Data breaches typically involve lots of people, making them prime targets for class actions. Most cases have not gotten to the class certification stage because they have been dismissed on standing grounds, and when they have reached the class phase, certification has been denied because of the predominance of individualized issues. Two recent Supreme Court decisions, Clapper v. Amnesty International USA, in which the court held that actions based on speculative injury cannot proceed due to lack of standing, and Comcast Corp. v. Behrend, an antitrust case in which the court held that when damages are individualized, a class cannot be certified, reinforce these trends. While neither case involves a data breach, both have significant ramifications in the data breach context.

Many cases have been dismissed on standing grounds, such as Hammond v. The Bank of New York Mellon and Randolph v. ING Life Insurance and Annuity Company. A number of circuit courts have recognized standing, but nevertheless have dismissed the action for lack of a compensable injury. For example, see Pisciotta v. Old National Bancorp from the 7th Circuit in 2007 and Ruiz v. GAP, Inc. from the 9th Circuit in 2010.

However, in 2011, the 1st Circuit allowed a case to proceed, Anderson v. Hannaford Bros.Co., holding that reasonable out-of-pocket expenses necessary to mitigate future harm are recoverable, and that such steps are a reasonably foreseeable consequence of a data breach. In addition to common law claims, plaintiffs often bring statutory claims. But, like common law claims, there is a question on whether there is standing or damages for these claims. For example, in Sterk v. Best Buy Stores, a Video Privacy Protection Act case, the district court held that “Congress cannot erase Article III's standing requirement by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.”

The Supreme Court's Clapper decision now makes it clear that actual injury is required for a plaintiff to proceed under Article III in any context. Clapper was brought under the Foreign Intelligence Surveillance Act (FISA). Plaintiffs alleged that an amendment to FISA that permitted the government to intercept their foreign transmissions without probable cause was unconstitutional, and having to take measures to protect their communications from surveillance had harmed them. The Supreme Court held that Article III standing — and not standing under FISA in particular—requires actual injury, and that speculative injury is insufficient to create standing: “We have repeatedly reiterated that 'threatened injury must be certainly impending to constitute injury in fact,' and '[a]llegations of possible future injury' are not sufficient.” The court further cautioned against standing based on self-inflicted injury: A plaintiff “cannot manufacture standing merely by inflicting harm based on fears of hypothetical future harm that is not certainly impending.” Indeed, “If the law were otherwise, an enterprising plaintiff would be able to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.”

While not many cases have proceeded to the class certification stage, those that have gotten that far generally have been dismissed because of the predominance of individualized issues. Most recently, in In re Hannaford Bros. Co. Customer Data Security Breach Litig. discussed above, the 1st Circuit affirmed standing but denied class certification. The court recognized that damages would differ among class members, depending on whether they had incurred fraudulent charges and took steps to mitigate harm.

The Supreme Court's Comcast decision, decided shortly after Hannaford, makes it clear that the existence of individualized damages precludes class certification. Comcast was brought by Philadelphia cable subscribers alleging that Comcast had violated the Sherman Act by monopolizing Philadelphia's cable market. The Supreme Court ruled that when damages are so individualized that they outweigh any common elements of the case, a class may not be certified under the predominance requirement of Rule 23(b)(3): “Questions of individual damage calculations will inevitably overwhelm questions common to the class.”

Plaintiffs will try to confine Clapper and Comcast to their specific facts. But the decisions are not so limited. Thus, the battles will continue, and the predominance of individualized issues can still be expected to be the battleground for most data breach class actions that manage to proceed to class certification.

Data breaches typically involve lots of people, making them prime targets for class actions. Most cases have not gotten to the class certification stage because they have been dismissed on standing grounds, and when they have reached the class phase, certification has been denied because of the predominance of individualized issues. Two recent Supreme Court decisions, Clapper v. Amnesty International USA, in which the court held that actions based on speculative injury cannot proceed due to lack of standing, and Comcast Corp. v. Behrend, an antitrust case in which the court held that when damages are individualized, a class cannot be certified, reinforce these trends. While neither case involves a data breach, both have significant ramifications in the data breach context.

Many cases have been dismissed on standing grounds, such as Hammond v. The Bank of New York Mellon and Randolph v. ING Life Insurance and Annuity Company. A number of circuit courts have recognized standing, but nevertheless have dismissed the action for lack of a compensable injury. For example, see Pisciotta v. Old National Bancorp from the 7th Circuit in 2007 and Ruiz v. GAP, Inc. from the 9th Circuit in 2010.

However, in 2011, the 1st Circuit allowed a case to proceed, Anderson v. Hannaford Bros.Co., holding that reasonable out-of-pocket expenses necessary to mitigate future harm are recoverable, and that such steps are a reasonably foreseeable consequence of a data breach. In addition to common law claims, plaintiffs often bring statutory claims. But, like common law claims, there is a question on whether there is standing or damages for these claims. For example, in Sterk v. Best Buy Stores, a Video Privacy Protection Act case, the district court held that “Congress cannot erase Article III's standing requirement by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.”

The Supreme Court's Clapper decision now makes it clear that actual injury is required for a plaintiff to proceed under Article III in any context. Clapper was brought under the Foreign Intelligence Surveillance Act (FISA). Plaintiffs alleged that an amendment to FISA that permitted the government to intercept their foreign transmissions without probable cause was unconstitutional, and having to take measures to protect their communications from surveillance had harmed them. The Supreme Court held that Article III standing — and not standing under FISA in particular—requires actual injury, and that speculative injury is insufficient to create standing: “We have repeatedly reiterated that 'threatened injury must be certainly impending to constitute injury in fact,' and '[a]llegations of possible future injury' are not sufficient.” The court further cautioned against standing based on self-inflicted injury: A plaintiff “cannot manufacture standing merely by inflicting harm based on fears of hypothetical future harm that is not certainly impending.” Indeed, “If the law were otherwise, an enterprising plaintiff would be able to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.”

While not many cases have proceeded to the class certification stage, those that have gotten that far generally have been dismissed because of the predominance of individualized issues. Most recently, in In re Hannaford Bros. Co. Customer Data Security Breach Litig. discussed above, the 1st Circuit affirmed standing but denied class certification. The court recognized that damages would differ among class members, depending on whether they had incurred fraudulent charges and took steps to mitigate harm.

The Supreme Court's Comcast decision, decided shortly after Hannaford, makes it clear that the existence of individualized damages precludes class certification. Comcast was brought by Philadelphia cable subscribers alleging that Comcast had violated the Sherman Act by monopolizing Philadelphia's cable market. The Supreme Court ruled that when damages are so individualized that they outweigh any common elements of the case, a class may not be certified under the predominance requirement of Rule 23(b)(3): “Questions of individual damage calculations will inevitably overwhelm questions common to the class.”

Plaintiffs will try to confine Clapper and Comcast to their specific facts. But the decisions are not so limited. Thus, the battles will continue, and the predominance of individualized issues can still be expected to be the battleground for most data breach class actions that manage to proceed to class certification.