Authored by: Alan Pate

In a ruling this past Wednesday, November 14th, a Federal Judge in the Western District of Washington dismissed a class action against video game developer Valve Corporation. The class action stemmed from a November 6th, 2011 data breach of Valve’s popular online video game distribution platform, “Steam.” As a result of this breach hackers allegedly gained access to billing addresses, passwords, online handles/ID’s, and credit card information. Plaintiffs, a class of Steam subscribers, brought claims under six separate California causes of action alleging both present and future harm resulting from this breach.

Judge James L. Robart dismissed all of plaintiffs’ claims for failure to adequately plead damages. Judge Robart’s order discussed the legal inadequacy of the pleadings on both the future and present damages claims. As to the future damages, Plaintiffs had pleaded that because of the 2011 data breach they may be forced to spend money at some unspecified time in the future to “protect their privacy.” Citing a string of cases addressing this issue, Judge Robart explained, “when personal information is compromised due to a security breach, there is no cognizable harm absent actual fraud or identity theft.” Alleging only the possibility of future harm was insufficient.

As for present damages, Plaintiffs had pleaded that as a result of the 2011 breach they had “various services and subscription interrupted, loss of data, … an inability to access various gaming networks,” and that they lost money paid to Valve for “products and services.” Judge Robart held that this too was an insufficient plea of damages. Emphasizing the “higher plausibility threshold” that their complaint required due to the size and potential expense of the data breach class action, Judge Robart explained that to overcome a motion to dismiss, the plaintiffs must lay out exactly what services were interrupted, what data was lost, or how exactly money was lost on their Steam subscriptions (a free service).

Plaintiffs’ claims were dismissed without prejudice and they were given leave to amend within 30 days. The case is Grigsby v. Valve, Corp., No. C12-0553 (W.D.Wa. Nov. 14, 2012).

Photo of Gerald J. Ferguson Gerald J. Ferguson

Gerald Ferguson currently serves as the Intellectual Property, Technology and Media Group Coordinator for the firm’s New York office. Mr. Ferguson also serves as the national leader of the firm’s Privacy and Information Security group. He has worked with companies to create national…

Gerald Ferguson currently serves as the Intellectual Property, Technology and Media Group Coordinator for the firm’s New York office. Mr. Ferguson also serves as the national leader of the firm’s Privacy and Information Security group. He has worked with companies to create national and global privacy policies. He has extensive experience advising companies regarding compliance with state breach notification laws. Mr. Ferguson is able to advise clients regarding notification obligations quickly and efficiently using a state-by-state survey of the 47 jurisdictions with breach notification laws that is regularly updated by Baker Hostetler’s Privacy and Information Security group. As part of his proactive approach to an incident response, he works with forensic consultants to develop the substantive opinions necessary to support a determination that disclosure of a breach is not required when possible. If disclosure is required, he uses a team approach to carefully manage the process in a cost-effective and efficient manner that focuses on minimizing reputational harm.

Mr. Ferguson is Chairman of the Intellectual Property Committee of the New York State Bar Association, International Law and Practice Section.

Read more about Gerald J. FergusonEmailGerald's Linkedin ProfileGerald's Twitter Profile
Show more Show less