• by Wendy Davis  @wendyndavis, August 5, 2021

Google plans to ask the Supreme Court to scrap a lawsuit by investors who claim the company waited too long to disclose a data breach that affected Google+ users.

The company revealed its plans in papers filed recently with the 9th Circuit Court of Appeals, which ruled in June that a group of investors led by the treasurer of Rhode Island (who sued on behalf of the state's pension system) could move forward with claims that Google violated securities laws by failing to reveal the data breach in regulatory filings.

That ruling “threatens to usher in endless and sprawling securities litigation based on a wide-ranging affirmative duty to disclose,” Google says in a motion filed last week with the 9th Circuit. The company is asking the 9th Circuit to postpone sending the case back to the trial court until at least the end of October.

The battle stems from Google's delay in disclosing software vulnerabilities -- including a bug allowed hundreds of outside developers to access private information about Google+ users, including their birth dates, photos, occupations, and addresses. (Google shut down Google+ in 2019.)

Google allegedly learned of the security glitch in March of 2018, and fixed it by April. But the company didn't publicly disclose it until October of 2018, when The Wall Street Journal reported on the bug.

Google reportedly delayed disclosing information about the glitch due to fears of regulatory scrutiny and bad publicity. 

The investors alleged that Google violated securities laws by failing to reveal the data breach in the company's April or July 2018 filings with the Securities and Exchange Commission.

U.S. District Court Judge Jeffrey White in San Francisco dismissed the investors' lawsuit last year. He ruled that even if the allegations in the investors' complaint were true, they wouldn't show that Google had made any false or misleading statements in its regulatory submissions.

His decision noted that Google had already remedied the software bug before its April filing.

A three-judge panel of the 9th Circuit reversed White's decision. Those judges said the investors' complaint raised the inference that the company made a decision to deliberately conceal the cybersecurity bug.

“The competing inference that Alphabet knew of this information but was merely negligent in not disclosing it is not plausible,” Circuit Judge Sandra Ikuta wrote in an opinion joined by Judges Sidney Thomas and Jacqueline Nguyen.

Google now says that ruling conflicts with Supreme Court decisions, and also “has dramatic practical implications” for all publicly traded companies.

“The panel’s decision would encourage management to disclose any and all 'problems' -- regardless of whether they are remediated or material,” Google writes.

The result of that ruling, according to Google, is that shareholders would be swamped with “an avalanche of trivial information.”