Eleventh Circuit Reverses Dismissal Of Data Breach Class Action Involving Stolen Laptops

Addressing a purported class action filed after laptops containing health care patients' private data were stolen, the Eleventh Circuit recently issued one of its more consumer-friendly class action decisions, Resnick v. AvMed, Inc., 11-13694, 2012 WL 3833035 (11th Cir. Sept. 5, 2012). The case spotlights an important question: what level of actual injury and what causation are required in order for a data breach class action to survive dismissal?

Data breaches occur when personally identifiable information ("PII") typically held by a business entity in confidence—ranging from names and addresses to social security numbers and financial account numbers—makes its way into the hands of a third party. Data breaches can be intentional—hackers, stolen laptops or devices, etc.—or unintentional—system glitches, employee negligence, etc. Human error and glitches constitute the root cause of most data breaches. But those caused by malicious hacking and other deliberate misdeeds may be increasing. See PONEMON INSTITUTE LLC, 2011 COST OF DATA BREACH STUDY (March 2012). Generally, plaintiffs have struggled to demonstrate actual harm stemming from a company's lapse in data security.

To head off a jurisdictional standing challenge based upon the absence of actual injury, plaintiffs frequently allege that intentional maliciousness caused the data breach and that identity theft was the motive. See, e.g., Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d. Cir. 2011) (finding no standing where no evidence "that the data has been—or will ever be—misused"); Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010) (finding sufficient injury-in-fact under Article III but cautioning that "[w]ere Plaintiffs–Appellants' allegations more conjectural or hypothetical—for example, if no laptop had been stolen, and Plaintiffs had sued based on the risk that it would be stolen at some point in the future—we would find the threat far less credible"): Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 634 (7th Cir. 2007) (where the breach was "sophisticated, intentional, and malicious . . . the injury-in-fact requirement can be satisfied by a threat of future harm or by an act which harms the plaintiff only by increasing the risk of future harm that the plaintiff would have otherwise faced").

But surviving a standing challenge at the pleading stage often proves a short reprieve in some jurisdictions, as many cases soon end in a dismissal on the merits for inadequate poof of...