Question

Risk Corporation is incorporated in Minnesota. The company operates a financial services business and serves clients in Wisconsin and Minnesota. Although the articles of incorporation describe the business purpose of the company as "providing financial services to business clients," Risk Corporation has recently begun selling insurance to clients. Due to a recent increase in the number of cyber attacks affecting companies in the local area, Risk Corporation’s board of directors decides to address the issue of data security during its regularly scheduled board meeting. Since the board does not have expertise in this area, the board decides to hire Crown Security Experts, a consulting firm, to advise them on the issue of data security. The board hires Crown Security based on the suggestion of board member Fay Francis. The board is unaware that Fay Francis has an ownership interest in Crown Security Since Fay does not mention her ownership interest in Crown Security. Because Fay has a background in data security, the board relies on Fay in its decision to hire Crown Security even though other security consulting firms offer similar services at a lower rate. Crown Security informs the board that Risk Corporation should adopt a more aggressive data security program and an incident response plan in the event that corporate data is compromised by a data breach. Although many companies have incident response plans, there is no legal requirement to establish an incident response plan. Based on this advice, Risk Corporation's board decides to invest in an expensive incident response plan. Although the board monitors whether the incident response plan is implemented, the board does not fully monitor how individual employees are trained on data security procedures. Two months later, there is a significant data breach after a Risk Corporation employee inadvertently forwards an email to the wrong recipient. Had the company adopted a more aggressive data security training program, it is possible that the data breach could have been avoided. As a result of the data breach, customers’ personal and financial data is confiscated, resulting in significant financial losses for Risk Corporation customers. Following the discovery of the data breach, stock prices at Risk Corporation decline. Although Risk Corporation notifies customers of the security breach, the company does not notify customers in a timely manner. Risk Corporation notifies customers after two months, in violation of Wisconsin laws. Although the board ensures that customers are notified about the security breach, the board does not take an active role in evaluating the timing of the notification since other companies use a similar shareholder notification program. Based on these activities, shareholders file a derivative action against the company and sue the board of directors. At the time the shareholders file the lawsuit against Risk Corporation and the board of directors, Risk Corporation's customers file a lawsuit against the shareholders. The customers' lawsuit against Risk Corporation shareholders alleges that the shareholders are liable for the customers' losses due to confiscated personal data since the corporation was formed to evade an existing obligation.

If you are representing the defendant, the board of directors, present your arguments explaining why the board of directors should not be liable in this case. Discuss all relevant legal principles from chapters 39 and 40. also, indicate what additional information would be helpful in analyzing the case.

Answer 1

*****Please please please LIKE THIS ANSWER, so that I can get a small benefit, Please*****

In representing the defendant, the board of directors many legal principles are relevant in explaining why the board of directors should not be liable in this case. Chapter 39 talks about the process and financing within corporations. Corporate personnel states that the overall the board of directors is entrusted for what happens to the corporation, policy decision, and hiring. They are elected by shareholders and shareholders are those that purchase a share of the stock in a corporation. There are several different kinds of corporations and the classification depends on location, purpose and characteristics of ownership. Risk Corporation would be a domestic corporation to Minnesota and since they do business in Wisconsin that state would refer to them as a foreign corporation. Another important legal issue is a concept known as, “piercing the corporate veil”. This term ignores the corporate structure, when the owners use a corporate entity to conduct fraud, find a way around the law, or achieve an illegitimate objective in some different way. This term also refers to exposing shareholders to personal liability. This is done so in court when the corporate privilege is abused for own personal benefit and when the business is treated very carelessly. If this occurs shareholders become liable for corporate debts. Several factors lead courts to pierce the corporate veil, but no single factor is conclusive, and it depends on the specific circumstances and facts of the case. The board of directors did invest in an expensive incident response plan. Also, the lawsuit from Risk Corporations states the shareholders are liable for the customers' losses due to confiscated personal data since the corporation was formed to evade an existing obligation. In chapter 40 corporations’ directors, officers, and shareholders are discussed. The duties of the board of directors are to govern the corporation and call meetings as an agent of the corporation. They have the power to make micro decisions, such as the board ensuring the customers are notified about the security breach and the expensive investment of an incident response plan. Doing this is the board of directors’ duty to the corporations’ best interest, not the interest of the board of members or the shareholders. The board of directors are acting under the duty of care as their duty to the corporation and duties to make informed decisions and apply to the better judgement rule. They also have a duty of loyalty which is a fiduciary duty, as well as conflict of interest disclosing any conflicts between personal interests and those of the corporation. Lastly, hiring Crown Security was suggested by Fay Francis who the board of directors is unaware that she is interested in ownership of Crown Security who has overextended her obligations by serving on a number of corporate boards.

ALTERNATIVE ANSWER:

If I were represent the shareholders, then following arguments explaining why the shareholders should win their case as below

• Shareholders are not engaged in any of the data breach activities and they do not have any liability due to ownership/responsibility/accountability for the data breach event. The board of director and executive team is responsible for the data breach event.
• Board of director is responsible/liable for not reviewing the adequacy of the Crown Security firm and its engagement with one of the board of director Fay Francis. This could be the key cause for the data breach incidence in the organization.
• The board of directors are responsible and liable for selecting the inappropriate security response plan, which is not enough aggressive for the business need.   
• The Shareholders had filed the directive law suit against the board of directors. This lawsuit will be against the board of director and board of director will be investigated for their issues against the data breach incident happened at the organization.
• The board of director and executive team will be responsible in not investigating the ownership role of Fay Francis with the Crown Securities, which is hired for security services for the organization. Fay Francis has influenced the rest of the board of directors to hire Crown Security for the cyber attack prevention approach. This will be the key reason that will be supporting the data breach incident for the organization. Shareholders do not have any linkage with this issues and shareholders will not be made liable for the data breach incident

The additional information would be helpful in analyzing the case is the root cause analysis for the cyber attack issue or data breach incident. The root cause analysis will show the key cause that had resulted in the data breach incident and how this has happened and what could have prevented this event.

*****Please please please LIKE THIS ANSWER, so that I can get a small benefit, Please*****