Avoiding the Siren Call of the Clock in “Unreasonable Delay” Data Breach Notification Cases

Authors

Evan Yahng, Private Attorney

Abstract

As online personally identifiable information, data breaches, blockchain, Artificial Intelligence, and other trends in the cyber ecosystem proliferate, courts must confront legal questions about data privacy that past courts have kicked down the road. One such question that courts and scholars have yet to properly interrogate is what constitutes “unreasonable delay” in violation of state data breach notification statutes.

All fifty states, the District of Columbia, Puerto Rico, the Virgin Islands, and Guam have laws requiring companies that hold data to provide notice to data subjects in the event such data is compromised. But courts have been able to punt the question of delay until now because data breach litigation often dies early, either because the statute does not provide a cause of action, or because the harm is too speculative to support a cause of action in negligence. With courts recognizing more statutory causes of action and more harms in negligence, the time to answer the question has come. Indeed, a massive number of courts addressed unreasonably delayed data breach notice claims in 2024.

A substantial number of those courts made a grave error when they denied motions to dismiss solely because precedent in their jurisdictions held that a given number of days was prima facie unreasonable. This Article argues that this approach misunderstands the purpose of data breach notification laws and leads to undesirable results including costly liability for companies and risks to individual consumers’ identities. After sampling some of these 2024 cases, this Article explains myriad problems associated with relying on the clock as the sole indicator of reasonableness. Finally, this Article suggests that courts follow a more practical and doctrinally desirable approach whereby they examine defendants’ post-breach investigation to determine whether any delay was unreasonable.

Recommended Citation

Evan Yahng, Avoiding the Siren Call of the Clock in “Unreasonable Delay” Data Breach Notification Cases, 28 Chap. L. Rev. 399 (2025).
Available at: https://digitalcommons.chapman.edu/chapman-law-review/vol28/iss2/4