It is remarkable that the epidemic of lost and stolen PCs, laptops, PDAs and cellular phones has not yet resulted in large judgments in suits brought by people whose personal data–such as birthdates, Social Security and credit card numbers–has been breached.

The primary reason for this, says David Johnson, a partner at Jeffer Mangels Butler & Marmaro, is that plaintiffs have been unable to prove identity theft or other actual damages resulting from a security breach. Recent cases in two federal districts courts illustrate the problems plaintiffs have had in stating a claim.

In Ruiz v. Gap, a class action was brought in the Northern District of California after a burglar broke into the offices of Gap's job application processing vendor, Vangent, and stole two laptop computers. The laptops contained personal information from 800,000 job applicants, including names, Social Security numbers, addresses and other personal information. The information was not encrypted and was therefore easily accessible.

The only harm Joel Ruiz alleged in his complaint was that, as a result of the laptop thefts, he was “at an increased risk of identity theft.” In granting summary judgment for the defendant in April 2009, the court reasoned that “an increased risk of loss still isn't a loss” after finding that there was no evidence that the data theft resulted in actual harm.

In August 2009, the federal court for the Western District of Washington in Krottner v. Starbucks and Lalli v. Starbucks dismissed two class action lawsuits for failure to state a claim. The complaints were filed following the theft of a laptop containing the names, Social Security numbers and addresses of approximately 97,000 Starbucks employees. Starbucks had notified the police and affected employees less a month after the theft. (The plaintiffs claim Starbucks was slow in issuing this notice.)

Only one of the plaintiffs alleged misuse of his information. He claimed that someone opened a bank account in his name without his consent shortly after the theft of the laptop. His bank closed the account before any unauthorized charges were made and no loss was claimed. The plaintiff never proved a connection between the data breach and the attempt to fraudulently open a bank account.

Because actual harm was not proven, the court did not address whether the defendant failed to act with reasonable care in protecting the data. The court noted that a claim for increased risk of identity theft did not appear to be recognized by the law of any state or the common law. The case is on appeal in the 9^th Circuit.

Some experts believe it is only a question of time before actual damages are proven in the case of a lost or stolen laptop or other remote device. The takeaway from cases such as Ruiz, says Johnson, is that “a business can limit its tort exposure from data thefts by taking the right actions before and after a data loss.”

It is remarkable that the epidemic of lost and stolen PCs, laptops, PDAs and cellular phones has not yet resulted in large judgments in suits brought by people whose personal data–such as birthdates, Social Security and credit card numbers–has been breached.

The primary reason for this, says David Johnson, a partner at Jeffer Mangels Butler & Marmaro, is that plaintiffs have been unable to prove identity theft or other actual damages resulting from a security breach. Recent cases in two federal districts courts illustrate the problems plaintiffs have had in stating a claim.

In Ruiz v. Gap, a class action was brought in the Northern District of California after a burglar broke into the offices of Gap's job application processing vendor, Vangent, and stole two laptop computers. The laptops contained personal information from 800,000 job applicants, including names, Social Security numbers, addresses and other personal information. The information was not encrypted and was therefore easily accessible.

The only harm Joel Ruiz alleged in his complaint was that, as a result of the laptop thefts, he was “at an increased risk of identity theft.” In granting summary judgment for the defendant in April 2009, the court reasoned that “an increased risk of loss still isn't a loss” after finding that there was no evidence that the data theft resulted in actual harm.

In August 2009, the federal court for the Western District of Washington in Krottner v. Starbucks and Lalli v. Starbucks dismissed two class action lawsuits for failure to state a claim. The complaints were filed following the theft of a laptop containing the names, Social Security numbers and addresses of approximately 97,000 Starbucks employees. Starbucks had notified the police and affected employees less a month after the theft. (The plaintiffs claim Starbucks was slow in issuing this notice.)

Only one of the plaintiffs alleged misuse of his information. He claimed that someone opened a bank account in his name without his consent shortly after the theft of the laptop. His bank closed the account before any unauthorized charges were made and no loss was claimed. The plaintiff never proved a connection between the data breach and the attempt to fraudulently open a bank account.

Because actual harm was not proven, the court did not address whether the defendant failed to act with reasonable care in protecting the data. The court noted that a claim for increased risk of identity theft did not appear to be recognized by the law of any state or the common law. The case is on appeal in the 9^th Circuit.

Some experts believe it is only a question of time before actual damages are proven in the case of a lost or stolen laptop or other remote device. The takeaway from cases such as Ruiz, says Johnson, is that “a business can limit its tort exposure from data thefts by taking the right actions before and after a data loss.”