This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

The most common questions and key elements of a negligence claim are whether the defendant breached a duty of care, whether there is any injury as a result of the defendant's breach of any purported duty of care, and whether the defendant's alleged breach caused the plaintiff any damages. While these essential questions and elements apply with equal force in data breach litigation involving as few as two parties and as many as thousands in the form of class action litigation, the difficult question to answer in these cases is "what is the value, if any, of your injury or damages?"

These questions have flooded the courts in the context of data breach class action litigation, resulting in contradicting decisions among the state and federal courts across the country as to whether a prospect of future identity theft or financial harm is sufficient to confer standing and allow a plaintiff, whether individually or on behalf of a putative class, to bring suit against a defendant who might have been the victim of a data breach, or whether it is sufficient to allege legally cognizable damages to sustain a claim for negligence or another common law or statutory claim.