Victims of a privacy breach may no longer have to rely on proving economic loss as a result of the privacy breach to sustain a third party action. They can also show the breach caused mental anguish. Aaron Konarsky, director of risk management and integrated controls at Canada Lands Co., spoke as a panel member during the Risk and Insurance Management Society (RIMS) Canada's Annual Conference in Ottawa on Sept. 20. The theme of the seminar was, 'Privacy Update: Hot Issues for Risk Professionals.'
"Traditionally, in a third party action against an organization, you have to prove that the loss of information would result in economic loss of the individual," Konarsky told delegates. "So basically, someone took your information, they put a bogus mortgage on your property or they used your identity to borrow – those are economic losses that would generally sustain a third party action." But now the tide has turned, Konarsky noted. U.S. caselaw is on the books suggesting that victims need only prove the breach caused them mental anguish.
In the United States a few years ago, the Department of Veteran Affairs accidentally released medical records of their veterans. The case eventually settled for $20 million. But the case was not about those records being used for economic advance.
"The case was around these veterans' personal medical information being out there, and the mental anguish they suffered worried about what would happen to it," said Konarsky. "Would they be embarrassed? and whose hands would that information fall into?
"There is the blue print for what we see going forward as far as civil exposure for organizations. You don't have to prove economic loss. If you suffered mental anguish, that's actionable as a third party loss."