AvMed Settlement Open To Those Who Did Not Suffer Identity Theft

A $3 million settlement was approved last week by Judge James Lawrence King in a class action lawsuit filed over AvMed Inc.’s 2009 data breach. The health insurance company was accused of inadequate security after a laptop with the personal details of more than 1.2 million customers was stolen. The settlement is drawing attention, however, because, for the first time, consumers who did not suffer identity theft will still be able to stake a claim.

Under the terms of the Settlement, Defendant has agreed to create a Settlement Fund in the amount of $3,000,000.

With the huge focus on data breaches recently (starting with Target’s breach over Thanksgiving 2013 and continuing as more and more companies admit they may have suffered breaches), the settlement is being hailed by attorneys in the case as a template for future class action settlements. The 2009 breach reportedly included AvMed customers’ names, addresses, phone numbers, social security numbers, and medical histories, including prescription records. Though the company denies wrongdoing, plaintiffs alleged that the lack of adequate encryption and security constituted negligence. The two sides have now come to an agreement, and those whose information was stolen will be compensated.

The most interesting aspect of the case, though, is the inclusion of those who have not actually suffered identity theft after their information was stolen.

In approving the class, Judge King is clearly laying the blame and the cost of the theft at the feet of the company, but – more importantly – setting a precedent for future data breach settlements to include all consumers who were affected in any way, rather than just those who suffered actual damages. As the settlement website itself says, “If You Paid for or Received Insurance from AvMed, Inc. at Any Time Through December of 2009, You May Be Part of a Class Action Settlement.” [Bolding added]

The initial deal was announced in September of last year, though details weren’t made public until October, and were still subject to final approval. The motion was unopposed, meaning that AvMed was in agreement with plaintiffs as to the best course of action. In the motion, the two sides agreed that:

While it may not seem like big money –$30 at most for consumers who didn’t suffer identity theft – the fact that these people can make claims could have an important bearing on future settlements. If companies can be found culpable when consumers’ data is breached, even without any actual harm, the cost of settlements could drastically skyrocket. Take, for example, Target’s breach – more than 70 million customers were affected, meaning the company would be looking at a hefty settlement if litigation followed the same pattern as AdMed’s – and nothing inspires companies to act quite like the threat of losing billions of dollars. If the cost of exposing customers’ data goes up, so too will companies’ security, as they move to avoid, whenever possible, such repercussions.

While you’d hope that companies will be keen to protect consumers’ data for its own sake, it’s nice to know that the threat of losing profits is looming in the background.

UPDATE: The settlement for this case expired on 31 March, 2014.