Sony Hack: Will Shareholders Sue?

Sony Pictures Entertainment Studios - H 2014
AP Images

Sony Pictures Entertainment Studios - H 2014

Six class action lawsuits were filed against Sony Pictures Entertainment last week on behalf of employees and former employees whose personal data was breached by hackers linked by the U.S. government to North Korea, but they’re not the only ones potentially aggrieved.

With the costs to SPE likely to exceed $200 million – when factoring in IT remediation, losses on The Interview and on five pirated films, employee lawsuits, business interruption, damaged morale, lost productivity, injury to the brand and more – the logical question is whether Sony Corp. shareholders too will sue the company alleging damages for a series of bad decisions.

Indeed, why haven’t they sued already?

One answer may be that the Japan-based company’s share price hasn’t moved decisively in response to the hack attack on its Los Angeles-based studio, with a recent drop offset by a rise after the studio pulled the plug on The Interview. That almost indifferent response may be due to the fact that the studio accounts for only about 11 percent of the parent company’s revenue (although it contributes 21 percent to bottom line profits, or operating income). The company’s shares closed at $20.78 Monday, seven percent below the 52-week high, while the S&P was less than 0.1 percent below its 52-week high.

Read more Sony Executive Judgment Under Scrutiny As Hack Fallout Grows (Analysis)

There’s a legal reason too for the absence of shareholder litigation so far, and it’s nuanced. In a nutshell, corporate officers and directors are protected by a web of legal doctrines, corporate documents, insurance and company structure that limit their liability to shareholders even for what might seem to be egregious misjudgments, such as allegedly lax cybersecurity and what plaintiff’s attorneys would no doubt call a reckless – or at least grossly negligent – decision to proceed with The Interview despite North Korean threats earlier this year. A third decision – to pull the movie, at least from major chains – could also come under fire.

When shareholders are angry about a corporate decision, they may bring what’s called a shareholders’ derivative suit. The name reflects the concept that the harm to the shareholders, such as a drop in stock price, is derivative of the harm to the company. Indeed, although the suit is brought by shareholders, they do so in the name of the company and are deemed to be bringing a claim that belongs to the company. The defendants are the company’s officers and/or directors – whoever made or tolerated the bad decision.

As a reader pointed out in the comments after this article first appeared, prior to filing suit the shareholders may be required to make a demand that the company itself sue the officers and directors; usually, the board refuses, and the plaintiffs will then sue, arguing that the demand was wrongfully refused. Sometimes, instead of making demand, the plaintiffs simply sue, and argue “demand futility.”

The reader also pointed out that with respect to the director defendants (as distinguished from officers), a claim for dereliction of their oversight duties is governed by a case called Caremark. That case sets a high bar: it require that the directors knew or should have known that violations of law (or, perhaps, other serious problems) were occurring and took no steps in a good faith effort to prevent or remedy that situation, and that such failure “proximately resulted” in the losses complained.

In any event, if the shareholders prevail in a derivative suit, the company will recover damages from the officers and directors, or more typically from the insurance company that provided directors and officers insurance (D&O). The shareholders’ attorneys will get paid too – legal fees and costs are recoverable – but the shareholders themselves don’t recover damages. They benefit if the share price increases as a result of the company’s recovery of damages.

But recovery isn’t easy. For one thing, corporate law in states such as Delaware – where SPE is incorporated – allows companies to shield corporate directors from liability using so-called exculpatory and indemnity clauses in their corporate articles, the basic governing documents of a corporation. Whether SPE’s articles contain such provisions is not known.

In any case, plaintiffs’ lawyers would probably argue that SPE chairman and CEO Michael Lynton and SPE co-chair Amy Pascal were acting in their capacities as officers, not as members of the board of directors. Delaware law does not allow exculpatory clauses to cover officers, unlike some other states.

However, there’s an even larger hurdle: the business judgment rule, a key legal principle that immunizes directors, officers and managers from liability to the company for business decisions made in good faith. “Mistakes or errors in the exercise of honest business judgment do not subject the officers and directors to liability for negligence in the discharge of their appointed duties” says an early leading case.

