By Kyle Ffrench
Article III, §2 of the U.S. Constitution limits the jurisdiction of the federal courts to cases and controversies. One element of the cases and controversies requirement is that a plaintiff has standing to sue ensuring plaintiffs bringing a case before the court have an actual stake in the litigation and are not wasting the valuable time and resources of the court. To establish standing, a plaintiff bears the burden of establishing at minimum three requirements set forth by the Supreme Court: (1) an injury-in-fact that is concrete and particularized; (2) causation that is fairly traceable to the defendant; and (3) that a favorable outcome for the plaintiff will remedy the injury. The injury-in-fact requirement has been further clarified as an invasion of a legally protected interest that is concrete and particularized and is actual or imminent not merely speculative.
This has been the main contention in class action data breach cases in recent years. The Supreme Court held that plaintiffs in Clapper v. Amnesty Int’l, 568 U.S. 398 (2013), lacked standing to sue based on the theory of future potential injury which the Court found too speculative to satisfy the established requirement that the threatened injury be certainly impending. In Clapper, a broad class of plaintiffs brought a facial challenge to a provision of the Federal Intelligence Surveillance Act (FISA) arguing the provision violated their constitutional rights and that their communications with non-U.S. citizens would be impermissibly recorded under FISA.
Recently, the Ninth Circuit considered a case stemming from a breach of Zappos.com’s servers in which hackers stole personal identifying information of more than 24 million customers including names, account numbers, passwords, email addresses, billing and shipping addresses, telephone numbers and credit and debit card information. The district court distinguished between the two sets of plaintiffs dismissing those who did not allege actual financial losses stemming from identify theft and allowing those who did to proceed. The Ninth Circuit reversed the district court’s decision on the first set of plaintiffs despite no showing of actual harm from the breach finding that the plaintiffs sufficiently alleged injury-in-fact based on an increased risk that the hackers would commit identity fraud.
In reaching their decision the Ninth Circuit relied on one of its earlier decisions in which they held plaintiffs had standing where a laptop containing employee’s social security numbers and other personal information was stolen despite there being no indication the stolen data had been misused. In a similar case involving the theft or misplacement of a laptop containing sensitive information of roughly 7,400 patients, the Fourth Circuit declined to extend standing to the victims of the data breach on the basis that the plaintiffs failed to show that identity theft was imminent.
In its recent decision, the Ninth Circuit distinguished Clapper by noting it required a speculative chain of inferences, unlike the data breach which necessarily imposed a substantial risk of identity theft. Perhaps one of the more distinguishing aspects of the case is the existence of the second group of plaintiffs that alleged actual financial loss due to the breach of data making the substantial risk of identity theft more compelling as an imminent threat. Unlike in Clapper, where plaintiffs asserted the potential for their communications with a non-U.S. person to be intercepted, the possibility was too attenuated to establish a concrete and particularized issue. Other circuits such as the Fourth Circuit have held that an increased risk of future identity theft created by a breach of data too speculative to satisfy the requirements of an injury-in-fact. With more and more sensitive data being held on online servers it is left to be seen whether more courts will follow in granting plaintiffs standing in breach of data cases, though standing is just the beginning.
Student Bio: Kyle French is currently a 2L student at Suffolk University Law School. She holds a Bachelor of Arts in International Relations and Global Studies with a minor in Latin American Studies from the University of Texas at Austin.
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHTL or Suffolk University Law School.
