Judge David Tatel, of the U.S. District Court for the District of Columbia/Photo by Diego M. Radzinschi/ALM

A federal appeals panel appeared poised to overturn the dismissal of a closely watched pair of cases brought over data breaches that hit the U.S. Office of Personnel Management.

The breaches compromised the Social Security numbers and other personal information of 21 million federal government employees, and prospective employees, at OPM. In 2017, U.S. District Judge Amy Berman Jackson dismissed two cases brought over the breaches, one by a government employee union and one a class action, after concluding that the plaintiffs lacked standing to sue because they hadn't been injured.

But, on Friday, a three-judge panel of the U.S. Court of Appeals for the D.C. Circuit wasn't so convinced.

“You've got an uphill battle,” Circuit Judge David Tatel told Assistant U.S. Attorney Sonia Carson in oral arguments. The other panelists, Patricia Millett and Stephen Williams, also appeared skeptical about the government's arguments.

“I think it's fair to say that the judges, all three of them, pressed the government quite hard on the standing issue,” said Paras Shah, assistant counsel at the National Treasury Employees Union, who argued on Friday in the union case.

The panel asked numerous questions, for example, about one of the lead plaintiffs in the class action who spent money out of her own pocket to purchase credit-monitoring services before OPM began offering free similar services to breach victims. Panelists also pushed back against Carson's argument that the risk of identity theft was speculative in a case involving hacked Social Security numbers.

Pete Patterson, a partner at Cooper & Kirk, who argued for the plaintiffs in the class action, did not respond to a request for comment.

U.S. Department of Justice spokeswoman Kelly Laco declined to comment.

The case raises a controversial issue in data breach class actions: Whether plaintiffs whose information was hacked suffered injuries sufficient to sue in federal court under Article III of the U.S. Constitution. In many cases, victims of data breaches allege nothing more than the risk of identity theft, but some cases have named plaintiffs who suffered fraudulent tax returns, charges to their credit cards or other costs. Courts have split over whether those injuries are sufficient to have standing.

In an amicus brief in the OPM appeal, the Electronic Privacy Information Center, joined by 44 “legal scholars and technical experts,” outlined the damage that stolen Social Security numbers can do. “The threats to the security of personal data collected by the government increase daily, and the law has failed to keep up,” the brief states.

The U.S. Chamber of Commerce, many of its members having been sued over data breaches, urged the D.C. Circuit in its own amicus brief not to take a “one-size-fits-all presumption on standing” given that some hackers do not intend to use the personal information.

The two OPM breaches compromised names, birth dates, addresses and Social Security numbers. In one case, the American Federation of Government Employees, along with 38 individuals, brought a class action under the federal Privacy Act, while the National Treasury Employees Union and three government employees who had filled out background investigation forms filed a case alleging OPM violated their constitutional right to privacy of information.

Complicating matters was a recent decision by the D.C. Circuit reversing dismissal of a case related to a 2014 breach at health insurer CareFirst. In that case, the panel found that the district judge had taken too narrow a view of harm to the plaintiffs in finding that the increased risk of identity theft was speculative.

Jackson wrote that, because of CareFirst, “standing is a very close and difficult question in this case.” But, ultimately, she found the cases to be different because CareFirst dealt with a domestic hack in which credit card or bank fraud was at issue, while OPM's breach appeared to be from a foreign state and involved Social Security numbers.

The plaintiffs both appealed to reverse Jackson's opinion, citing the CareFirst decision and other circuit court precedents that allowed data breach cases to go forward.

The panel appeared receptive to their arguments on standing.

“The government, in its briefs and arguments, tried its best to distinguish Attias, and I think on Friday what we saw was some pushback from the court on that,” Paras said.

Jackson, the district judge, also had found that immunity shielded the federal government and contractor KeyPoint Government Solutions from the class claims. But the panel questioned KeyPoint attorney Jason Mendro, a Washington, D.C., partner at Gibson, Dunn & Crutcher, on whether the contractor's immunity would stand if it found the government was liable.

Mendro did not respond to a request for comment.

The D.C. Circuit scheduled oral arguments for this month after three of the lawyers had scheduling conflicts, two of them for family purposes. Carson wrote a letter stating she expected to begin maternity leave on Jan. 1, and Patterson said he would be on paternity leave in early 2019.