The US Department of Veteran Affairs has decided to settle a class-action suite that was filed in response to the theft of a laptop and external hard disk from a VA employee. The computer did not feature laptop encryption software nor was there any type of file encryption program protecting the contents.
The settlement of $20 million will be used as reparation for vets who can prove that they were harmed by the data loss. For example, maybe they suffered from emotional distress or signed up for credit monitoring, meaning there was a cost borne by the victims.
The total number of veterans' records was 26.5 million. To date, no veteran has come forward to say that they were negatively impacted by the loss and recovery of the laptop.
(But then, with so many companies losing information left and right, how's one to know who's responsible for a particular name showing up on fraudulent mortgage applications?)
The suit, filed in 2006, had initially asked for $1,000 for each veteran that was put at risk. Obviously, that was never going to fly. With 26.5 million names, it would have meant 26.5 billion dollars. That's nearly half of Microsoft's revenues in 2007. That was a pretty extreme request.
On the other hand, this settlement is also extreme. It resolves to about $0.75 per name. It's so little, considering how much time one must spend on the phone sorting out everything. On the other other hand, $20 million is nothing to sneeze at. That's a serious hit to any organization's pocket. Besides, what's the point of squeezing more money out of the VA? It's ultimately tax payer money, ain't it?
Chances are, there's a (un)happy medium somewhere out there, and most companies won't see such artificially depressed monetary settlements like the VA. For example, if a Fortune 100 company is sued, and the number of people affected was 10,000, chances are no one's going to settle for $7,500. That's $7,500 total.
Instead of using the above, it looks like the cost of data breaches should still rely on previously reported data.
Related Sites:http://www.nytimes.com/2009/01/28/washington/28vets.htmlhttp://www.scmagazineus.com/US-Veteran-Affairs-Department-settles-data-breach-case/article/126518/http://blogs.usatoday.com/ondeadline/2009/01/va-to-pay-vets.htmlhttp://fcw.com/articles/2009/01/28/va-settlement.aspx
It's official. The judge overseeing the VA lawsuit has approved the settlement of $20 million. If