Negligent Entrustment Liability for Outsourced Data

Abstract

American financial services companies, health care facilities, and software producers are increasingly outsourcing data handling to low wage nations. Companies electronically transmit the personally identifiable information of millions of Americans to back office operations (BPOs) located in countries such as India, China, the Philippines, and Russia. Companies can easily delegate non-core operations to an offshore data hub, but it is unlikely that these firms will be permitted to outsource their legal responsibility for reasonable data security. American companies are vulnerable to being held jointly and severally liable for transmitting data to insecure back office operations under a theory of negligent entrustment. This article explores the potential liability of data handlers for negligent entrustment of outsourced data.

Keywords: tort liability, negligence, damages, international business transactions, information security, negligent entrustment