DIRECTOR LIABILITY: Boards are on the hot seat over data breaches, illegal sales practices and more.

Author:Milford, Maureen
Position:ON THE TABLE FOR 2018

Directors and officers might want to start 2018 by doubling down on their oversight systems.

Last year, boards and senior managers at several large corporations faced significant shareholder lawsuits over allegations they were not minding the store when their companies suffered high-profile traumas surrounding data breaches, sexual harassment and discrimination scandals or improper sales practices.

"What I've seen in these cases is there were a lot of red flags out there and the board just ignored them," says Jorge Amador, an attorney representing shareholders in a case against Wells Fargo & Co. over phony customer accounts.

In addition to Wells Fargo, directors and top leaders at Home Depot Inc. and Twenty-First Century Fox Inc. found themselves on the hot seat after investors filed derivative cases seeking to hold them personally liable for losses stemming from the crises.

In a derivative lawsuit, shareholders sue a third party on behalf of the company for harm done to the enterprise. Proceeds from a winning case go to the company, not the plaintiffs. In the recent cases against Wells Fargo, Home Depot and Twenty-First Century Fox, shareholders allege the damages resulted from a failure by directors and managers to uphold their fiduciary duties of due care, loyalty and good faith.

For boards, these lawsuits serve as cautionary tales highlighting the obligation to assure there are adequate corporate information and reporting systems to help avoid shocks to the company. Failure at such proper oversight could result in board members and officers being forced to make the company whole, Delaware Court of Chancery ruled in the 1996 landmark Caremark International Inc. derivative case, which alleged that directors did not put in place adequate internal control measures that opened the door to employee criminal activity. All three companies are incorporated in Delaware.

In Caremark, the court ruled that a director's obligation includes a good faith duty to make certain that there are sufficient information and reporting systems so that "appropriate information will come to its attention in a timely manner as a matter of ordinary operations." Directors could, in theory, be held liable for losses if they failed at this obligation, the ruling says.

"Directors and officers must be cognizant of issues, ask questions and reach a level of satisfaction with the quality of information that they are obtaining," says Melissa Krasnow, a privacy partner at...

To continue reading