The advantages of arbitrating data breach disputes

Data breaches are becoming increasingly frequent and severe. In 2021, data breaches at corporations increased by over 68% from the previous year and the average cost of a data breach was $4.24 million. (Identity Theft Resource Centre. 2022. Annual Data Breach Report 2021.) This trend shows no signs of slowing down as 2022 has seen huge data breaches impacting companies such as Twitter and crypto.com. This rise in data breaches has naturally caused a rise in data breach litigation filed in courts across the United States. Despite the potential value in litigating these claims in a public forum, (e.g., drawing Congressional and regulatory attention to cybersecurity issues) alternative approaches, such as arbitration, provide numerous benefits that are unavailable in the courtroom.

First, the parties to an arbitration can select an arbitrator with expertise in data breach disputes. Arbitration allows the parties to select their arbitrator or arbitration panel, which is especially important in data breach disputes because of the technical nature of the cases. Data breach cases often require specialized expertise that most judges lack to understand the facts and the nuances of the parties' arguments as well as the testimony from expert witnesses. Appointing a technically competent arbitrator can be essential to resolving a data breach efficiently and effectively as the arbitrator will be able to parse the technical pieces of the case without the aid of a neutral or special master. The importance of this factor cannot be overstated. Courts are laboring under heavy dockets and a data breach case may not be given the same priority that parties think it deserves, simply because judicial resources are stretched so thin. If the claims are pled in such a way as to provide for trial by jury, the timeline may be pushed even further, and the technical issues and expert testimony alluded to above may be problematic for some jurors.

Second, arbitration is designed to be a more time and cost-efficient path to dispute resolution than litigation. Arbitrating a data breach dispute will generally limit costs as compared to litigating the dispute in court, because discovery during arbitration is more limited and controlled than that in traditional litigation. As the United States Supreme Court affirmed in Alexander v. Gardner-Denver Co., 415 U.S. 36, 49 (1974), in arbitration a party trades the formal procedures of a courtroom for the simplicity, informality and expedition of arbitration:

[T]he fact finding process in arbitration usually is not equivalent to judicial fact finding. The record of the arbitration proceedings is not as complete; the usual rules of evidence do not apply; and rights and procedures common to civil trials, such as discovery, compulsory process, cross-examination, and testimony under oath, are often severely limited or unavailable. ... And as this Court has recognized, '[a]rbitrators have no obligation to the court to give their reasons for an award.'... Indeed, it is the informality of arbitral procedure that enables it to function as an efficient, inexpensive, and expeditious means for dispute resolution. 415 U.S. 36, 57-58 (1974).

Third, arbitration can more quickly address procedural hurdles, and advance, if appropriate, to the merits of the dispute. Customarily, data breach litigation has focused on procedural issues. Most commonly, courts face the dilemma of whether compromised personal records constitute harm necessary to satisfy the standing requirements. This is otherwise known as the "speculative future harm" issue.

In earlier cases such as Remijas v. Neiman Marcus Group, 794 F.3d 688, 693-94 (7th Cir. 2015), the Seventh Circuit determined that the risk of identity theft or credit card fraud was "immediate and very real." Id. at 693. "Neiman Marcus customers should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing." Id. Similarly, in Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), injury in fact was found based on "the increased risk of fraudulent charges and identity theft they face because their data has already been stolen." Id. at 967. However, in more recent cases such as Tsao v. Captiva MVP Rest. Partners, LLC, No. 18-14959,(11th Cir. 2021), the Eleventh Circuit found that standing required a concrete and particularized injury that was actual or imminent - declaring that the plaintiff's potential injuries based on fear of future harm and preemptive steps taken to ward off potential identity theft do not confer standing. Likewise, in Baysal v. Midvale Indem. Co., 21-cv-394-wmc (W.D. Wis. Apr. 19, 2022), the District Court of Wisconsin not only deemed speculative future injury insufficient to confer standing, but emphasized that "the imminency of harm depends on the type of information disclosed in the breach." Id. at 4. The disclosure of credit card and social security numbers pose markedly different risks than that of driver's license information.

Lastly, arbitration is a private hearing and therefore has the advantage of keeping the proceedings confidential, which can be crucial when dealing with the sensitive issues often at play in data breach litigation. For many companies, the reputational damage from a data breach is worse than the direct monetary losses from the breach itself. These reputation losses can be mitigated by resolving disputes in a private arbitration setting where the parties agree to execute a confidentiality agreement.

While arbitration has many potential advantages over litigation when resolving data breach disputes. It is of course necessary to assess the individual facts and circumstances of a particular matter before choosing which dispute resolution route makes the most sense.