privacy business liability
Liability for Client Data Confidentiality
<p>If a ransom-ware attack was to happen which threatened to make public "private client data" if you didn't pay up: Is an LLP (Limited Liability Partnership) status enough to protect the company, its employers and employees?</p>

<hr>

<p>As companies are now sidestepping ransom-ware attacks by simply using good backups to restore copies of files, I believe the next logical evolutionary step would be for ransom-ware attacks to threaten to reveal confidential client data, where backups will be useless as a defense.</p>

<p>Also, as far as I understand, no security measure is 100% perfect to attacks, and that you can only reduce your chances of being attacked in the first place. </p>

<p>The intent of such an attack could be to take down a larger company to make way for your smaller company to take over.  I can think of many reasons why someone would want to create such a virus which could theoretically destroy a company.  Is there a legal way of protecting your company from such an attack without losing client trust?  Not sure how this can be done as if you don't pay, you lose your clients, and if you attempt to pay, you go bankrupt.</p>

<blockquote>
  <p>If a ransom-ware attack was to happen which threatened to make public
  "private client data" if you didn't pay up: Is an LLP (Limited
  Liability Partnership) status enough to protect the company, it's
  employers and employees?</p>
</blockquote>

<p>Limited liability means that one can't sue the owners of the company simply because they are owner of the company. </p>

<p>Limited liability does not protect the company itself at all from any liability. It also does not protect anyone who personally participates in actionable negligent acts that cause harm. But, employees and officers of a company are not liable for negligence caused by the company simply because of their affiliation with the company, they have to personally participate in the wrongdoing in most cases (there are a handful of exceptions to that rule, but this isn't one of them).</p>

<blockquote>
  <p>Is there a legal way of protecting your company from such an attack
  without losing client trust? Not sure how this can be done as if you
  don't pay, you lose your clients, and if you attempt to pay, you go
  bankrupt.</p>
</blockquote>

<p>The legal ways to protect the company are to include a waiver in the contract with the company, or to buy insurance that covers the risk.</p>

<p>Also, I'm not sure that there would be liability in any case. This is the intentional act of a third party and there is no good reason to believe that the ransomware company will comply if you pay them. In some jurisdictions and under some circumstances, it may even be illegal to pay a ransomware company.</p>

<p>The bigger concern from your company's perspective (which can also probably be waived) is whether the loss to the client was due to the company's negligence in taking measures to defend against ransomware in the first place before the infection happened. </p>

<p>I know of a case, for example, where the IT provider said they were doing backups and virus protection, but didn't actually do any virus protection and only had one day old backups that were rewritten with the ransomware infected version before it was detected. That is a failure of a basis standard of care and would probably be grounds for liability in the absence of a waiver.</p>
