORTS (4th ed. 2009); and ADVANCED TORT LAW: A PROBLEM APPROACH (2010).
1 See generally Vincent R. Johnson, Cybersecurity, Identity Theft, and the Limits of Tort Liabili-
ty, 57 S.C. L. REV. 255, 256-57 (2005) (discussing the potential adverse consequences of database
intrusion). The fact that data disclosure increases the risk of identity theft is so well established that
some defendants do not contest the issue. See Rowe v. UniCare Life & Health Ins. Co., No. 09 C 2286,
2010 WL 86391, at *5 (N.D. Ill. Jan. 5, 2010) (noting that the defendants responsible for personal in-
formation being temporarily available on the Internet did not seem to challenge whether Rowe and the
purported class members were put at a 'substantial risk' of identity theft or some other harm).
2 See Credit Monitoring Services: A Comparison, AAACREDITGUIDE.COM,
http://aaacreditguide.com/credit-monitoring-services/ (last visited Sept. 20, 2011).
3 See id.
4 See Remsburg v. Docusearch, Inc., 816 A.2d 1001, 1008 (N.H. 2003) (Victims of identity theft
risk the destruction of their good credit histories. This often destroys a victim's ability to obtain credit
from any source and may, in some cases, render the victim unemployable or even cause the victim to be
incarcerated.); see also Guillermo Contreras, Key Figure Admits Guilt in Huge ID Theft Case, SAN
ANTONIO EXPRESS-NEWS, Apr. 6, 2011, at 2B (indicating that victims of identity theft found it hard to
get loans and faced lingering headaches in trying to straight[en] things out).
5 See Johnson, supra note 1, at 259-61 (discussing remedial and preventive options); see also
James Graves, Note, Medical Monitoring for Non-Medical Harms: Evaluating the Reasonable Ne-
113](ViewImageLocal?handle=hein.journals/gmlr19&div=6&collection=&method=preview&ext=.png&size=3)
What Is HeinOnline?
Contact us for annual subscription options:
Already a HeinOnline Subscriber?
profiles profiles most
Credit-Monitoring Damages in Cybersecurity Tort litigation
Contact us for annual subscription options:
Already a HeinOnline Subscriber?
profiles profiles most