Until recently, cases alleging damages for data breaches have been mainly unsuccessful, absent a showing of actual damages by the persons whose personally identifiable information was hacked. In a recent decision, the U.S. District Court for the District of Massachusetts held that negligence and breach of fiduciary duty counts could be brought for a data breach. It also has initially ruled that non-economic damages like pain and suffering, inconvenience, et cetera could be the basis for a recovery under those theories.
WHY THIS IS IMPORTANT... Although not a final decision, this case opens the door for class action damages even where people whose data was hacked suffered no economic loss. This is part of U.S. law's overall data and privacy rights expansion.