Equifax Faces Multibillion-Dollar Lawsuit Over Hack

Equifax still hasn't revealed any data about how it was hacked, without that information it's hard to prove they were negligent.

Negligence requires three things: duty, breach and damages.

As to duty:

Does Equifax really owe a duty to every single person whose data it keeps. That would be a tough argument to make. They didn't sign any contract or make any agreement with the people whose data they collect. So where does the duty come from?

Even if the plaintiffs were able to overcome that hurdle, they would then have to prove breach. Was Equifax careless in they way they handled information security? I don't see evidence of that, the mere fact that they were hacked doesn't necessarily mean they were careless. All Equifax would have to show to win on this count is that they had some sort of basic security system in place comparable to what other businesses it's size have in place. My guess is that they do have a security system and that this probably wouldn't be hard for that to show.

Being hacked would be considered under law to be an intervening criminal action. It is established that people are not responsible when damage is caused by someone else's criminal action. So long as Equifax took basic, prudent steps to protect data, they can't be held responsible for intervening criminal action.

As to damages

It's hard to see how anything of monetary value was lost by the plaintiffs in this case. There was a loss of privacy, but I haven't heard of courts giving out awards for that sort of loss.

I'm sure people more familiar with information security could point to flaws in they way Equifax protected info. And certainly the way they reacted to the hack was negative. But bad or imperfect behaviour doesn't in and of itself give rise to a claim for monetary damages in court. This case doesn't seem winnable to me.

There is some argument that if you use Equifax's identity theft protection you may be able to sue, which I think is what this class action is about. But that still doesn't give rise to damages because none of the plaintiffs can prove that their identity was actually stolen. And you still don't have breach (no proof that the hack was the result of Equifax's carelessness).

And federal civil asset forfeiture almost always starts out as administrative forfeiture which doesn't involve the judiciary at all.

When the feds seize an asset the owner has 60 days to file a claim. If no claim is filed the government keeps the asset.

If a claim is filed, the government can either pursue civil or criminal forfeiture. In the case of civil forfeiture there is a right to a trial by jury.

However, as I said previously this isn't automatic. The person has to either have the legal knowledge to know how to file a claim, or they need a lawyer. In the majority of cases no claim is filed in many cases because the legal fees necessary to recover the asset will be greater than the value of the asset.

Basically if the government sizes a few grand in cash, it will cost you too much to recover it to make it worth it.

In states like Tennessee, police can seize your cash and you have to sue to get it back. They automatically get to keep the assets unless you sue them. They don't need to convince a jury of anything unless you sue them.

This is not the same thing as a person suing you and then using a replevin action to force you to give up your property. This is like if a person broke into your house, took your TV, and then you were forced to initiate a lawsuit to get it back. Plus you couldn't recover legal fees, it was significantly more complicated and costly than small claims court, and the thief suffered no consequences beyond returning the TV even if they lost the case.

Even Clarence Thomas, the most conservative member of the the Supreme Court, indicated in recent statement that he believes the current way civil asset forfeiture is practiced is unconstitutional.

1- http://immigration.findlaw.com/citizenship/dual-citizenship....