Cyber Security, Data Breaches and the Board of Directors

The creation and maintenance of effective cyber security systems and programs is becoming progressively important to Canadian corporations. The increase in the occurrence of, and costs associated with, data breaches, new and creative causes of action relating to data breaches, as well as greater government monitoring and regulation of corporate cyber security matters generally have made it a matter of company-wide concern and a matter to be addressed at the board level.

This article will examine why board oversight of these programs has become necessary by reviewing:

This article will end by summarizing some best practices (see Best Practices) a corporation’s board can employ to:

A corporation’s shareholders elect a board of directors to oversee and manage the business and affairs of the corporation. As part of this task, the board appoints officers to run day-to-day operations, proposes strategies and objectives, and implements corporate plans. If the corporation is a public company, the board also oversees corporate compliance with provincial and territorial securities laws, including corporate governance standards and continuous disclosure regulatory requirements.

Federal as well as provincial and territorial corporate laws enshrine the core fiduciary duty and duties of care, diligence and skill of each member of a board of directors. In accordance with their fiduciary duties, each member of a board of directors must demonstrate loyalty towards the corporation and act honestly, in good faith and in the best interests of the corporation (not in their personal interest). In accordance with their other statutory duties, each member of a board must exercise the care, diligence and skill a reasonably prudent person would exercise in comparable circumstances. To learn more about the duties of a board of directors, please see the following Practice Notes (subscription required):

Ultimately, a corporation’s financial, reputational and operational success rests on the board. Those appointed to the board must ensure they have the wherewithal to fulfil their duties as well as have the requisite knowledge and skills to manage the business. As business is constantly changing, board members must regularly educate themselves and upgrade their skill base to perform their jobs accordingly. If not, the corporation may be in jeopardy.

In the past few years there have been multiple reports of cyber security attacks resulting in significant data breaches at large, international corporations. The direct cause of each attack is similar: hackers or fraudsters access a company’s systems (through employee or vendor access codes or by other means) and upload malware, giving them access to confidential email as well as to customer and payment systems information. The hackers or fraudsters then use the information obtained for their own benefit, victimizing the company’s employees or customers or both.

Many affected by a data breach hold the corporation’s management and board of directors responsible; they feel that the corporation failed to address weaknesses in its cyber security systems and programs. In addition, those affected by the data breach critique the corporation’s handling of the breach, including the lack of timely disclosure to those affected and insufficient remediation efforts.

The consequences of data breaches are quite negative. Consumers or employees victimized by fraudsters experience unauthorized charges on their credit and debit cards and have to spend a large amount of time with credit, bank and other professionals to mitigate their losses. The companies suffer significant monetary costs and financial hardship, including litigation costs and damages awards.

Some of the specific facts and consequences relating to a few recent breaches are set out below.

The significant costs associated with data breaches discussed in Recent Data Breaches are enough to raise board concern, as such costs can waylay corporate profitability for years to come. The province of Ontario’s recognition of a new tort, the tort of intrusion upon seclusion (also known as invasion of privacy), should increase this concern. Under this new tort a person can be found liable up to a maximum of $20,000 for each invasion of privacy it committed. While this amount is modest in an individual sense, class actions based on this tort can bring the damages award into the millions of dollars. In addition, some are seeking to expand the scope of the tort to include vicarious liability of employers. If the tort is expanded, then a corporation could be found liable for its employees’ breaches of confidential information over which the corporation had no direct control. A brief summary of the tort as well as a summary of one attempt to enlarge its scope are set out under Jones v. Tsige and Possible Expansion of the Scope of the Tort.

It is possible that, in the near future, liability respecting corporate cyber security missteps and data breaches may not be the sole responsibility of a corporation. In the USA, shareholders have commenced derivative actions against directors personally concerning board mismanagement of a corporation’s cyber security systems and board mismanagement of a corporation’s data breach.

Generally, plaintiffs argue that the board failed to adequately oversee the corporation’s cyber security measures before the breach, and failed to appropriately oversee the corporation’s disclosure, investigation and remediation efforts after the data breach. To date, no derivative actions of this type have been successful; however, derivative actions against Target are still pending.

The most recent derivative action dismissed by the American courts was Palkon v. Holmes, Case No. 2:14-cv-01234 (D.N.J.D.C.). A shareholder of Wyndham Worldwide Corporation (Wyndham) commenced the action after Wyndham suffered a series of data breaches between 2008 and 2010. The plaintiff claimed breach of fiduciary duties, waste of corporate assets and unjust enrichment. The claim was against 10 of Wyndham’s directors and officers.

The court dismissed the plaintiff’s action finding that Wyndham’s board had acted reasonably and in accordance with their fiduciary duties. Below are examples of steps taken by Wyndham’s board of directors that supported the court’s conclusion:

Note that no shareholder derivative actions have yet been commenced in Canada (where derivative actions require leave of the court and judicial approval of any settlement claim). However, if this cause of action starts to gain traction in the USA, shareholders may start to launch these proceedings in Canada. Accordingly, boards of directors should take protective actions, such as those noted above (and those discussed in Best Practices) to protect themselves from personal liability.

The proliferation of data breaches in North American consumer markets has caused government regulators to increase their monitoring of corporations' activities respecting data breaches and cyber security generally. Two Canadian initiatives are summarized below.

Considering the role and responsibilities, including fiduciary duties and other statutory duties, of a corporation’s board of directors, as well as the financial, reputational and litigation costs (including potential litigation costs against a director personally), and increased government monitoring of cyber security measures and data breaches, it becomes evident why board oversight of a corporation’s cyber security systems and management of data breaches are critical.

Below is a list of some practices boards can use in their oversight of cyber security and data breach matters (including steps boards can take to protect directors from personal liability):