What the Hack?! Reexamining the Duty of Oversight in an Age of Data Breaches

Due to the proliferation of electronic data andadvancements in technology, data breaches have becomecommonplace. Data breaches are a threat tocorporations of all sizes and can have devastatingimpacts. Focusing solely on Delaware law, this Noteexplores how doctrines such as the business judgmentrule, exculpation provisions, and heightened pleadingstandards have left shareholders with limited recoursein holding directors liable for the catastrophicconsequences of data breaches. Recognizing thatshareholders have been unsuccessful allegingCaremark-type claims arising out of a data breach, thisNote argues that the expansion of bad faith in WaltDisney provides alternative ground for shareholders tohold directors liable for data breaches. Nevertheless, thisNote concedes that courts will be unlikely to accept thatargument. Courts are too wary of opening the floodgatesof director liability. Therefore, this Note argues thatthere are certain risks—such as cybersecurity risks—towhich Caremark can be extended without evisceratingthe business judgment rule. This Note finally arguesthat where Caremark applies, the standard should berelaxed in the context of cybersecurity. In an age of databreaches, the time has come for the Caremark standardto have some teeth