Are colleges that expose confidential student records vulnerable to class-action lawsuits?
Philippe Gross thinks so. The former student at the University of Hawaii-Manoa filed a class-action suit on Thursday against the University of Hawaii after the system allowed a series of privacy breaches.
Last month, the system discovered that a retired professor had posted Social Security numbers and other information about more than 40,000 alumni, purportedly including Mr. Gross, on a public Web server. In July, the system acknowledged that hackers had gained access to private records of 53,000 students and employees at its Manoa campus.
Mr. Gross’s lawyer, Thomas R. Grande, said the University of Hawaii had violated the constitutional right to privacy of the students and employees who were affected. “For those with access to private security information comes a heavy responsibility to protect that information,” Mr. Grande said.
A spokeswoman for the University of Hawaii said she could not comment on the lawsuit because the system had not yet been served with a copy. Officials have previously acknowledged that its decentralized approach to security was inadequate, and that it would spend more money on improving its data security.
The case could face a difficult road ahead. Courts have tended to reject claims that organizations that disclose private records are liable for damages, even when the disclosures violate their own privacy policies. An increased risk of identity theft does not constitute an injury, several courts have ruled.
Airline passengers sued JetBlue, which gave private passenger information to a third-party government contractor. But a federal district judge ruled in 2005 that passengers had no reason to expect they should be compensated for the loss of privacy.
Job applicants to Aetna, an insurance company, sued after a database with their Social Security numbers and employment histories was hacked. But a federal district judge dismissed the case in March, finding that the plaintiffs were unable to show more than speculative injury.
Mr. Grande acknowledged some of the challenges. But he pointed to a local case, Arakawa v. Sakata, in which a federal district judge in Hawaii ruled in 2001 that a public agency had violated a motorist’s right to privacy when it released his personal information after a car accident.
The court recognized that people have a privacy interest in not having their social security numbers disclosed, Mr. Grande said.
“It’s a cutting-edge area of the law,” he said. “I think, in our particular case, we have a very winning argument based on our local precedent to say that our present damages are necessary to prevent future harm.”