How to claim responsibility for data loss caused by negligence to create a backup
Hi,
This is a question regarding how to start a lawsuit regarding data loss when a company fails to exercise reasonable care in protecting the information, and what amount can be claimed. Interested in acting asap.
I am running a research group of 10 people at a university. When IT performed installation of my new laptop that included data transfer from the previous machine, all the data has been lost (~200 GB).
Most of the lost data is unrecoverable. Therefore critical research records, presentations, grant applications and analysis disappeared. Since scientific work and research group management depends on these records it has been impeded.
The host failed to back up data in an outside location, which is a normal procedure in research institutes that would guarantee the data recovery.
The data that was partially recovered will take a lot of time to restore because file names are not recovered and its not trivial to allocate the information to the right sources. Therefore grant applications that were in preparation will have to be cancelled, particularly a proposal for 7 MSEK to the Swedish Foundation for Strategic Research that was supposed to provide 5-year research funding for the research group.
A significant harm is also caused due to the fact that data loss pauses central research activities, interactions with collaborators and teaching commitments that will result in affecting productivity in the immediate term and reputation damage in the long term.
Thank you
Lawline svarar
The Parties
As you are the legal owner of the lost data, you are the sole person who may claim responsibility in court. While the IT workers caused the damages, their employer is the party that may be held responsible for any damages that its workers cause during work hours.
Property Damage (Data Loss)
The IT department and the workers are organized and employed by a university. There is no contract between you and the IT-department in regard to the service that was performed on your request.
In order to claim accountability in connection to a faulty executed service, contractual or indemnity liability must be established. Indemnity liability can be claimed without there existing a contract and requires
1. damage,
2. negligence or intent,
3. adequate causal link between 1 and 2.
In this case, the data loss must be shown to be a direct result of the IT workers' negligence or intent, i.e. the damages should not have been caused if the IT workers have acted differently (properly). I assume there was no intent to cause data loss. The IT workers have been negligent if they did not exercise reasonable care. They should probably have predicted that data loss could be a result of not taking proper security measures before initiating the transfer. Therefore, data loss was a predictable consequence that should have been addressed.
"The host failed to back up data in an outside location, which is a normal procedure in research institutes that would guarantee the data recovery." Personally, I doubt that IT workers would operate otherwise. It is therefore our opinion that the IT workers have acted negligent.
What Amount Can Be Claimed
If the IT workers can be held responsible for the damages, you are entitled to the property value or the repair/recreation costs. As you cannot put a value on every piece of lost data, you cannot successfully put a price tag on it. For example, it's hard to successfully claim that the grant applications are worth MSEK 7 as a condition is that the applications will be granted. Before they are granted, they have no value in terms of money. In order to put a value on the lost data, it would have involve data that had an actual monetary value such as software. Consequently, reputation damage wont be regarded as a relevant damage.
However, you can claim estimated acquisition and recreation costs for all the non-monetary lost data. Time is one factor in this calculation. Expenses for having people working for you to recreate all the lost data are claimable. This applies to all your losses: grant applications, research documents, possible, data breach etc. As it is difficult to estimate such future costs, the court may estimate a reasonable amount if you cannot provide enough proof within what is possible. Without a contract, your legal basis is limited to these claims.
How to proceed
I recommend you hiring legal counsel to initiate negotiations with the university. There may be a way to resolve this matter without involving the courts. If you decide to submit a lawsuit, it must be submitted in Swedish and to the district court in Stockholm (Sw: Stockholms tingsrätt). Please do not hesitate to contact me if you'd like our help to negotiate with the university or to represent you in court in this matter.
Soroosh Parsa / soroosh.parsa@lawline.se
