Personal Data Privacy Lawsuits

Consumer safety attorneys are taking on new class action data privacy violation cases every day. While companies collect, store, share, and sell your personal data, consumers often see their privacy compromised.

Cybersecurity may take a backseat to company profit and growth, and instances of data misuse are increasingly common. There are many new questions surrounding what companies can legally do with data they collect from their clients, but only a handful of states have actually signed consumer data privacy protections into law.

How secure are data systems? Judging by the huge number of data breaches announced each year, it is safe to say online privacy and cybersecurity needs some improvement on several fronts. Beyond the security and theft of personal data lies more concerns: data misuse and privacy violations.

Personal data privacy violations can be the basis for class action data misuse lawsuits, and The Lyon Firm aims to protect consumer privacy rights. If you have been the target of data sharing, personal data misuse or data privacy violations, call for a free consultation. You may be eligible to join existing data privacy class actions and compensation may be available.

Can I Protect My Personal Data Privacy?

Companies often take advantage of consumers by presenting a long, unreadable privacy policy on websites and apps. The end result is consumers signing away their personal data for nothing in return, except to use a website or media platform. Opting out of data collection may be difficult or impossible in some cases.

Not only is personal data collected and sold by certain companies for profit, but it is not always properly secured, and data breaches lead to data theft and a host of data privacy violations. Cyber security lawsuits are a growing trend in the legal world, and personal data privacy class actions may be necessary to hold companies accountable for instances of data misuse and data sharing.

There are many ways in which personal data can be leaked, stolen or misused by third parties. Data breaches can be very costly to everyone involved, and legal action may be a logical course of action.

What Consumer Data Privacy Laws Exist?

As of 2021, there is no federal legislation in the United States that addresses consumers’ data privacy concerns. There are laws such as HIPAA (personal health privacy), Gramm-Leach-Bliley (financial privacy), and COPPA (children’s online privacy) that establish industry-specific standards, but nothing that encompasses the full scope of online privacy matters.

There are, however, some state laws that may be the model for future federal data collection regulations, including personal data privacy and cybersecurity regulations in California, Illinois and Virginia.

The Biometric Information Privacy Act (BIPA) is one of the most modern examples of state legislation intended to regulate companies’ use of biometric data. Some of the more important provisions of the privacy law include:

• Requirements for companies to seek informed consent prior to collecting personal biometric data
• A limitation of rights to sell or disclose collected biometric data
• A requirement for companies to create confidentiality and data retention guidelines
• A prohibition of profiting from collected biometric data
• The right of legal action for individuals affected by data theft violations
• Enacting damages from $1,000 to $5,000 per negligent or reckless violation.

Not only do some states regulate a business’s use of biometric data, but they allow for individuals to bring legal action against companies that violate state biometric data laws. In January 2019, the Illinois Supreme Court ruled that private individuals can file data theft claims if they are able to show that their privacy rights have been violated.

The Illinois statute prohibits an entity from collecting biometric information unless it fulfills the following:

• Informs individuals in writing that their biometric data is being captured
• Outlines the purpose and period of time for which the data will be utilized
• Receives a written release from individuals consenting to the data collection

Other states have been scrambling to catch up with modern advances and have been slow to provide biometric policies. Most states have no comprehensive biometric regulations. The following states are exceptions:

• Texas has its own biometric privacy act which provides that a person cannot capture a biometric identifier without a prior consent, and may not sell biometric date without consent. A company or person must use reasonable care in storing it, and “shall destroy the biometric identifier within a reasonable time.” Violators may face a civil penalty of $25,000 for each violation,
• Washington passed biometric privacy legislation in 2017. The law prohibits any company or individual from entering biometric data into a database for a commercial purpose without providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose.
• The California Consumer Privacy Act (CCPA) regulates biometric data by including it in the definition of “personal information.” Biometric data is defined in the CCPA to include physiological, biological or behavioral characteristics, including DNA, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings.
• New York has passed the Stop Hacks and Improve Electronic Data Security (SHIELD) Act, which broadens the definition of private information to include biometric information. The law applies specifically in the employment context and prohibits fingerprinting “as a condition of securing employment or of continuing employment.”
• Arkansas amended existing laws and revised the definition of covered personal information to now include biometric data.

