Bill That Would Limit Ability to Sue Over Data Breaches Clears First Hurdle

By Gordon Hopkins The Nebraska Legislature advanced a bill that would limit liability in the event of a cybersecurity event on February 12, 2025. If passed, the bill would make it more difficult to bring a class action lawsuit against a private entity in possession of Personally Identifiable Information (PII), such as names, addresses social security numbers, or other identification numbers, should a cybersecurity event compromise that data.According to the bill's published statement of intent, “LB (Legislative Bill) 241 would provide a definition for a cybersecurity event for the unauthorized access to or disruption of information systems of private entities. It would further require that in order to maintain a class action lawsuit against a private entity for such an event, a person would need to demonstrate the cybersecurity event was the result of willful, wanton, or gross negligence on the part of the private entity.”Private entities would include corporations, associations, businesses, religious organizations, and charitable organizations, such as nonprofits. This comes on the heels of a series of high-profile data breaches in which thousands of customer's PII were accessed by unauthorized actors. One of those breaches occurred at PowerSchool, a software vendor that provides the Student Information System (SIS) for schools throughout the world, including several local schools. That company is now facing lawsuits filed in multiple states after a data breach in December of 2024.Change Healthcare, a division of UnitedHealth Group, also suffered a major data breach in 2024 and Nebraska Attorney General Mike Hilgers filed a major lawsuit in against the company..According to Senator Robert Halstrom (District 1), who introduced LB241, it is this very ‘surge’ in class action lawsuits that was the impetus for the bill. He suggested that most data breaches result in ‘minimal’ financial loss for individual consumers but extremely high costs for businesses in the form of lawsuits and increases in liability insurance. For example, Halstrom said, “Equifax involved a $380 million settlement, $2.58 was the per class member damages that were sustained, and the attorneys got $77.5 million. Yahoo, $117.5 million, damages of 61 cents per member, and the lawyers got $22,763,000.”“Even with the existence of reasonable precautions,” said Hallstrom. “The bad actors are always a step ahead of them.” Opponents to the bill include Senator Terrell McKinney (District 11), who said, “If my Social Security and my information is floating across the internet, across the dark web, somebody should be held accountable.” PII can be used for identity theft and is often sold on the dark web for that very purpose.McKinney said. “So if these corporations, or if these companies or private entities are negligent, they should be held accountable for these cybersecurity events.”Lawmakers voted to advance LB 241 to the second round of debate 33-9.

Lee Enterprises Continues to Struggle from Cyberattack

JCH&L Among Top 100 Critical Access Hospitals for 2025

Related Articles

Praise and Pancakes

Shamrock Shuffle

Odell Resident Recognizes Bitcoin Message As ‘Smishing’ Scam

Steele City Holds Meeting on Water Main Project