One of the primary issues confronting corporate directors, officers and others involved in risk management today is cybersecurity. News cycles have been littered with high-profile data breaches at companies ranging from Sony Pictures Entertainment, Wyndham Hotels, Anthem and Home Depot, since Target Corporation’s massive data breach kicked off this scrutiny in 2013. The massive federal data breach earlier this year demonstrated that the U.S. government is not immune either.
A corporate data breach not only inflicts reputational and financial pain on the targeted company, but, depending on the data disclosed, the impact on consumers can be dramatic. According to Redspin’s Breach Report 2013, since 2009, nearly 30 million Americans have had their personal health information accidentally disclosed—or worse, breached. Further, the Cyber Edge Group recently surveyed 800 security decision makers and practitioners and found that more than 70% indicated that their networks were breached in 2014, an increase of 8% from 2013.
Claims against Directors
Cybersecurity is an issue of risk assessment that should be on the mind of board members. As every director has likely experienced, corporate decision-makers are under more scrutiny today than ever before because of corporate scandals that led to the adoption of the Sarbanes-Oxley Act and the more recent Dodd-Frank Act. One of the main objectives of Dodd-Frank is to increase transparency and improve accountability in the corporate financial world. As a result, board members are now required to spend more time overseeing a company’s operations than perhaps was the case in prior years.
A key determinant of liability is how a director acts once a red flag has been identified. When a warning sign appears, a director is required by law to diligently undertake a reasonable investigation.
But an open issue at hand is how much training companies provide to their directors so that they can identify potential issues and respond accordingly, or actively oversee the corporate compliance program. In light of many recent cases, the answer is: not enough. One proactive approach is for a corporate board to annually review all of the material events that impacted their company over the past year (both externally and internally) and assess how prepared the management team was for each event. They should also assess the company’s overall approach to cybersecurity policies and practices annually, including any incident response plans.
All this said, if history is our guide, the likelihood of a corporate board member being held personally liable for poor oversight of a public company is low. This is because directors and officers insurance almost always covers any liability or settlement. According to a 2006 Stanford Law Review study, between 1980 and 2005, there were only 12 cases where directors were forced to make payments that were not covered by insurance, including legal fees.
While data breaches have spawned litigation brought by consumers or employees, widespread litigation has not ensued with shareholders seeking damages as a result of a data breach. This is likely because of the challenges inherent in demonstrating that a company’s share price was materially affected by a breach.
The data breach at Home Depot provides a good example of potential litigation strategies that may be employed in the future. Following that breach, a lawsuit was filed in Delaware Chancery Court seeking access to Home Depot’s books and records related to the data breach. It appears that the plaintiffs are using this suit to determine whether Home Depot’s directors and officers breached their fiduciary duties by failing to adequately protect the company’s credit card information. Based on what is uncovered, it is likely that future litigation will ensue.
The law regarding director’s liability is fairly well established, and claims typically arise in one of two scenarios: 1) The directors should be liable because they made a decision or took an action that was either negligent or ill-advised (they breached their duty of care); or 2) The directors failed to act in a situation where they could have prevented a loss (they breached their duty of loyalty).
Claims alleging a breach of the duty of care are unlikely to succeed because directors enjoy the protections of the director-friendly business judgment rule. Essentially, the business judgment rule immunizes a director’s conduct from judicial scrutiny as long as the decision is informed, made in good faith, and with the genuine belief that the decision was made in the company’s best interest. Even if a plaintiff can overcome the presumptions in favor of a director by showing gross negligence, many companies have adopted charter or bylaw provisions consistent with Delaware law, thereby insulating directors from liability for a breach of their duty of care. Other states such as Nevada have enacted statutes specifically protecting directors from these types of claims.
In the second scenario, a director is not insulated from liability under Delaware law, and a director’s conduct is evaluated under the standards enunciated in Caremark International Inc. Derivative Litigation and its progeny. This oversight liability attaches when directors consciously disregard their responsibilities either by: 1) failing to implement a sufficient reporting system; or 2) after implementing a reporting system, failing to properly oversee or monitor its operations by serving as passive recipients of information. Simply put, making no decision – or looking the other way – may indeed be worse than making any decision, even a bad one.
Many risks can be mitigated through the use of insurance policies. But with respect to cybersecurity, relying on insurance may prove problematic. With no form of standardized cyber insurance policy language established, different insurers are adopting different approaches. Moreover, an actuarial challenge exists in predicting or gauging the probability and impact of a cyberattack. As a result, it remains difficult to match a cybersecurity policy with the risk profile of a particular company. Also, the damages suffered from a data breach may be multifaceted and unique, with no normal distribution of outcomes. In sum, insurance may be a partial answer, but not necessarily a cost-effective complete solution.
Rise of the Corporate Investigation
Over the past several years, a cottage industry has emerged among lawyers who claim to specialize in corporate investigations. These investigations used to be the purview of a company’s general counsel or legal staff. But courts became less likely to apply the business judgment rule if an investigation was conducted in-house. This reluctance has spawned the exponential growth of corporate investigations, and more or less established that the standard of care is to retain outside counsel. Even though the costs of these investigations can be prohibitive, there appears to be no consensus on a different tactic.
In the face of a government enforcement action, regardless of which regulatory authority is involved, a director’s playbook is pretty straightforward. Directors should establish a committee to exercise day-to-day supervision of an internal investigation and monitor the progress in order to best ensure the company’s protection. One way for directors to limit their exposure—and perhaps cut down on corporate misconduct—is to provide the same oversight on an ongoing, day-to-day basis. This can decrease the number of required corporate investigations and the identification and remediation of issues before they become significant liabilities. Viewed through the eyes of a director, such an approach could lessen the likelihood of future liability.