Gross negligence, rather than simple negligence, may be another issue, but the area is complex. Officers owe a duty of care to the corporation, and “most people think you’d have to show gross negligence” to get past the business judgment rule, said USC Law School professor Michael Chasalow.

Thus, whether Sony was “negligent” or “grossly negligent” – or not negligent at all; we don’t know the company’s position since it hasn’t yet responded to the class action lawsuits – could make a difference. Those are the sort of difficult distinctions litigators live for.

Should the business judgment rule shield Sony’s officers and directors? Yes, said experts.

“It seems crazy to think Sony might be liable – if ever the business judgment rule should apply … surely this is where,” said Harvard Law School’s Mark Ramseyer. The logic is two-fold. For one thing, corporate law recognizes a separation of ownership and control: shareholders own the corporation but directors and officers control it.

And courts too, it is felt, shouldn’t be in the position of micro-managing corporations and second-guessing good-faith business decisions after the fact.

Chasalow agrees. “I’m not seeing a lot of culpable decisions on Sony’s part,” he said. “We protect management decisions (and) don’t want shareholders second-guessing.”

In essence, even bad or arguably bad decisions are generally protected. Hollywood saw this up close when a Delaware court ruled in 2005 that Disney’s board and then-CEO Michael Eisner were not liable in a shareholders derivative suit that challenged a $140 million severance payment to company president Michael Ovitz after just 14 months on the job.

“The business judgment rule protects the right to make a bad decision provided it was made in good faith and after reasonable investigation,” summarized Chasalow. “American innovation is based on a freedom to try things.”

And there’s yet another complication: SPE isn’t a public corporation. It’s a wholly-owned subsidiary of Sony Corp., and its only shareholder is Sony – i.e., Sony, or some intermediate entity, owns one hundred percent of the stock of SPE. Sony, in contrast, is a public company, but its shareholders own stock in Sony, not in SPE. How can Sony shareholders bring a derivative suit against SPE when they don’t actually own shares in SPE?

Enter the double derivative action, which sounds like a double fudge sundae and is just as messy. “A double derivative suit,” said the Delaware Supreme Court in a 2010 case, “is one brought by a shareholder of a parent corporation to enforce a claim belonging to a subsidiary that is either wholly owned or majority controlled.” That contrasts with a standard derivative action, in which a shareholder brings a lawsuit asserting a claim belonging to a company in which the shareholder owns shares.

In other words, a double derivative suit follows the chain of ownership, from shareholder to parent to subsidiary.

But there’s a wrinkle: a double derivative action, said the court, is a “procedural vehicle to remedy the claimed wrongdoing in cases where the parent company board’s decision not to enforce the subsidiary’s claim is unprotected by the business judgment rule.”

In other words, confirmed Chasalow, to reach SPE’s officers (Lynton, Pascal, SPE’s chief information officer and whoever else), a Sony shareholder would have to argue not only that their conduct falls outside the business judgment rule, but also that the Sony board’s likely decision not to sue the SPE officers also falls outside the protections of the rule.

Says one article, “The double derivative suit literally doubles the shareholders’ burdens because he must satisfy all derivative suit requirements for a standard derivative suit against both the parent and subsidiary.”

All of this makes a shareholder suit against Sony a very difficult exercise. And if this sounds complex, we’re not even all the way home. “It’s like a law school exam,” said TroyGould’s Bill Gould, co-author of the book Advising and Defending Corporate Directors and Officers.

The missing element? Corporate litigation of this sort often raises questions of jurisdiction – where should the suit be brought (Delaware? California state court? California federal court?) – and choice of law (will Delaware law apply or California law?). SPE, after all, is a Delaware corporation but is headquartered in Culver City, California.

But Sony, the parent company, is something else altogether: it’s a Japanese corporation, headquartered in Tokyo – but traded on both the Tokyo and New York stock exchanges. At first glance, that suggests that a lawsuit might be brought in Japan as well as (or even instead of) the U.S.

However, a Japanese suit might be an even tougher row to hoe than an U.S. one. For one thing, there’s the Japanese analog to the business judgment rule, variously translated as keiei handan no gensoku by Hajime Iwaki, head of the Tokyo corporate department for DLA Piper, or as eigyo handan no gensoku by Harvard’s Ramseyer, an expert in Japanese corporate law.