Other states have introduced biometric legislation but most laws have not yet been enacted.

Data Sharing Case Study

In 2021, Zoom agreed to a $85 million settlement after the company allegedly misrepresented its end-to-end encryption on video calls. According to complaints, the company shared user data with companies like Facebook and Google without users’ consent. The settlement follows a class action claim of data privacy violations.

Attorneys and plaintiffs claimed that Zoom willingly shared personally identifiable information (PII) with third parties without proper permission, which in turn made it possible for such third parties to identify and track users’ behavior. The official legal complaint also alleged that Zoom misrepresented its security features.

The court allowed claims of breach of contract, breach of implied contract, and quasi-contract to proceed. Under the proposed settlement, Zoom agreed to “major changes to its practices,” meant to better protect consumer data.

Of course Zoom is not the only company facing legal scrutiny about data sharing practices. The Lyon Firm is currently investigating a variety o data sharing and privacy violation cases on behalf of plaintiffs nationwide.

Does My Car Collect Personal Data?

To add to other privacy concerns for American consumers, automobile manufacturers are allegedly collecting personal data at a rapid pace. Unfortunately, there have already been security breaches involving automakers. General Motors (GM) announced in May 2022 that it was hit by a credential stuffing attack that exposed customer information and allowed hackers to redeem rewards points and gift cards.

GM said that they detected the malicious login activity and began a data theft investigation. GM posted a data breach notification  and sent notices to affected customers.

A credential stuffing attack is possible when credentials are obtained from a previous data breach. Such data was likely not obtained from GM but a third party.

The stolen personal data of affected GM customers includes full names, email addresses, home addresses, usernames and phone numbers, last known and saved favorite location information, avatars and photos, profile pictures, search and destination information, and Wi-Fi hotspot settings.

Recent reports note that some modern cars collect a vast amount of personal data, and may track where we live, who we text, and what restaurants we visit. Collected data isn’t delivered to car owners, but rather to the automakers, or third parties willing to pay for the data. The data generated by cars may be worth billions of dollars each year.

TV Data Tracking

The misuse of TV data, collected by media conglomerates and other corporate entities, can pose a privacy concern to consumers and lead to class action lawsuits. In recent years, some landmark litigation has led to the strengthening of consumer data laws.

In most cases, if a company does not have your permission or written consent to collect and disseminate your personal information (location data, viewing history, demographics), they may be liable for violating privacy protection statues and can be sued accordingly.

Joe Lyon is a class action data privacy lawyer representing plaintiffs in and nationwide in a variety of personal data sharing litigation.

Biometric Data Misuse Litigation

Although some legislation protecting consumers from companies misusing their biometric data has been passed since 2008, class action lawsuits have not been filed until relatively recently. Companies have tried to shift away from potential legal trouble, but may are still toeing the line between legal marketing tactics and invasive schemes.

At the moment, only Illinois has passed biometrics legislation that provides for a private right of action, while Texas, Washington, California, New York, and Arkansas have passed biometric statutes only allow enforcement by the state attorneys general.

Who is buying my personal data?

A whole host of marketers and companies vying for your business. Companies like retailers and Facebook and Google collect a vast amount of data and sell it to third parties for various consumer tracking and marketing purposes. If that data is leaked, then other bad actors can use that info in more damaging ways.

What personal data can be collected and sold?

• Consumer behaviors
• Home address
• Social security number
• Banking information
• Browsing history
• Video Viewing History
• Purchase history
• Telephone numbers & email
• Credit card information
• TV tracking data
• Genetic data & DNA test Results
• Biometric data—facial recognition, fingerprints, genetic information and retina scans