DATA PRIVACY & CYBERSECURIT Y
Preserving Privilege in Data Breach Investigations By J. RANDALL BOYER
F
orensic examination of data systems is critical when responding to a data breach. However, with lawsuits under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) emerging as an additional threat, companies doing business in California are well-advised to undertake these investigations in a way that shields them from discovery. A decision
10
from a CCPA case, In re Blackbaud, Inc., stands as a timely reminder. Blackbaud, Inc. is a cloud computing, account management and billing services company that was the victim of a ransomware attack in early 2020. The company paid the ransom in exchange for return of customer personal data and a promise that the hackers would destroy any and all copies of the data. Despite that promise, whether
TODAYSGENERALCOUNSEL.COM JANUARY 202 2
and to what extent personal data was divulged or retained remains unknown. The incident, unsurprisingly, spawned several lawsuits, including a CCPA class action filed in the Central District of California. The named plaintiff alleged that Blackbaud had not taken reasonably available steps to prevent the breach. These suits are currently proceeding in multi-district BACK TO CONTENTS
