A federal judge has ruled that department-store employees whose personal information was made public can’t sue the insurer allegedly responsible for the breach as a class.
Employees of the nationwide store Dillard’s can’t collectively sue Combined Insurance Co. of America for the breach because the employees are spread across several states, all of which have different contract laws, US District Judge Ruben Castillo ruled.
The employees filed a suit in 2014 accusing the insurer of failing to prevent a third-party vendor from posting personal information on an unsecured database. Information posted included sensitive personal data like Social Security numbers. Some of the employees whose information was posted later claimed that their identities were stolen.
According to the lawsuit, Combined hired a company called Enrolltek to help process insurance applications. Enrolltek’s CEO then allegedly stored those applications on an unsecured hard drive, and an Enrolltek employee allegedly uploaded files containing “the name, address, date of birth, Social Security number and other insurance enrollment information” of Dillard’s employees, as well as their dependents.
Castillo encouraged the parties in the lawsuit to “exhaust all settlement possibilities” before moving forward, ruling that he couldn’t certify the employees as a class.
At issue in Castillo’s decision was whether a promise made by Combined to protect insured employees’ privacy was enforceable. Castillo said that since the employees live in 25 different states, it would be impossible to answer that question given varying contract law.
“Given the multiple state laws that would be applied in this case, the court easily concludes that certification of a nationwide class would be improper,” Castillo wrote in his ruling.
Related stories:
Insurer sued by Yahoo hits back
Unemployment Insurance Agency breach – 1.9 million records at risk
