Data breaches typically involve lots of people, making them prime targets for class actions. Most cases have not gotten to the class certification stage because they have been dismissed on standing grounds, and when they have reached the class phase, certification has been denied because of the predominance of individualized issues. Two recent Supreme Court decisions, Clapper v. Amnesty International USA, in which the court held that actions based on speculative injury cannot proceed due to lack of standing, and Comcast Corp. v. Behrend, an antitrust case in which the court held that when damages are individualized, a class cannot be certified, reinforce these trends. While neither case involves a data breach, both have significant ramifications in the data breach context.

Many cases have been dismissed on standing grounds, such as Hammond v. The Bank of New York Mellon and Randolph v. ING Life Insurance and Annuity Company. A number of circuit courts have recognized standing, but nevertheless have dismissed the action for lack of a compensable injury. For example, see Pisciotta v. Old National Bancorp from the 7th Circuit in 2007 and Ruiz v. GAP, Inc. from the 9th Circuit in 2010.

However, in 2011, the 1st Circuit allowed a case to proceed, Anderson v. Hannaford Bros.Co., holding that reasonable out-of-pocket expenses necessary to mitigate future harm are recoverable, and that such steps are a reasonably foreseeable consequence of a data breach. In addition to common law claims, plaintiffs often bring statutory claims. But, like common law claims, there is a question on whether there is standing or damages for these claims. For example, in Sterk v. Best Buy Stores, a Video Privacy Protection Act case, the district court held that “Congress cannot erase Article III's standing requirement by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.”