This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

For as long as there have been data breaches that expose consumer data to hackers, there have been lawsuits by consumers seeking to hold companies liable for failing to protect the data collected by or entrusted to them. These lawsuits have often struggled to match up the unique realities of data breaches with traditional theories of legal liability, and courts have often dismissed data breach claims by consumers for reasons relating to lack of standing, unclear causation, nebulous harm, and speculative damages. This problem has been especially acute for plaintiffs hoping to bring claims on behalf of a class of all consumers whose personal data was compromised in a security breach.

A recent decision from the Southern District of Indiana, however, cut through these issues by allowing a class action claim to proceed on a theory of liability often proposed by commentators as a solution to the data breach liability conundrum but until recently almost uniformly rejected by courts: the common law theory of bailment. See, Krupa v. TIC International Corp., 2023 WL 143140 (S.D. Ind. Jan. 10, 2023). If other courts around the country follow Krupa's lead, it could represent a major shift in how data breach claims are litigated, and companies that maintain Personally Identifiable Information (PII) belonging to consumers or employees should be watching closely.