Standing Your Ground: Supreme Court To Consider Standing Question Important In Data Breach Class Action Litigation

Yesterday, the United States Supreme Court granted certiorariin Spokeo, Inc. v. Robins, to consider a question critical to the viability of data breach class actions: standing. Since the Court's most recent standing decision in Clapper v. Amnesty Int'l USA, a majority of lower courts have dismissed data breach claims for failing to satisfy Article III's injury-in-fact requirement; however, a growing chorus of lower courts have sanctioned such actions. As the Supreme Court prepares to wrestle with that split of authority during oral argument this fall, it will be tasked with deciding whether a plaintiff's allegations concerning violations of statutory rights under the Federal Credit Reporting Act ("FCRA") are sufficient to establish standing irrespective of any tangible injury. The ramifications of that determination are deeply significant, as the decision may either open or close the floodgates to data breach litigation throughout the country.

In Clapper v. Amnesty Int'l USA, the Supreme Court reaffirmed that Article III standing is not a speculative or conjectural concept; mere concern or fear of future harm does not suffice to confer standing. Rather, a plaintiff must demonstrate she has suffered a "concrete, particularized, and actual or imminent" injury, meaning the harm has either occurred or is "certainly impending."

Following Clapper, plaintiffs' lawyers have experienced significant challenges surviving motions to dismiss in data breach class action cases because the putative plaintiffs often have not suffered an identifiable injury, nor is one clearly imminent. This is especially true in cases involving compromised credit card information, login/password combination information, e-mail addresses, and location information, to name a few. In general, even though it may be possible to use such information to compromise an individual's identity, reviewing courts have routinely heldthat a mere risk of identity theft (as opposed to actual theft or misuse of personal information) does not qualify as a "certainly impending" harm so as to confer standing upon plaintiff class members.1 However, a minority of courts (some in several high-profile data breach cases) have come to the opposite conclusion, holding that the elevated risk of misuse is sufficient to qualify as "certainly impending" and that unauthorized acquisition of personal information on its own constitutes an adequate injury for Article III purposes.2

Spokeo presents an...