The State of Standing in Data Breach Litigation

In a world full of electronic information (not to mention hackers and identity thieves), data breaches—the loss, theft, or unauthorized access to data—are a reality for companies that collect and store personal information. Breaches can occur in myriad ways: a hacker gains access to a database or an unencrypted laptop is stolen, to name but two prevalent examples. Almost as regular as night follows day, class action lawsuits follow data breaches—and as the volume of data breaches increases, so too does the volume of litigation.

Yet federal standing and pleading requirements have thus far posed significant hurdles for plaintiffs. As the U.S. Supreme Court recently reiterated, “[n]o principle is more fundamental to the judiciary’s proper role in our system of government than the constitutional limitation of federal-court jurisdiction to actual cases or controversies.” Clapper v. Amnesty Int’l USA (2013).

The first element of constitutional standing is injury-in-fact, but the nature of “harm” in data collection and data breach cases is far from clear. Therein lies the rub. Courts are faced with questions such as whether the loss of personal information alone is an injury cognizable by law, whether an increased risk of identity theft is sufficient injury, and whether unauthorized access to personal information alone causes real harm. So far, most federal courts have answered “no,” and require some more tangible injury before a data breach lawsuit can continue.

Additionally, and crucially, constitutional standing requires the injury to be “fairly traceable” to the defendant. Standing is not satisfied absent a well-pleaded showing of causation and redressability—prongs of the standing inquiry that defendants, and courts, too often give only short shrift.

Article III Standing and Federal Pleading Standards

To have standing to pursue a lawsuit in federal court, the Supreme Court has established three requirements:

1. A concrete injury-in-fact.
2. A causal relationship between the conduct complained of and that injury.
3. A likelihood that a favorable ruling will provide the relief sought.