Digital Media and Data Privacy Law Blog

You have probably heard about the recent data breach at Sony; after all, it’s not often that Kim Jong Un and Angelina Jolie are mentioned as part of the same story. Unlike other recent high profile hacks, the recent Sony hack appears to be somewhat different in character: the hackers appear to care most about using the information stolen from Sony to bring shame and scorn to the company, rather than for their own pecuniary gain.

And the story appears to continue down the proverbial rabbit hole, with reports of a tongue-and-cheek offer of investigative cooperation from the North Koreans, and the recent revelation that all of North Korea’s internet is down, perhaps in retaliation for the recent attacks.

Amidst the intense Hollywood and international intrigue, an important group of victims isn’t receiving much attention: Sony employees. Indeed, the hack has allegedly resulted in the theft of social security numbers, birth dates, health information, and other sensitive data from thousands of Sony employees. In response, two Sony employees swiftly filed a federal class-action lawsuit against their employer, summing up their claims in the opening paragraph of their complaint:

An epic nightmare, much better suited to a cinematic thriller than to real life, is unfolding in slow motion for Sony’s current and former employees: Their most sensitive data, including over 47,000 Social Security numbers, employee files including salaries, medical information, and anything else that their employer Sony touched, has been leaked to the public, and may even be in the hands of criminals.

The employees have brought claims for negligence, as well as for various statutory data breach claims under both California and Virginia law.

Unlike the more “typical” breach case, where customers are the victims of stolen credit card numbers or other personal information, this action is unique in at least two critical aspects: the nature of the data breached, and the employer/employee relationship between Sony and the plaintiffs. Employers often owe their employees heightened duties of care to their employees, thanks to the particular nature of the employer/employee relationship. However, the duties employers owe their employees regarding the protection of employee data is largely uncharted territory, and this action may shed significant light on the standard to which employers will be held in protecting employee data.