Shook Partner Frank Cruz-Alvarez and Associate Britta Stamps Todd have contributed a column to the Washington Legal Foundation's Legal Pulse exploring the Eleventh Circuit's decision on standing for plaintiffs in a lawsuit stemming from a data breach.
Cruz-Alvarez and Stamps Todd explain that the federal circuits are split on the issue of whether a data breach constitutes a concrete injury sufficient for standing. "Even in the circuits that found standing, almost all of the cases included some allegations of actual misuse or access to personal data," they note. "Importantly here, the named plaintiff did not allege that social security numbers, birth dates, or other personal information was compromised in the data breach. Based on that, the court reasoned, it is unlikely that the information obtained in the cyber attack raises a substantial risk of identity theft. As to future harm, '[e]vidence of a mere data breach does not, standing alone, satisfy the requirements of Article III standing.'”
"The reasoning in Tsao could conceivably be extended to any case where a named plaintiff bases her alleged injury on a risk of future harm or effort to prevent a future harm," Cruz-Alvarez and Stamps Todd conclude. "While the Supreme Court has not teed up any cases on this specific standing point (despite the circuit split), class action practitioners should look forward to the Supreme Court’s decision in Trans Union LLC v. Ramirez later this term for a potential blockbuster opinion on class action standing." The authors previewed the Trans Union case in an earlier column for the Washington Legal Foundation.
Additional discussion of the case can be found in an issue of Shook's Privacy and Data Security Client Alert.