Second US firm hit with shareholder action over readiness for GDPR

With a second US company hit by shareholder action over claims it delivered misleading statements on General Data Protection Regulation (GDPR) readiness and impact the regulation would have on its business, experts have warned the case strongly suggests that companies, and their top management, face even greater risks from the new data privacy regime in certain parts of the world than they may have previously thought. Last month, investors filed a lawsuit in the Southern District of New York against Nielsen, its CEO and CFO. Nielsen is a US-based global firm that uses data to deliver views on consumers and markets worldwide. Its shareholders are seeking class-action certification and damages for Nielson’s alleged misleading statements about the GDPR, which came into force in May. The move followed the company’s quarterly results, in which Nielsen said GDPR-related changes harmed its growth, disrupted its advertising ecosystem and pressured partners and clients. Nielsen missed its revenue and earnings targets, revising down its forecasts for the year. The company’s share price dropped by more than 25%. The shareholders argue that Nielsen failed to warn them of the effect the GDPR would have on the company. They said the company repeatedly assured investors that “because privacy was built into the way its business processes, the enactment of the European General Data Protection Regulation … would not impact its necessary access to large data sets provided by its partners like Facebook”. The shareholders allege that Nielsen’s statements were false because the company “recklessly disregarded its readiness for and the true risks of privacy regulations and policies, including the GDPR, on its current and future financial and growth prospects”. They also attest the company was “far more dependent on Facebook and other third-party large data set providers” than it has previously disclosed, and failed to explain that changes to privacy rules would affect such access. The Nielsen case follows a securities suit in the US against Facebook itself in July. The company’s quarterly earnings disappointed investors, in part because the company was affected by allegedly unanticipated expenses and difficulties in complying with the GDPR. Experts and risk managers have expected companies to fall foul of the GDPR’s data privacy laws and the regulators. But the cases brought against Nielsen and Facebook show that companies in the US and other parts of the world are at risk of lawsuits for simply failing to manage the impact of data privacy law on financial performance. Rashmi Knowles, field CTO EMEA at RSA Security, said the lawsuits open the “floodgates” for “countless organisations to be taken to task for overlooking the business impact of lax data privacy”. She said any company outside of the EU in any doubt about whether GDPR applied to them should be taking heed and acknowledging that if you process or store EU-citizen data, GDPR is a business risk that needs to be managed. “As such, it’s a final warning to all organisations that securing personal data is no longer just the responsibility of the IT team, but a board-level issue that impacts every aspect of a company from profitability to shareholder confidence,” said Ms Knowles. According to Kevin LaCroix, attorney and executive vice-president at RT ProExec, an insurance intermediary focused exclusively on management liability issues, the Nielsen lawsuit underscores the suggestion that privacy-related concerns could be a significant source of corporate liability. “I noted at the time…that Facebook is far from the only company that was going to struggle with GDPR-related expenses and compliance difficulties. As the new lawsuit against Nielsen suggests, other companies are struggling with these issues as well,” wrote Mr LaCroix in The D&O Library. He said it is particularly interesting that part of the Nielsen case relates to problems its partners and clients had with GDPR compliance. “This knock-on effect suggests that other companies might also experience disruption as the companies’ customers, vendors, suppliers and partners themselves struggle with GDPR and other privacy-related compliance,” said the attorney. “I suspect strongly that Facebook and Nielsen are not going to be the only companies that experience financial effects from the impact of GDPR and other privacy regulations, and some companies experiencing privacy-related issues will be hit with D&O claims,” he added. Strategic Legal Solutions said the Nielsen case is “significant” because shareholder claims do not allege violations of the GDPR, but are grounded in US securities law on the basis the defendants failed to prepare for the regulation and made misleading representations that they had. “While this case is a securities fraud complaint seeking class-action certification, and not a data privacy or cybersecurity case, it is noteworthy because it is one of the first, if not the first, case brought under US law, seeking damages against a corporation operating in the US for the company’s alleged failure to assess adequately the impact of the GDPR on the company’s revenue streams as well as the company’s access to vital data from its data partners,” said the legal firm. It stressed that regardless of the outcome of the claims against Nielsen, companies based in the US should review their data privacy compliance with newly enacted data protection legislation, such as the GDPR and California AB 375. It said companies need to ensure they have adequately prepared for the impact of these statutes and forecast revenue accordingly. California AB 375 was passed in June and marks the first move by a state to introduce GDPR-like data protection laws in the US. A growing number of countries around the world are enacting GDPR-style data protection law as regimes. Last month, Brazil enacted tough data protection laws along the lines of the GDPR. India also recently announced plans to modernise its data protection laws. The European Union and Japan agreed in July to recognise each other’s data protection regimes as 'equivalent'.

Second US firm hit with shareholder action over readiness for GDPR

Want to read this article?

Read Next

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

SEC climate-related disclosure rules on hold

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

SEC climate-related disclosure rules on hold

Want to read this article?

Read Next

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

SEC climate-related disclosure rules on hold

Related Articles