T.J. Hooper (short for In re Eastern Transportation Co. (The T.J. Hooper), 60 F.2d 737 (2d Cir. 1932)), is a legal ruling that may have interesting implications in future legal battles that result from data breaches. In this case, Judge Learned Hand established the precedent that prevailing practice is not a valid way to avoid liability.
When two barges sank and their cargoes were lost in heavy weather, the owners of the lost barges and their cargoes claimed that their loss was caused by negligence on the part of operator of the tugboats. Their claim was that if radios that could receive weather reports had been installed on the tugboats then their losses would have been avoided when the tugboat operators were warned of the heavy weather. Because the tugboats did not have radios installed, this meant that the owner of the tugboats was negligent for not using them.
The owner of the tugboats claimed that they couldn’t be expected to have radios installed because they were new technology and their use was not common. In the T.J. Hooper case, the operator of the tugboats was found negligent. This set the general precedent that the fact that technology is new and its use is uncommon does not mean that not using it is a way to avoid liability.
Today, data breaches are very common, yet the use of encryption is not very widespread. There may be good reasons for not wanting to encrypt information. Encryption has historically been difficult and expensive. This isn’t the case any more, but when it was, it was a valid reason not to use encryption. Now that encryption is easy enough to use, however, the precedent of T.J. Hooper becomes relevant. Prevailing practice is not a valid way to avoid liability, and just because many other organizations aren’t protecting their information with encryption doesn’t mean that you shouldn’t do it yourself. You can still be found negligent if that’s the case. Not using encryption because there’s no valid business case for it makes sense; not using it just because other people don’t use it doesn’t.