0

Suppose your company is doing a competitive analysis on a competitor, and compiles a set of unflattering data. This is for "internal" (company) use, not for publication. But a hacker breaks into your system, steals the info, and publishes it. Some of it happens to be "untrue." The reason is because this data is being constantly collected and verified, but because of the hacker, some false data was "released" before the company could do its checks.

Under currently existing legal theories, would the liability be limited to the hacker who actually published the data? Or is there an established theory of liability against your company for compiling it? For the above, assume that we are in the U.S.

Let's move to the UK, where libel law is much more in favor of the plaintiffs. There, not only publishers but distributors of "libel" can be sued. Would it be much easier to sue your company in the UK on the theory that you were part of the food chain?

Improve this question
4
  • I don't understand the distinction between "internal" and "publication", in terms of the law pertaining to communication of untrue damaging statements. Are you referring to "smaller audience" vs. "larger audience"?
    – user6726
    Aug 3, 2017 at 21:38
  • @user6726: "internal" means that only company employees can read the material. External means that it is published "outside" the company. Let's say that the data is constantly being compiled, and vetted, but because of the hacker, some false data was leaked before it could be vetted "internally."
    – Libra
    Aug 3, 2017 at 21:40
  • So the statements are conjectures, rather than assertions of fact, but may be phrased as though they were assertions, right? It's not "data" until it's vetted, so I was thrown by the use of "data".
    – user6726
    Aug 3, 2017 at 21:57
  • @user6726: Yes, fair enough. My understanding is that the company would have a strong defense in the U.S., less so in the U.K.
    – Libra
    Aug 3, 2017 at 21:58

1 Answer 1

Reset to default
1

In my limited experience with defamation cases, I recall that it is considered an "intentional tort", meaning the plaintiff has the burden of proving that the defendant's publication of the false information was intended to cause harm. As the hypothetical collection was not published by the company for ANY reason, it would seem unlikely that they would have much liability for the (presumably third-party) hacker's actions.

Internal distribution of trade secrets is not considered "publication" because the company would be deemed a unitary entity and thus internal use by employees (with fiduciary duties of confidentiality) would not be to "another person".

Improve this answer
1
  • I agree that there has been no publication by the company, only by the hacker (and the hacker may sincerely believe that information to be true because he thinks that company is more accurate than it really is, in which case neither would be liable). At a minimum a publication of a defamatory fact must be a voluntary act.
    – ohwilleke
    Aug 4, 2017 at 4:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .