• by Ray Schultz , Columnist, May 25, 2017

Target Corp. has settled one of the worst data breach cases yet seen, agreeing to pay $18.5 million to 47 states. It's not much money as such things go, but Dark Matter estimates the true cost to Target is closer to $202 million, legal fees and other expenses are counted.

Back story: Target was the victim of a malware theft that included names, email addresses, phone numbers and other identifiers of tens of millions of people. Altogether, 61 million consumers were affected one way or the other, according to the Albany Times Union.

There are two lessons to be learned from this episode.

One, as Dark Matter writes, is that companies will be held accountable for data breaches that expose personally identifiable information. You don't have to do anything deliberate -- you can get into trouble through omission and sheer incompetence. 

The other lesson is that state attorneys general are stepping into the gap left by the federal government. 

Which gap is that? This one: As Aaron Lancaster and Gabriella E. Ziccarelli write in Corporate Counsel: "There are significant indicia -- including the unreported gathering and use of big data by the Trump campaign to deliver targeted political advertisements; new actions by Customs and Border Patrol to examine the social media history of people entering the U.S., including U.S. citizens; and the alleged gutting of Internet privacy protection, to name a few," to show that privacy is not a high federal priority.

But don't rejoice, those few who would knowingly violate the law. It is likely, the authors continue, that "significant data privacy enforcement" will occur at the state level: 48 states, run by both Republicans and Democrats, now have data breach notification laws.

And it doesn't stop with privacy. Many states also have "mini-FTC acts" that protect consumers from unfair and deceptive trade practices, Lancaster and Ziccarelli write. And they have mini Can-Spam acts.

Here's one more reason you can get in trouble with the states. In his comment on the target cases, New York Attorney General Eric Schneiderman said: "This settlement marks an important win for New York -- bringing over $635,000 into the state," along with other benefits, the Albany Times Union reports.  

Get it? That $635,000 -- New York's share of the settlement -- is small change on the federal scale, and it couldn't have been easy to obtain. But such sums can be important to cash-strapped states.