Circuit Courts Split: Victim of a Data Breach? Can You “STAND” and Sue in Federal Court?

Abstract

As data breaches become more frequent, those whose data has been stolen have begun to sue the companies that kept their personal data. In order to sue in federal court for this issue, the plaintiffs need to satisfy Article III standing. To satisfy Article III standing, plaintiffs need to show that they suffered an injury in fact. The Sixth, Seventh, Ninth, and D.C. Circuit Courts of Appeals have held that the risk of future identity theft arising from a data breach is enough to establish the injury requirement under Article III. Although not in a data breach case, the Eleventh Circuit has also found that the risk of identity theft is sufficient to establish an injury in fact. In contrast, the Second, Third, Fourth, and Eighth Circuit Courts of Appeals have refused to find an injury in fact based on the increased risk of identity theft arising from a data breach. Although not in a data breach case, the First Circuit Court of Appeals has also found that the risk of identity theft is not sufficient for a plaintiff to have standing to sue in federal court. The Fifth and Tenth Circuits have not yet weighed in on the issue. The Supreme Court has also refused its opportunity to address the circuit split. The Supreme Court should address the issue and find that a data breach victim has suffered an injury in fact based on an increased risk of identity theft because (1) previous Supreme Court decisions regarding an injury in fact support that finding; (2) statistics and legislative action show a correlation between data breaches and identity theft; and (3) finding an injury in fact is the equitable result based on the pervasiveness of data breaches and the burden a data breach imposes on a victim, including economic and emotional burden. The Court should find an injury in fact for all victims of a data breach, including victims of data breaches that occurred during a physical laptop or box theft, and when the information stolen in the breach is credit or debit card information.