Shostack + Friends Blog Archive


More On Cardsystems Lawsuit

Joris Evers continues to report well on the Cardsystems lawsuit, this time in “Judge looks for links in credit card case:”

Kramer said he wants to be clear on which defendants fall under California civil code section 1798.82, the notification statute. While it is clear that the breach was at CardSystems, the law applies to entities that “own or license” personal information about Californians. Plaintiffs in the case say that includes Visa, MasterCard and Merrick.

“I believe we have to figure out whether indeed Visa, MasterCard and Merrick are covered by the statute. They don’t seem to own the data, but the plaintiffs’ view is that they are operating with a license,” Kramer said. He ordered all parties to prepare for a trial on that matter and to exchange information.

That makes it much clearer why this is not cut and dried. I previously mentioned the suit in “Cardsystems Breach and Notice.”