Ashley Madison and the Legal Battle Over Data Protection

By: Jonathan Ziarko 

“Life is short. Have an affair,” – the now infamous tagline of Ashleymadison.com. This summer the website was subject to one of the largest data breaches yet. Ashley Madison is a website owned by Avid Life Media, and it provides an online dating service for people who are already in a relationship. [1]

The hack, perpetrated by “The Impact Team,” a group of hackers who are taking credit for this massive data breach, is just one in a long line of data breaches of websites and companies.[2] In late August the hackers released the data of 33 million website users including their user names, real life addresses, phone numbers, passwords, email addresses, and potential credit card information.[3] Around 15,000 of the email addresses in the data file have been linked to the U.S. military or government addresses.[4] Access to the data could have a real impact on the people who are linked to the accounts. There is a serious possibility that the information leaked could be used to blackmail people who do not want their membership to such a website revealed. In fact, simply being on the list could put marriages in jeopardy.[5] The revealed information has already been linked to two suicides in Canada.[6]

So far there have been four class action suits brought against Avid Life Media, including one originating in Canada.[7] Avid Life Media is facing damages up to around $578 million from the Canadian lawsuit alone. [8] The lawsuits originating in the U.S. have yet to specify damages or even gain class action status but it is alleged that Avid Life Media acted negligently by failing to exercise reasonable care in protecting and safeguarding personal information in their possession, breach of contract, and other privacy violations.[9] A major contention in the lawsuits is the fact that the website charged users a $19 fee to permanently delete all of their data, however the data was still available.[10] The hackers stated this is the reason why they targeted the website in the first place as an act of so-called “hacktivism,” in order to stop the website form taking money for not actually removing data.[11] Internal sources are showing that the company was aware of some of the potential vulnerabilities but took no steps to fix them.[12]

The outcome of these cases could very well be groundbreaking on the subject regarding how the law is shaped around data protection. To date it seems there is no security system that is impervious to hacking, even the government is susceptible. Can there ever really be a reasonable expectation that all the data we put out on the Internet will remain private? All that companies can do is to use the best security they can by following industry standards and by doing their best to contain a breach when it does occur. As these cases unfold it may in fact have a large impact on how Internet based services conduct business and store data. It no longer seems a question of can personal data be stored securely online, but rather how long until someone decides they want to take our information and share it with the world.

 

[1] Amanda Lee Myers, Americans Sue Ashley Madison Over Hack, Time Inc. (Aug. 25, 2015), http://time.com/4010665/ashley-madison-american-lawsuit/

 

[2] Meg Wagner, Adultery website Ashley Madison hacked; intruders threaten to leak 37 million users’ personal info, New York Daily News (July 20, 2015, 8:40 AM), http://www.nydailynews.com/news/national/adultery-website-ashley-madison-hacked-article-1.2297545

 

[3] Ashley Madison: What’s in the leaked account data dump?, BBC (Aug. 19, 2015), http://www.bbc.com/news/technology-33986228

 

[4] Id.

[5] Myers, supra note 1.

 

[6] Ashley Madison: ‘Suicides’ over website hack, BBC (Aug. 25, 2015), http://www.bbc.com/news/technology-34044506

 

[7] Myers, supra note 1.

 

[8] Id.

 

[9] Kim Zetter, Ashley Madison Hit With $500 Million In Lawsuits, WIRED (Aug. 25, 2015, 3:30 PM), http://www.wired.com/2015/08/ashley-madison-hit-500-million-lawsuits/

 

[10] Myers, supra note 1.

 

[11] Wagner, supra note 2.

 

[12] Zetter, supra note 9.