Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Jeff Paravano, Michelle Hervey, Nick Mowbray Speak to Tax Club of Cleveland

Antitrust Advocate

Courts Split on FTC’s Authority to Issue Noncompete Rule

Employment Law Spotlight

Sunshine State Update: New Florida Law Forbids Local Employment Regulation in Three Areas

Daniel Kaufman Comments on FTC Monitoring of Consumers’ “Right to Repair”

As highlighted in the Data Security Incident Response Report, government entities such as universities, medical centers, public utilities and transportation services companies have become highly sought-after targets of cyber litigation, as they increasingly rely on technology to provide essential services to millions of citizens. Yet whether enshrined in a state’s constitution or statute or a concept of judicial creation, the general principles of sovereign immunity can potentially shield the government and its agencies from civil liability, for most claims, in the wake of a data breach.  

core/paragraph

We have seen a recent trend in which plaintiffs are attempting to creatively expand a government’s cyber liability by arguing that personal identifiable information (PII) is a property right, and thereby attempting to capitalize on the waiver of sovereign immunity involving individuals’ property rights. See, e.g., N.M. Stat. § 41-4-6 (waiving sovereign immunity for property damages resulting from a public employee’s negligence); Minn. St. Ann. § 3.736 (waiving sovereign immunity for property damage under certain conditions). Plaintiffs are also attempting to expand a government’s cyber liability by arguing that government entities, in particular medical centers, have voluntary contractual obligations under the Health Insurance Portability and Accountability Act (HIPAA) when personal health information (PHI) is involved.

Despite plaintiffs’ best efforts, government entities still have many options to defend against these creative attempts. First, a privacy interest in one’s PII does not automatically equate to a property interest in that information. In fact, courts have repeatedly concluded that although there is a privacy interest in a person’s driver’s license number, Social Security number, address, etc., the law has not framed these protections as property rights. See, e.g., Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 695 (7th Cir. 2015) (refraining from taking a position on the plaintiffs’ property right theory); Quintero Cmty. Ass’n, Inc. v. Hillcrest Bank, 2014 WL 1764791, at *5 (W.D. Mo. May 2, 2014) (“Having a privacy interest in personal information, however, does not necessarily mean that [plaintiff] has a present property interest in that same information.”), aff’d sub nom. Quintero Cmty. Ass’n Inc. v. F.D.I.C., 792 F.3d 1002 (8th Cir. 2015).

Second, some states have already rejected plaintiffs’ attempts to expand an individual’s intangible PII or PHI “property right” to the same protections as for tangible property. This is because these states have expressly limited waivers of sovereign immunity to tangible property interests only. See, e.g., McConnell v. Dep’t of Labor, 345 Ga. App. 669, 671 (Ct. App. 2018) (defining “loss” as “damage to tangible property”); Univ. of Tex Health Science Ctr. at Houston v. DeSoto, 401 S.W.3d 319, 325 (Tex. Ct. App. 2013) (concluding that sovereign immunity is waived when the injury is “proximately caused by the condition or use of tangible property.”); Bufford v. Pa Dep’t of Transp., 670 A.2d 751, 753 (Pa. Comm. Ct. 1996) (concluding that sovereign immunity is waived when “the personal property itself causes the plaintiff’s injury.”) (emphasis in original).

Thus, although we expect plaintiffs to continue to try to erode sovereign immunity, governmental and quasi-governmental entities should not give up on these protections without a fight.

Sovereign Immunity Is Alive and Well, Even After a Cyberattack

Featured Insights

Related Services

Featured Insights