The court threw out the case, saying it was unclear whether any of the personal data had actually been accessed by the criminals who stole the disks.

The cases show the need for an updating of existing liability laws, Preston said. "We don't quite have the laws yet that make people liable for security as a matter of statutory law," he said.