Plaintiffs and regulatory bodies can and have sought claims against a company’s directors and officers for their roles in failing to implement adequate data security mechanisms.
It’s chairwoman was quoted “It is not only appropriate, but critical, that the FTC has the ability to take action on behalf of consumers when companies fail to take reasonable steps to secure sensitive consumer information.”