The news today that two Canadian law firms have filed a $578 million-dollar class action lawsuit against Avid Life Media is the strongest evidence yet that blame for the leak of personal information of more than 39 million users will fall to the company behind Ashley Madison, not the hackers who stole their information. (Compare that figure against the bounty Avid has placed on "information leading to the arrest and prosecution of the individual or group of people responsible": $500,000.)
American firms are following suit; last week, Rosen, a New York law firm, announced it had "initiated a class action lawsuit investigation", and the lawyer representing a Missouri woman who sued Ashley Madison in US District Court before the data was published online told ABC News that he has been fielding calls from potential class members.
"We're definitely moving forward," Phillip Kim, a partner at Rosen, told BuzzFeed News. "And we anticipate filing the lawsuit very shortly."
But while a tsunami of American litigation is imminent, it's not clear that any of it will have the desired effect. In fact, a class action suit in Canada has a much higher likelihood of success than one in the States, even though a majority of the site's users hail from the US.
That's for several reasons. A 2013 Supreme Court decision, Clapper v. Amnesty, International found that plaintiffs had to show "certainly impending injury" as a result of a privacy violation to confer legal standing. Canada has no such standard.
In Canada, damages are assessed after trial, long after the certification of the class. According to Ted Charney, the Toronto lawyer whose firm brought the suit in Canada, a judge would simply need to rule on the two points of Canadian law at issue in the suit: 1. Whether Ashley Madison committed a breach of contract for failing to protect the confidentiality of users (including those who paid 19 dollars for the so-called "full delete" option), and 2. Whether Ashley Madison is vicariously liable for "Intrusion Upon Seclusion", a relatively recent privacy tort that would provide for damages based on humiliation and insult to reputation. If Ashley Madison was found liable, individual plaintiffs in the class would each go before an arbitrator to determine individual damages, which may vary widely.
Post-trial damage assessment and the lack of a "certainly impending" standard have created a friendly environment for privacy classes in Canada; according to the law firm Norton Rose Fulbright, "Over 20 privacy class actions have been filed in Canadian courts in recent years."
That climate doesn't exist in the US. "It's much more difficult in the States to get these privacy breaches certified," Charney told Buzzfeed News, "because there has to be substantial evidence" of injury.
In addition, in the States, broadly speaking, plaintiffs seeking "individualized" damages cannot be certified as a class; the uniformity of the damages have to be established at the certification stage. In other words, a CEO who lost her job because of the leak could not seek financial compensation as part of the same class as a husband seeking emotional damages after his spouse left him because of the leak, who could not seek seek financial compensation as part of the same class as a movie star who suffered bad publicity; the damages would all be too different.
That doesn't rule out classes that seek certain, limited kinds of damages. Avid Life Media claims that the credit card information contained in the leaks is partial and unactionable. If that turns out to be false, it would be relatively straightforward to calculate compensation based on protecting the affected members from fraud.
"Assuming financial information is out there, everybody would benefit from getting credit monitoring and identify protection services," Joel Bernstein, whose firm, Labaton Sucharow, filed a class action suit on behalf of more than 20 million governments workers over the Office of Personnel Management breach, told BuzzFeed News.
And Rosen's forthcoming suit, according to Kim, is likely to focus on false advertising related to the pay-to-delete function, although it's reasonable to wonder what damages plaintiffs would be entitled to, beyond a refund, and legal fees. Notably, such a class suit would not deal with a privacy tort. And even if such a case wouldn't necessarily result in a huge judgment for the plaintiffs, corporate defendants in privacy cases sometimes settle to avoid the cost of litigation. Kim declined to comment on whether a class action suit would be easier to bring in Canada.
None of this is to say that Americans harmed by the leak won't seek massive damages against Avid Life for violation of privacy and harm sustained because of it. Just that these are much more likely to be brought as individual lawsuits.