Antitrust Law Daily Wrap Up, PRIVACY NEWS: Adult dating website Ashley Madison sued over data breach, (Aug 27, 2015)

By Linda O’Brien, J.D., LL.M.

The operators of the adult dating website Ashley Madison invaded the privacy of the users of its website by failing to keep their private information safe and by disclosing such information to unauthorized parties for unauthorized use, according to a complaint filed in the federal district court in Los Angeles (Doe v. Avid Life Media, Inc., August 21, 2015).

Avid Life Media and Avid Dating Life operate the online dating site AshleyMadison.com under the Ashley Madison trademark. The website, in operation since 2002, is designed to facilitate discreet intimate adult encounters for individuals who are married or in committed relationships. The website stores personal, financial, and profile information of its users—such as login details, mailing addresses, email addresses, telephone numbers, payment transaction details, credit card data, and passwords—as well as photographs and sexual fantasies.

A male consumer, using the pseudonym “John Doe,” created an account with Ashley Madison in March 2012.

According to the complaint, on July 20, 2015, a hacker known as Impact Team accessed and downloaded the information of all of Ashley Madison’s 37 million customers. Following the theft, the hackers threatened to release all customer information on the Internet if Avid Life did not shut down the website. Avid Life refused to shut down the website. On August 18, 2015, the hackers released on the Internet 9.7 gigabytes of stolen and highly sensitive personal and financial information, including user identity information and their sexual interests, belonging to the website’s 37 million users. Included in the “dumped” data was the data of individuals who paid a fee to have Ashley Madison scrub their profiles from the site but whose profiles had apparently not been scrubbed.

The complaint states that, in March 2012, the plaintiff created an account with Ashley Madison. As part of the process of creating the account, the plaintiff created a user name and password and entered his personal information into the website’s system, including photographs. He subsequently purchased credits and communicated with other users on the website. The plaintiff’s account and personal information was among the information that was compromised in the data breach and made public on the Internet.

As a result of the defendants’ unreasonable and inadequate data security, its users’ extremely personal and embarrassing information is now accessible to the public, the plaintiff alleged. In addition to the embarrassing information regarding users’ sexual interests and seeking to have affairs, their addresses, telephone numbers, email addresses, credit card information, birth dates, and photos are now available on the Internet. For many of the website users, the publicity of this information has created and will continue to create irreparable harm, the complaint states.

The complaint also states that the website’s users had reasonable expectations of privacy in the private information the defendants mishandled. The massive data breach could have been prevented had the defendants taken necessary and reasonable precautions to protect user information by encrypting the data entrusted to it on a database level so that any information hacked and downloaded appeared in the encrypted format. Furthermore, the defendants were aware or should have been aware of the need to secure users’ information in light of the recent rise in massive security breaches on the Internet.

The plaintiff asserts claims for negligence, negligent infliction of emotional distress, invasion of privacy, breach of implied contract, conversion, and violations of California’s Unfair Competition Law and Customer Records Act. The action seeks declaratory relief, disgorgement, restitution, damages, pre- and post-judgment interest, attorney fees, costs of suit, and any other just and proper relief.

The case is No. 2:15-cv-06405-PSG-AJW.

Attorneys: Julian Hammond, Polina Pecherskaya, and Ari Cherniak (HammondLaw, P.C.) for John Doe.

Companies: Avid Life Media, Inc.; Avid Dating Life, Inc.

News: Privacy StateUnfairTradePractices CaliforniaNews