June 27, 2024 – The security of consumer data is a major issue all around the globe. It impacts all businesses because all companies collect data from consumers in one way or another. The firearms industry is no exception. Whether it be through sales transactions, internet traffic, background checks, marketing activities or otherwise, firearms companies come into contact with a large amount of consumer data. From the General Data Protection Regulation (GDPR) in Europe, to the privacy statutes currently in effect in various states here in the U.S., it is challenging to keep everything straight and ensure that your company’s data collection, use, and storage practices offer sufficient protections to their customers and do not violate any relevant privacy statutes.
Part of a company’s responsibility includes making sure that the consumer data it collects is properly safeguarded. Generally speaking, this requires that companies implement reasonable data protection measures to protect consumer information from preventable risk of being disclosed without authorization. This issue has once again been brought to the forefront with a class action lawsuit recently filed in California against Ticketmaster LLC and Live Nation Entertainment Inc. This lawsuit alleges these companies were negligent and violated California’s Consumer Protection Act when they failed to properly secure consumer data, leading to a massive data breach last month that affected 560 million consumers. The breach exposed consumers’ names, email addresses, physical addresses, phone numbers and credit card details; and was the result of the companies being hacked by a group that is allegedly attempting to extort $500,000 from the companies. According to the complaint, “[t]he data breach was a direct result of defendant’s failure to implement adequate and reasonable data protection procedures . . . necessary to protect consumer’s [personally identifiable information] from foreseeable and preventable risk of unauthorized disclosure.” The class action plaintiffs are seeking statutory damages for anywhere from $100.00 – 750.00 per class member, in addition to any actual damages that exceed statutory damages. Given that these companies process tickets for millions of customers annually, this lawsuit poses a potentially major financial blow, all stemming from the fact that their systems were hacked, and customer data was stolen.
Here in the U.S., more states are passing these types of statutes. Currently, five states have consumer privacy bills in effect. California was the first in 2020, and since then, Colorado, Connecticut, Utah, and Virginia have followed suit. Three more states – Oregon, Texas, and Florida – have statutes that are set to become effective beginning July 1, 2024, with an additional ten states having also passed statutes that will become effective within the next two years. Beyond that, eight more states currently have active bills being considered. It is a safe bet that before long, nearly every state will have a consumer privacy statute in some form. Navigating the different requirements and potential penalties under these various statutes can be daunting. Nevertheless, it is vital for firearms companies to ensure that they have suitable data collection, storage, and protection procedures in place to shield their customers’ data and minimize the risk of falling prey to these types of hacking attacks, and subsequently being subject to potential class-action lawsuits brought by affected consumers or prosecutions by state regulators.
Renzulli Law Firm, LLP continues to monitor privacy legislation around the country, as well as lawsuits resulting from alleged violations of these statutes. If you have any questions about consumer privacy compliance or these legal challenges, please contact John F. Renzulli or Christopher Renzulli.