Data Privacy and Data Breach

Using innovative frameworks and advanced data analytics capabilities, Cornerstone Research staff and affiliated experts have addressed issues related to causation, impact, and damages in disputes relating to personal data.

Much of today’s data are generated by the everyday activities of consumers as they communicate, shop, travel, work, or engage in routine interactions with other consumers, businesses, and government entities through digital systems, platforms, and social media. Given this massive accumulation of information, the opportunities for disputes over the use or misuse of consumer information continue to increase. Cornerstone Research has experience in high-profile data privacy and data breach matters, addressing a wide range of damages methodologies and analyses. Our experience covers all stages of litigation, including pre-litigation assessment of exposure, support for mediation, and expert testimony support at the class certification and merits phases. We also have substantial experience assisting clients in regulatory proceedings relating to data privacy or data breach issues in the United States and Europe.

Data Privacy and Data Breach Capabilities

Litigation and Consulting Experience

Our staff and experts have an in-depth understanding of the academic literature, proprietary data, and research on data privacy expectations, as well as the potential negative outcomes resulting from data breach incidents. We have addressed issues relating to a wide spectrum of personal data, including demographic information, financial information, app and device user data, geolocation information, and individual behavior (such as smart-TV viewing habits).

We have worked on data privacy disputes and data breach matters involving many industries, including major technology companies, app developers, smart device manufacturers, financial institutions, magazine publishers, national restaurant chains, credit reporting bureaus, and healthcare companies.

Damages Rebuttal

Cornerstone Research staff and experts have experience rebutting the methods plaintiffs use to value private data and determine alleged harm.

  • “Market price”-based methods: Plaintiffs in data privacy and data breach class actions often use so-called “market prices” and rely on transactions on the dark web or prices advertisers pay for targeted advertising. We have extensive experience in rebutting such methods.
  • Conjoint analysis: Conjoint analysis is another method used by plaintiffs in data privacy and data breach class actions to quantify the alleged overpayment for products and services. We have extensive experience with conjoint analysis and have rebutted such methods in disputes involving personal data.
    Learn more >
  • Contingent valuation: Plaintiffs in data privacy and data breach class actions have proposed contingent valuation surveys to assess, for example, how much consumers value their data or how much they would pay to protect their data. In these cases, we have evaluated the survey instrument and assessed the reliability of the results. As part of our analysis, we relied on academic research that demonstrates biases generated by contingent valuation surveys, including the susceptibility of such surveys to the “privacy paradox,” the well-known discrepancy between consumers’ stated privacy preferences and actual behavior.

Economic Causation

Causation is at the forefront of data breach class actions, as plaintiffs allege the breach caused fraudulent use of their data. However, because consumers may typically share the same types of data with multiple parties (e.g., payment card data) and because concurrent data breach incidents have become increasingly common, it can be difficult to establish a link between fraudulent activity and a particular data breach incident.

In data privacy cases, linking economic harm to the alleged misuse of personal information may be further complicated if such information was already in the public domain, or if consumers benefitted from the company’s use of such personal information (e.g., by receiving more tailored products or services).

Real World Consumer Behavior Analysis

Litigation relating to personal data usually involves an assessment of how consumers would respond in the but-for world to information regarding the use of their personal data. In many instances, key events can be used as natural experiments to analyze consumers’ real-world responses to such information. For example, statistical analysis can be used to analyze consumers’ product usage or product purchase decisions before and after a privacy-related disclosure by the company. Similarly, statistical analysis can be used to analyze consumer complaints about fraudulent payment card activity or consumers’ decisions to sign up for identity theft protection services before and after the announcement of a data breach incident.

Our expertise with processing and analysis of large datasets enables us to study such real-world behavior.

Consumer Surveys

We conduct rigorous consumer surveys to address a variety of issues that may arise in litigation related to personal data, such as:

  • Consumer expectations, awareness, or understanding of the types of data companies at issue collect, store, use, or share with third parties
  • Consumer expectations, awareness, or understanding of targeted advertising
  • Materiality of disclosures regarding targeted advertising and the types of consumer data that are collected, stored, used, or shared with third parties
  • The nature and extent of consumers’ data-sharing behavior with third parties

Class Certification and Merits Phase Experience

Cornerstone Research staff and experts have prepared expert reports during the class certification stage and merits phase of data privacy and data breach litigation. We have experience developing affirmative surveys and rebutting surveys, including conjoint studies, and have successfully rebutted various “market price”-based and other approaches to calculating damages at both the class certification stage and merits phase of class actions.

European Jurisdiction Experience

A variety of economic and legal issues have arisen in data privacy and data protection litigation as a result of the European Union’s General Data Protection Regulation (GDPR) and the UK’s Data Protection Act 2018 (DPA 2018). The right to compensation under these two laws has, by design, introduced a significant risk of damages actions following allegations of unauthorized use of, or access to, personal data. The emerging but nascent stage of such litigation in the UK means that experience from other jurisdictions and practice areas can provide significant insight into the likely challenges and opportunities when responding to such damages actions. Cornerstone Research staff and experts have assisted clients in proceedings in front of European data protection authorities.

Dark Patterns

Government agencies have recently put increased focus on the use of alleged “dark patterns,” or activities by firms that are loosely described as confusing, tricking, or manipulating consumers to take actions they did not intend to.  Allegations related to the use of dark patterns have included alleged hidden fees, unauthorized charges, and obscure privacy settings. Cornerstone Research professionals and affiliated experts have experience designing analysis to evaluate these types of allegations.