Session 8 · ERQI Global Virtual Risk Summit
Talk to the (Learned) Hand: legal risk, quantified
Dave Navetta & Elimu Kajunju
Overview
Privacy and security lawyers Dave Navetta and Elimu Kajunju argue that legal risk advice still runs largely on experience and instinct, even though the law's own test for reasonableness is a cost-benefit formula. They walked through how counsel advises on breaches, ransomware and tracking litigation today. Navetta then showed litigation and enforcement data built to give that advice firmer numbers.
Session 8 recording, ERQI Global Virtual Risk Summit 2026
The formula behind reasonableness
Navetta opened with Judge Learned Hand's negligence formula: a duty to take precautions arises when the burden (B) is less than the probability of loss times the loss (P x L). He described it as embedded in the law's idea of reasonableness, from slip-and-falls to securing systems, even when nobody states the math. Kajunju said probability is usually the hard term, and without it the burden question is difficult to answer. Navetta added that legal losses are also poorly documented because the data has not been brought together.
Advice on partial evidence
Both lawyers described breach advice as judgment under uncertainty. Navetta recounted a nation-state breach involving 44 terabytes that the client could neither prove nor disprove had left. Notifying risks a public relations problem, while staying silent risks a worse downside if the data surfaces months later. On ransomware, he said executives who vow never to pay often change course once they learn they lack backups and face months of downtime, in one case at $5 million a day. Kajunju noted that time cuts both ways: more investigation can clarify exposure, but delay without new information burns goodwill.
Tracking technology showed the multi-stakeholder problem. Navetta cited about 4,000 wiretap-style class actions over website trackers, with $5,000 in statutory damages per violation and no need to prove harm. Many companies pay a small demand instead of facing theoretical exposure in the hundreds of millions. In one case an insurer's marketing team projected $30 to 40 million a year in losses from a consent banner, and counsel was asked to estimate litigation exposure against that. Navetta said "this is not yet a scientific formula." Kajunju observed that once every California company is in the same position, claims of lost revenue get harder to sustain.
Enterprise risk and the case for data
At the enterprise level, Kajunju described advising on anti-kickback risk in a healthcare product as a business partner, not a veto, and said "reasonable security" is benchmarked to peers. Navetta recounted a defense contractor whose CISO won the argument to segregate controlled unclassified information. After a later nation-state intrusion, that data had not been reached. He then showed a database of about 16,000 data security, privacy and AI cases from 2015 to 2026, with medians of about $2.06 million for cases alleging Social Security numbers or government IDs and $427,000 for medical information. He also previewed the Privacy Enforcement Pressure Index (PEPI), a beta 1-to-100 measure tracking public sentiment and regulator maturity, which he described as correlative, not predictive.
“This is not yet a scientific formula.”
Dave Navetta, on estimating litigation exposure from website trackers
Key takeaways
1
Reasonableness already has a formula
The Learned Hand test weighs the burden of a precaution against probability times loss. Lawyers apply it daily, mostly without the inputs.
Watch at 5:562
Delay and silence carry their own risk
Not notifying, or refusing to pay, can produce a worse outcome later, and the trade-off rarely has firm numbers behind it.
Watch at 16:063
Legal risk is one stakeholder's view
Decisions such as consent banners trade litigation exposure against revenue, so the business has to weigh both numbers.
Watch at 23:004
Worst cases do not persuade
Navetta said it is "very easy to discount the sky is falling," and that management wants the actual chances.
Watch at 35:105
Litigation data can narrow the range
Settlement medians by allegation type, class size and plaintiff firm give exposure estimates something to stand on.
Watch at 46:28
