A Cook County judge could soon weigh in on the question of whether the city of Chicago and Cook County have the power and the right under state law to sue Uber over a 2016 data breach.
In recent weeks, ride hailing company Uber Inc. and attorneys for the city and county have exchanged legal briefs in court over the question.
First, in February, Uber asked the court to dismiss the regulatory lawsuit the city and county filed against it late last year, asserting Chicago city attorneys, Cook County prosecutors and the private trial lawyers the city and county deputized to litigate the case on their behalf, have overstepped their legal bounds in bringing the lawsuit at all.
And on March 16, those attorneys for the city and county responded in court with a memorandum asserting Uber is the one misapplying state law, a Chicago city ordinance and decisions from Illinois courts grappling with the questions.
The court’s decision in the case could also have some bearing on a similar consumer fraud lawsuit brought this week by the same private trial lawyers, from the firm of Edelson P.C., against Facebook over the way the social media giant handled access to user data obtained by a firm linked to the 2016 campaign of President Donald Trump.
In late November 2017, Chicago city attorneys and the Cook County State’s Attorney’s office filed suit against Uber. The lawsuit was filed with attorney Jay Edelson, principal of the Edelson P.C. firm, who was designated a special city corporation counsel and special assistant state’s attorney in this case.
The lawsuit was filed in Cook County Circuit Court purportedly on behalf of all residents of Chicago and Illinois whose personal information may have been compromised in a hack suffered by Uber in October 2016. In all, published reports estimated hackers obtained names, email addresses and phone numbers of 50 million Uber passengers around the world, as well as personal information of 7 million Uber drivers.
The lawsuit specifically faults Uber for allowing hackers to access that data on its servers using almost exactly the same tactic that allowed them to obtain Uber users’ data two years earlier, demonstrating Uber allegedly had not reinforced its safety measures to protect the data or had not enforced its user data protection protocols properly. I
Further, the complaint pointed to information indicating Uber had attempted to hide evidence of the hack from the public eye, allegedly paying $100,000 to the hackers to delete the allegedly purloined user data and not discuss the data breach further.
The joint Chicago-Cook County lawsuit accuses Uber of violating state consumer fraud laws and a Chicago ordinance which purportedly require companies to notify the city and users of such data breaches involving Chicago residents. The lawsuit asks the court to order Uber to pay fines of $10,000 per violation per day under the city ordinance, and up to $50,000 per violation under the state law.
However, in February, Uber asked the court to toss the lawsuits, saying the city and county lack the authority under state law to essentially legally pile on, when the Illinois Attorney General’s office has announced it has opened its own investigation into the data breach and has not yet indicated whether it may pursue legal action of its own under the state fraud laws cited by Edelson and the city and county attorneys.
Uber noted the state laws cited in the county-city lawsuit empower only the Attorney General and county state’s attorneys to bring such legal actions.
Since the attorney general is purportedly investigating the breach and has “exercised her authority” as the state’s chief legal officer, Uber asserts the Cook County State’s Attorney, and other state’s attorneys in any of Illinois’ other 101 counties, “is precluded from simultaneously pursuing claims against Uber on the same allegations.”
Uber also asserts the city of Chicago should not be allowed to continue with its action under its ordinance because the ordinance represents “an end-run around its lack of authority to bring … claims where these underlying statutes do not grant such authority.”
“To allow the City to do otherwise would contravene the will and intent of the State Legislature,” Uber asserts in its motion to dismiss.
Uber is represented in the action by attorneys Christopher B. Wilson and Eric D. Brandfonbrener, of the firm of Perkins Coie LLP, of Chicago.
However, on March 16, Edelson, Chicago city attorney Edward Siskel and Cook County State’s Attorney Kimberly Foxx said Uber’s reading of the state law and legal precedent interpreting the laws is “tortured.”
The city-county legal team noted the law does not solely empower the attorney general to sue in cases like this, and the law was specifically amended by lawmakers to add state’s attorneys to those authorized to bring such legal actions.
“Although the AG is undoubtedly the chief legal officer of the State, the power of the Attorney General to act on behalf of the People may be exercised concurrently with the power of the State’s Attorney to initiate and prosecute all actions, suits, indictments and prosecutions in her county as conferred by statute,” the city-county lawyers argue in their brief.
“… Although the (law) does grant certain exclusive powers to the AG, the ability to initiate and prosecute actions clearly is not one of them,” they said.
Further, they asserted the city of Chicago has authority under the Illinois constitution to enact ordinances, such as the one at issue in this case, for which it does not need special permission under state law to enforce through lawsuit.
They noted the courts have specifically allowed the city for violations of its ordinances, pointing to the city’s lawsuit against pharmaceutical companies over their distribution and marketing of so-called opioid painkiller drugs.
“… Courts have consistently allowed the City’s enforcement actions under the Ordinance (and others like it) to proceed without issue,” the city-county attorneys wrote.
And they also disputed Uber’s assertions the city ordinance conflicts with the state fraud laws, saying the ordinance “operates concurrently and in harmony with those statutes,” looking to those laws “for guidance in its own interpretation” of “unfair, fraudulent or deceptive business conduct within the City.”
Cook County court records do not indicate Uber has responded to the city and county’s response to its motion to dismiss, nor has Cook County Circuit Judge Kathleen M. Pantle publicly indicated when she might rule on the dismissal request.
Separately, Foxx has also hired Edelson to bring a lawsuit, which was filed on March 23, against Facebook and data firm Cambridge Analytica over the use of Facebook data obtained ostensibly to aid the Trump 2016 campaign.
That case also levels allegations under the state’s consumer fraud statute, asserting Facebook and Cambridge Analytica deceived Illinois customers into granting access to their data, along with tens of millions of others across the U.S., allowing the Trump campaign to specifically use the Facebook platform to target voters with their campaign message to boost Trump and to denigrate Democratic nominee Hillary Clinton.
Illinois Attorney General Lisa Madigan has indicated her office is also investigating those same claims.
Facebook and Cambridge Analytica have not yet responded in court to that lawsuit.