But the bigger hurdle is the issue of double derivative suits. Legislation authorizing such actions is actually just six months old – an amendment to the country’s Companies Act was enacted June 20 – and it isn’t set to come into force until April 1, 2015. Iwaki says the legislation is not retroactive.

In addition, the new law is quite restrictive. It requires that the named plaintiffs own one percent or more of the parent company’s stock (class actions aren’t allowed, says Iwaki) and that the book value of the subsidiary account for 20 percent or more of the total assets of the parent company (which seems unlikely in the case of SPE and Sony). Moreover, says Iwaki, the law only applies where the subsidiary is also a Japanese entity, which is not the case here. That last factor alone is enough, he says. “Japanese courts would not hear the case because of this.”

(Iwaki noted that other lawyers in his firm represent Sony, and  that he was not speaking with direct reference to the company.)

So do we return to a U.S. double derivative suit as the answer for unhappy Sony shareholders? Maybe not. After this article appeared, an astute reader asked, “Does it matter for double derivative suit that people in US hold ADRs not stock in Sony?”

Yes, it turns out that it does matter. ADRs – American Depository Receipts – are the form in which shares of foreign companies are often traded on U.S. exchanges, and such is the case with Sony. ADRs are governed by a “Deposit Agreement,” which may vary from company to company.

That Deposit Agreement, in turn, can contain a choice of law clause specifying that the law of the parent company’s jurisdiction should apply. In Batchelder v. Kawamoto, a 1998 double derivative action involving Honda and its U.S. subsidiary, a California corporation, the 9th Circuit considered just such a clause, which specified Japanese law. The court honored the clause, particularly since the "internal affairs doctrine" also argues in favor of using the parent company's jurisdiction.

We don't know if Sony's Deposit Agreement contains a Japanese choice of law provision, because the document does not appear to be readily publicly available. But if it does, that would be a problem for a plaintiff, because, Batchelder held, under Japanese law an ADR holder is not a shareholder and can't bring a derivative action.

Also, said Batchelder, Japanese law does not recognize double derivative actions. That's still true, until the new Japanese law goes into effect and even then, the suit would be blocked for the reason Iwaki discussed, and quite possibly by the one percent and 20 percent thresholds as well.

That would deprive an American plaintiff of a remedy against Sony, but this was true in Batchelder as well and the court was untroubled. On the other hand, the court’s serenity stemmed in part from the fact that California law – applicable to American Honda – too seemed inhospitable to double derivative suits. A court applying Delaware law – which is applicable to SPE and which does recognize double derivatives – might reach a different conclusion, and make a double derivative suit available.

An ADR holder who intends to sue could exchange her ADRs for actual Sony shares, but that might not solve her problem. In general, under Delaware law she would have to have been a shareholder at the time of Sony’s alleged wrongful acts. That requirement might not be satisfied by having been an ADR holder at the time of the doomed decisions.

Derivative actions aren’t the only type of suit a shareholder can bring: a securities fraud claim is theoretically possible too. But USC’s Chasalow said such a suit is unlikely, because it would require a shareholder to show a material misrepresentation by Sony (relating, for instance to the strength of its cybersecurity) and also that the shareholder bought or sold the company’s stock in reliance on the misrepresentation. That second prong is a problem, since most people buy or sell stock based on business fundamentals or technical stock market concerns, rather than on an evaluation of a company’s cybersecurity.

So will Sony shareholders sue? It’d be an uphill battle but it could happen. Said Ramseyer, “there are lots and lots of truly wacky or opportunistic courts in the U.S. so I suppose they'll be burning their money in attorneys fees by the bundle now.”

Full disclosure: this reporter is of counsel at TroyGould and is an adjunct professor at USC Gould School of Law

Dec. 24, 2014 9:35 a.m. PT: Updated with discussion of reference to indemnity clauses, discussion of demand, Caremark, Batchelder and ADRs, and interview with Hajime Iwaki.


Twitter: @jhandel