FEMA headquarters in Washington, D.C.

News broke last week that the Federal Emergency Management Agency had exposed personally identifiable information related to 2.3 million survivors of Hurricanes Irma, Harvey and Maria. FEMA sent information that included bank names and electronic transfer numbers to an outside contractor responsible for finding hotel accommodations for relief applicants.

The exposure was made public in a report published Friday by the Department of Homeland Security, which also indicated that FEMA had violated the Privacy Act of 1974. While that all sounds quite serious, the chances that FEMA will face any significant legal repercussions are relatively slim.

“I anticipate they're going to get scrutiny from Congress and others, but in terms of how that will impact them down the road, it's not quite as clear given that they are a government entity,” said Michael Waters, a shareholder at Polsinelli.

The federal government is typically immune from most lawsuits, but just how immune is currently being put to the test by the United States Court of Appeals for the D.C. Circuit.

A class action suit brought against the Office of Personnel Management (OPM) for a 2015 data breach that exposed Social Security numbers and other personal information belonging to 21 million government employees has found second life there, and Waters thinks that the outcome could greatly impact FEMA's legal future.

“If, for example, the District Court of Appeals says that the Office of Personnel Management is immune to lawsuits because it's a part of the federal government, FEMA is going to make the same argument. Same thing on standing grounds,” Waters said.

Standing has been an ongoing obstacle to class action suits related to privacy or data issues. For example, U.S. District Judge Amy Berman Jackson dismissed the original suit against OPM after deciding that the plaintiffs hadn't been injured and so therefore lacked the grounds to sue.

In a breach-related incident, an injury might constitute monetary loss or identity theft. A statement released by FEMA press secretary Lizzie Litzow said the organization “has found no indicators to suggest survivor data has been compromised.”

“That's a very hot topic right now in privacy and cybersecurity right now generally, which is do you suffer a harm because your information was breached? And that's not clear yet,” said Paige Boshell, a managing member of Privacy Counsel LLC.

Even if FEMA was found to be in violation of the Privacy Act of 1974, there's no guarantee that would make it easier to successfully pursue action. According to Boshell, the plaintiffs would have to prove that the organization demonstrated an intentional and willful refusal to comply with the law.

While the optics of exposing the personal information of millions of people who have already suffered at the hands of a natural disaster is not great for public image, Waters said that courts typically don't take claims of emotional distress into account as a valid form of injury in such cases.

He is, however, expecting to see an increased number of class action suits filed in response to data breaches.

“A number of courts have started to take the position that an increased risk of identity theft in the future can be an injury that gives you standing, and as a result some of these class actions have gotten passed the motion to dismiss stage,” Waters said.