Sony Hack: How the Studio Will (Likely) Handle All Those Lawsuits
Eight (and counting) class actions have the studio considering strategies from workers' comp settlements to an all-out defense.
This story first appeared in the Jan. 23 issue of The Hollywood Reporter magazine.
The legal strategy is coming into focus for Sony Pictures in the wake of a string of class action lawsuits filed in response to the studio's unprecedented data breach. On Jan. 6, an eighth suit claimed Sony didn't do enough to safeguard the personal information of 47,000 employees and former employees. The plaintiffs allege everything from negligence to violations of California's Confidentiality of Medical Information Act, and experts say the damages could run in the mid-tens of millions of dollars.
Lawsuits over stolen data are not uncommon — Target, Home Depot and Sony's own PlayStation Network have been targeted. But the new Sony cases are unique in that they concern employee rather than consumer data, and the information includes medical records, considered more sensitive than financial data. "We're in uncharted territory," says Scott Vernick, an expert on data security litigation.
Sony's legal team, led by general counsel Leah Weil and litigators David Marcus and Christopher Casamassima at WilmerHale, declined to comment on strategy. But they likely will attempt to consolidate the separate cases into one or two lawsuits. For example, in the wake of the PlayStation hack, 65 suits were combined into a single federal case that went to a preliminary settlement in July, and four of the new lawsuits already have entered consolidation. Federal court is perceived to be friendlier to defendants because of its more selective jury pool and tighter-controlled discovery process.
Of course, Sony's early efforts also will challenge whether the cases — or at least certain claims — should be heard in court at all. The studio will argue that its security protocols were reasonably sufficient and that no company could have anticipated such an aggressive and widespread attack. Vernick also predicts Sony might add a unique defense: Employee claims of harm or inconvenience due to a data breach actually are workers' compensation claims. If a judge agrees, the plaintiffs would have to refile in a separate court. "I think it's a novel and creative argument," he says.
Sony likely will argue that the employees can't prove they have been injured by identity theft or otherwise, even if they have been put at greater risk. "Courts are still in the frame of mind that you have to have actual damages. The speculation of what could happen with your information is not sufficient," says Bryan Sullivan, an L.A. litigator. But that standard for damages has been shifting in recent rulings, in particular a December decision concerning Target's 2013 hack that upheld customer claims that they had been injured merely by the release of their information and their efforts to resecure it. "Target is likely going to make Sony's life a little more complicated," notes Adam Levitt, who litigated the PlayStation case.
If the plaintiffs withstand the studio's pretrial motions, they'll be able to certify the class action and argue the factual issues, such as whether Sony's precautionary measures were sufficient. Vernick believes the plaintiffs' cases will be heard: "I think this will survive."
But the case likely won't end up in trial. Data-breach suits nearly always settle, and the high-profile nature of this situation might provide the studio added incentive to resolve it. "If [Sony] didn't care about the public component of this, I think they'd fight this thing tooth and nail," says Mark Keegan, a consultant whose research firm advises attorneys on settlements. But, he notes, "The earlier you settle, the more you're settling for. That's what gives this case some life."
It's nearly impossible to speculate how much a global settlement might cost Sony. If the past few years of resolutions — such as the PlayStation deal for $15 million — are any indication, the number likely would be in the mid-eight figures. Lawyers take as much as 40 percent, but at those amounts, the hacked Sony employees might still get a Hollywood ending.