David M. Furr is a member of the North Carolina Bar Association’s newly created Privacy and Data Security  Committee, which begins work in the upcoming bar year. 

---

By David M. Furr

Traditional retail in the United States has had two distinct issues negatively affecting its survival in this decade. First, the proliferation of E-commerce companies has severely reduced the profitability of the traditional brick and mortar businesses as shoppers’ habits are fundamentally changing. In the first four months of this year, nine retailers have filed for bankruptcy — Payless Shoes, hhgregg, The Limited, RadioShack, BCBG, Wet Seal, Gormans, Eastern Outfitters and Gander Mountain — with the closing of hundreds of stores.¹  Many other retailers are shuttering stores at such a record pace that 2017 is being bannered as the year of retail bankruptcies.²

Second, retail has been particularly hard hit by cybersecurity breaches because of the wealth of Personal Identity Information (PII) collected and, unfortunately retained, by the retailers. The 2013 massive compromise of retail giant Target’s systems has been litigated in the courts and subject to an extensive Multi-State Attorney General task force action that has produced record payouts to plaintiffs.

The purpose of this paper is to use the Target litigation as a backdrop of the cybersecurity measures a business must have in place if it is to protect adequately the PII of its lifeblood — the customers. While common tort and specific statutory theories serve as the foundation for these claims, the sophistication of the Plaintiff counsels’ deep dive into the actual technology facts serve as an important road map to safe cybersecurity.

Read more