Trending (Part II): Cybersecurity/Data Privacy, AI and Website Tracking Technology Litigation

Welcome back! I hope you’re ready for Part II of our discussion on trending litigation. This edition focuses on emerging trends related to cybersecurity and data privacy, artificial intelligence (AI) and website tracking technology. So, without further ado, let’s get started.

What are the Trends? 

Cybersecurity/Data Privacy: Class action litigation continues to be widespread in the cybersecurity and data privacy space. Several credit unions have faced lawsuits following cyberattacks that exposed members’ Personally Identifiable Information (PII).

For anyone less familiar, PII refers to information that can identify an individual—either on its own or when combined with other data. There are two main categories:

• Sensitive PII, such as Social Security numbers or driver’s license numbers, which can directly identify an individual.
• Non-sensitive PII, such as birthdays or phone numbers, which generally cannot identify someone without being paired with additional information.

As financial institutions, we have a duty to protect our members’ PII. When a breach occurs and member data is accessed, lawsuits often follow—challenging whether the institution took proper steps to safeguard the information and comply with legal requirements. The causes of action that are being brought under this theory stem from the alleged failure of the financial institution to properly secure member data and/or their third-party providers’ failure to do so. This means that credit unions need to continually evaluate the security of members' information and evaluate third-party provider safeguards for protecting this information where applicable.  

Artificial Intelligence (AI): AI’s continued popularity and increased adoption is leading to an uptick in litigation related to the use of this technology. Credit unions and other institutions are increasingly incorporating AI into everyday operations, which has prompted lawsuits over issues such as call recording and transcription without proper disclosures and algorithmic bias in lending and credit decisioning.

Most of these claims are brought under state law, but this area of litigation is likely to expand as AI becomes more deeply integrated into products, services, and operations—and as lawmakers continue to develop new statutes and regulations governing AI usage.

Website Tracking Technology: This litigation trend should not be new to you, as I have talked about it previously, however, I think it’s worth highlighting again as it is not going away anytime soon. Litigation continues to target organizations for the tracking technologies embedded in their websites—specifically those that collect and transmit nonpublic personal information or personally identifiable financial data to third parties (such as cookies and pixels).

The issues stem from the fact that members are not aware that these tools are in place and of the ways in which their information is being collected and shared. Plaintiffs are arguing the use of these pixels and/or cookies violate the Gramm-Leach-Bliley Act and/or state privacy statutes. To mitigate risk, credit unions should proactively review their website technologies, identify what data is being collected or transmitted, and ensure compliance with applicable privacy regulations.

To sum it up… 

As I said last time, litigation is not going anywhere and the causes of action will continue to evolve as technology does. Staying on top of litigation trends is more critical than ever. I said it before and I’ll say it again: awareness is our first line of defense.  

As always, this article is intended for general information only and does not constitute legal advice. If you have any questions about this topic and/or possible implications, you should contact your attorney for advice.  

Hope to see you next time when we take a second to dig into the Telephone Consumer Protection Act (TCPA)!  

« Return to "Take a Second CU Legal Insights"