All aboard the privacy-breach gravy train

The hacking of a Sony customer database this spring has attracted class-action lawyers and consumers eager to cash in on the high-profile privacy breach.

At least 40 lawsuits have been filed in federal courts -- including at least two this week -- on behalf of millions of Sony PlayStation users. The suits accuse Sony of failing to protect gamers' personal data and credit card information from hackers. The pattern is a common one: Details of a privacy breach become public, which triggers a wave of suits, which lead to oft-costly settlements as companies try to hold onto the trust of their customers.

Who benefits the most from the suits? Not the plaintiffs. In privacy cases, it is both difficult to prove economic damage and to divvy up a settlement among classes that can number in the millions or even tens of millions. While a handful of lead plaintiffs might receive a nominal fee, the parties can also agree to distribute any settlement payout to nonprofit organizations that promote the privacy interests of the class. The lawyers, in contrast, walk away with a chunk of change that can range from tens of thousands to millions of dollars. Critics say these settlements deprive the victims of any meaningful benefit and invite conflicts of interest by allowing defendants and plaintiffs' lawyers to choose their pet organizations.