YOUR LEGAL LIABILITY IN A DATA PROCESSING DISASTER

Have you ever wondered how a corporate disaster might affect you personally? If the corporation survived despite major losses would you be affected in any way? And if the corporation went bankrupt, what might happen to you?

Beyond the problem of whether you would have a job or not, there is the concern of being sued by stockholders or criminally prosecuted if your corporation experiences a disaster. This article explains who should worry and why and what steps you can take to minimize the personal risk of a corporate disaster.

Who is at risk?
... It is likely that the vice president or manager of MIS can be held personally liable for the loss if there are actions he should have taken to avoid the loss, but did not.

Reasons for Liability
... If these responsible persons breach the duty of trust, they may be liable to the shareholders of the corporation. The standards used to judge faithful performance were developed over a long time. Numerous court cases in which disgruntled shareholders sued officers, directors and agents for alleged wrongdoing developed into the standard called the "Prudent Man Rule." It requires officers, directors and agents to discharge their duties with the diligence and care that ordinary, prudent men would exercise under simiilar circumstances... How is this duty of care related to the issue of disaster recovery planning? Where the risk of loss of assets is significant and the impact of the risk of loss is large, it would seem axiomatic that prudent men would take steps to protect the corporation and its assets.

You should analyze conduct for adequacy of performance from the point of view of a jury. A court could easily say that a failure to insure corporate assets essential to corporate survival (such as a data center) would be conduct that falls short of the proper exercise of the minimal standard of care. And, where directors, officers and managers neglect their duty and the proximate result is a loss to the corporation, they are liable for it.

...An equally important objective of the law was management accountability. Section 102 requires managemnt to provide shareholders with reasonable assuances that accurate books and records are properly maintained and that the business is adequately controlled.

It is the requirement to maintain and safeguard corporate records that makes disaster recovery planning important to compliance, since most of the required corporate records are stored electronically. Violations of the Foreign Corrupt Practices Act can lead to both civil and criminal fines and to the possibilty of imprisonment.

... A person lives up to the duty of good faith by doing things that he knows to be right. Knowingly doing the wrong thing is an act of disloyalty and a violation of the duty of good faith. If you know there is a real and preventable risk to your corporation and you do nothign to prevent the risk, then your disregard for the proper course of conduct would probably be construed as acting in bad faith.

Consider the following scenario. Assume a data processing disaster forces a company into bankruptcy because no contingency planning had been done. Assume further that an angy shareholder files suit against everyone responsible including directors, officers, and the MIS director for allowing the corporation in which he invested to go bankrupt.

The following argument might well be persuasive to a jury:
"Ladies and gentlemen of the jury, I submit that the reckless action of all of these people in failing to insure corporate assets and failing to develop a disaster recovery plan involves conscious disregard for a known but preventable risk. Thus, I submit that their approach to preservation of the corporate assets was an approach not taken in good faith, and thus their personal liablility would not be a liability subject to the limitations under the new corporate statutes nor should it be subject to indemnification under the traditional indemnity arguments. I ask personal judgements against all of them in the amount of the loss."

What To Do?
You can avoid the legal problems described above by acting like a reasonable and prudent man and by exercising due care for your corporation. In other words, develop a disaster recovery plan.