They say that hindsight is 20/20—which unfortunately is no help to Equifax right now. Last week, the credit reporting agency finalized a $1.4 billion settlement with 147 million consumers who were impacted by the company's 2017 data breach. Included in the agreement were a combined 10 years of credit monitoring and identity protection services.

While not every breach approaches the size or scope of Equifax, the settlement may illustrate some emerging trends—as well as a few nagging questions—over the way such incidents will be litigated in the future.

The Messaging Could Get Another Edit

In a post-Equifax world, attorneys and clients involved in a data breach settlement may be paying a little more attention to the nuances of how those terms are communicated to class action members. Michael Waters, a shareholder with Polsinelli, alluded to fallout surrounding the settlement announcement involved in the Equifax case, which indicated that impacted individuals could be receiving up to $125.

However, given the number of people involved in the class action, there's a possibility that individual class action members could ultimately find themselves holding a smaller check. "It may be that for future matters when settlements are announced that both plaintiff and defense parties are maybe a little more careful with how they message what people receive so that they are not setting expectations too high," Waters said.

The Perceived Value of Lost Data Is Going Up

A breach-related class action involving 147 million consumers doesn't come along every day, but there's still a chance that the scope of Equifax's $1.4 billion settlement could become par for the course depending on the size of the infraction. "We'll probably see in these larger lawsuits and larger data breaches settlements that look like Equifax's … but on smaller data breaches, on smaller incidents, you're probably only ever going to get credit monitoring," said Tomu Johnson, of counsel at Parsons Behle & Latimer.

Still, even credit monitoring standards may be getting an upgrade. Johnson pointed out that most settlements typically offer a year of free credit monitoring, maybe even three if the company is generous. Equifax's 10 year commitment is unusual. "It goes to, I think, a sense that there's a value to having your information lost that courts have usually been unwilling to entertain up until this moment," Johnson said.

Remedying Harm Will Continue to Get More Complicated

Myriah Jaworski, a certified information privacy professional with Beckage, echoed Johnson's belief that settlements on par with Equifax are going to become the norm, with the statutory damages provision of the California Consumer Protection Act potentially allowing for smaller class action suits to progress where they might not have before. However, exactly what future data breach plaintiffs will be asked to prove with regard to injury or damages is still up in the air in some states.

"Here you see this massive settlement amount, and you just sort of assume that there may have been some great demonstration of harm or damage, and that's not always the case," Jaworski said.

She expects to see more regulatory clarity provided on the issue of standing within the next year or two. Until then, the questions persist. "I think we're also starting to ask ourselves, is this really the type of harm that should be remedied by monetary damage, or is this something that should be dealt with more exclusively through credit monitoring?" Jaworski said.