hollywoodAs I noted in my recent rundown of the top D&O stories of 2014, one of the most important developments during the year just finished was the emergence of cyber security as a D&O liability concern. During 2014, plaintiff shareholders launched cyber breach-related derivative lawsuits against the boards of Target and Wyndham (about which refer here and here, respectively).But arguably the highest profile cyber breach during the year was the hack attack on Sony Pictures Entertainment apparently related to the company’s release of the controversial movie “The Interview.” Though at least six class action lawsuits have been filed on behalf of present and former Sony employees, so far there have been no shareholder lawsuits filed.


According to a detailed and interesting analysis published  in an unlikely source, a lawsuit against Sony would be an “an uphill battle” – which of course does not mean that no one will give it a shot, but does mean that any shareholder that wants to try will face a “very difficult exercise.”


Here at The D&O Diary, we don’t ordinarily devote much time to reading articles published in the Hollywood Reporter, but then we found Jonathan Handel’s December 23, 2014 article in that publication entitled “Sony Hack: Will Shareholders Sue?” (here) to be particularly interesting. In summary, Handel concludes that it would be very difficult for a plaintiff to pursue a shareholder lawsuit against Sony Pictures Entertainment or its senior officials. The reasons why it would be so difficult fall into two general categories – the difficulties any claimant would faces pursuing derivative suits, and difficulties a shareholder claimant would face that are particular to Sony.


First, a little bit of background. Sony Pictures Entertainment (SPE) is a wholly owned subsidiary of Sony Corp. SPE is a Delaware corporation with its principal place of business in California. Sony Corp. is a Japanese corporation whose shares trade in Tokyo and that also has American Depositary Receipts trading in the U.S.


Though Sony has ADRs trading on a U.S. exchange, it is unlikely that prospective claimants would seek to file a securities class action lawsuit against the company relating to the hack attack, because, Handel notes, the parent company’s share price “hasn’t moved decisively” as a result of the news surrounding the attack — which means that if shareholder claimants were to try to bring a lawsuit, they would likely have to proceed by way of a shareholder derivative lawsuit.


Handel speculates that a prospective derivative lawsuit claimant might want to try to allege what Handel describes as a series of “egregious misjudgments, such as allegedly lax cybersecurity and what plaintiff’s attorneys would no doubt call a reckless – or at least grossly negligent – decision to proceed with The Interview despite North Korean threats earlier this year. A third decision – to pull the movie, at least from major chains – could also come under fire.”


A shareholder attempting to bring a derivative lawsuit would of course face all of the hurdles that any derivative plaintiff would face. The prospective plaintiff would first have to make a demand on the company’s board demanding that the board itself launch the lawsuit, or plead in his or her complaint that demand would have been futile. If demand is made and refused, the plaintiff would have to plead that the demand was wrongfully refused.


The Sony defendants would also have all of the defenses that other defendants have in these types of cases. First, the defendants can rely on any exculpatory provisions the company may have in its bylaws or other charter documents. Second, the defendants would be able to rely on the business judgment rule to argue that the shareholders and the courts should not absent extraordinary circumstances second guess the board’s business decisions.


As if all of these hurdles and defenses were not enough to deter prospective claimants, there are additional considerations owing to the specific circumstances involved here. Because any prospective claimants would own shares (or ADRs) of Sony Corp., the parent company, and not of SPE, the subsidiary, the lawsuit would be filed not against the board of SPE, but would have to be filed against the parent company’s board, in the form of a “double derivative lawsuit.’


As Handel explains in his article, a double derivative lawsuit is “a procedural vehicle to remedy the claimed wrongdoing where the parent company board’s decision not to enforce the subsidiary’s claim is unprotected by the business judgment rule.” In other words, any claimant would have to argue not only that SPE board’s conduct falls outside the protection of the business judgment rule, but also that the parent company’s board’s decision not to sue SPE also falls outside the protections of the rule.


There are still further complications. Because the investors who bought their Sony securities on U.S. exchanges hold ADRs and not shares, their rights and remedies are further defined by the Deposit Agreement that regulates the administration of the ADRs. Many ADR deposit agreements have choice of law clauses specifying the law that would apply in the event of a dispute between an ADR holder and the company or its executives. Although the deposit agreement provisions vary, the likelihood is that Sony’s deposit agreement specifies that Japanese law governs ADR holder disputes.


If Japanese law applies to claims brought by ADR holders, any claimant would face some potentially insurmountable hurdles. First, at least according to sources Handel cites in his article, current Japanese law does not allow double derivative actions. Second, while the Japanese legislature recently adopted revisions to the Companies Act, which governs Japanese corporations, those revisions are not effective until April 1, 2015 and are not retroactive. The new provisions are in any event restrictive, requiring among other things that the claimant hold at least a 1% interest in the company involved.


Despite all of these concerns, it is still possible that a claimant might try to file a lawsuit. But for all of the reasons cited above and discussed further in Handel’s article, any claimant would face a very difficult challenge. As one of the commentators cited in the article put it in characterizing the maze of difficulties a claimant would face, this situation is “like a law school exam.”


The circumstances surrounding cyber security breaches may yet prove to be a source of significant corporate and securities litigation. But the complicated circumstances surrounding the Sony hack attack underscore that pursuing these kinds of claims is never straightforward. And as I noted in connection with the dismissal of the lawsuit filed last year against Wyndham Worldwide, it remains to be seen whether or not erstwhile plaintiffs will figure out a way to overcome all of the procedural hurdles involved and manage to turn these kinds of lawsuit into a successful exercise.


I will say that I never though I would have occasion to link to the Hollywood Reporter here for the publication’s legal analysis, but I have to admit that Handel’s article was interesting and is worth reading in full.