Recently, the Supreme Court denied a petition for writ of certiorari to resolve the circuit split on standing in data breach class-action lawsuits[1]. This highly contested issue – whether a data breach or unauthorized disclosure, alone, constitutes an injury sufficient to establish standing – is one in need of attention and review.
Additionally, this is the second time the Supreme Court has declined to revisit this issue[2]. For many companies, this decision is disheartening because Supreme Court review could provide guidance and clarification to limit their liability in data breach cases. For plaintiffs who have established standing based on allegations that their information was stored in a breached database, although absent claims that their information was misused, this is a welcomed response. The crux of this ongoing debate is whether a breach of someone’s data – without evidence of a later misuse of that data – satisfies the injury element needed to confer standing.
Remember Spokeo[3]? There, the Supreme Court opined that “standing requires a concrete injury even in the context of a statutory violation.” Since that decision, courts have been split on whether data breaches or unauthorized disclosures alone constitute an injury sufficient to establish one of the prongs of standing. Currently, the Third, Sixth, Seventh, Ninth, and the D.C. Circuits have found that a mere data breach may be a sufficient injury to establish standing. The First, Second, Fourth, and Eighth Circuits on the other hand have found that future harm as a result of a data breach is too speculative to meet standing requirements.
For the foreseeable future it may be unlikely to see the Supreme Court clarify standing in the context of data breach cases, although pressure appears to be mounting. Until then, it may be best to consider the laws of the circuit where claims are filed and how those circuits view standing to sue.
[1] Zappos.com, Inc. v. Stevens, 203 L.Ed.2d 609 (U.S. 2019)
[2] Frank v. Gaos, 139 S. Ct. 1041 (2019)
[3] Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016)
This information has been prepared by Validity Screening Solutions for informational purposes only and is not legal advice. The content is intended for general information purposes only, and you are urged to consult a lawyer concerning your own situation and any specific legal questions you may have.
