In a potentially groundbreaking decision, the Supreme Court of Appeals of West Virginia reversed a trial court’s order denying class certification in a data breach class action. The case, Tabata v. Charleston Area Medical Center, holds that petitioners have standing and meet the requirements for class certification to bring causes of action for breach of confidentiality and invasion of privacy despite no evidence that any named plaintiffs were victims of any actual or attempted identity theft, or for that matter, suffered any actual economic loss. Tabata v. Charleston Area Med. Ctr., --- S.E.2d ----, 2014 WL 2439961 (W. Va. May 28, 2014).
The West Virginia Case
While the decision is only binding on West Virginia courts, it could have national implications as it will likely be cited as persuasive authority that no evidence of economic damages is needed for a class to have standing and meet the requirements for certification. However, Tabata should have limited application as it only interprets West Virginia law. For example, in Florida, actions for breach of confidentiality and invasion of privacy have different elements, but this will likely be tested in an effort to move the law in this new direction.
In Tabata, the named plaintiffs’ personal and medical information contained in a database operated by Charleston Area Medical Center (CAMC) was accidentally placed on the Internet. The information included names, contact information, Social Security numbers, dates of birth, and basic respiratory care information. CAMC admitted that the information could have been exposed if “someone were to conduct an advanced Internet search.” Id. CAMC notified the plaintiffs of the data breach and offered them a full year of credit monitoring at CAMC’s cost. The plaintiffs filed an action individually and on behalf of a class alleging various causes of action, including breach of confidentiality and invasion of privacy. Importantly,
[d]iscovery revealed that the petitioners and respondents are not aware of any unauthorized and malicious users attempting to access or actually accessing their information, and they are not aware of any of the 3,655 affected patients having any actual or attempted identity theft. Further, the petitioners have not suffered any property injuries or sustained any actual economic losses. Finally, the petitioners are not aware if any other potential class members have sustained such injuries.
The Supreme Court of Appeals of West Virginia agreed with the trial court that the risk of future identity theft alone did not establish the plaintiffs’ standing. However, the court held that under West Virginia law, breach of confidentiality and invasion of privacy claims need not allege special damages. Therefore, the mere fact that the plaintiffs’ confidential data had been made publicly available established an injury in fact with a causal connection to the claims for breach of confidentiality and invasion of privacy, which would likely be redressed through a favorable decision by the court: the elements of standing. Id.
Moreover, the court held that the class could...
