As reported in our 2017 Data Security Incident Response Report, plaintiffs allege potential future harm as a basis for injury in 80 percent of data breach lawsuits. But are allegations of future harm sufficient to meet Article III’s cases-and-controversies requirement, specifically with regard to the injury-in-fact element of standing? Despite the prevalence of these allegations, federal courts remain divided on the answer to this question as it applies in the data breach context.
This divide stems from differing interpretations of the Supreme Court’s 2013 decision in Clapper v. Amnesty International USA, which held that plaintiffs must show that future harm is certainly impending, or that they are at a substantial risk of future harm, to satisfy the injury-in-fact requirement of Article III standing.
This divide continues to grow as the federal circuit courts begin to weigh in on the issue, with some circuits finding standing where others have not. Most recently, the Second Circuit joined the First, Third, and Fourth Circuits in holding that plaintiffs must allege more than the fact that their information was stolen to show an Article III injury. See Whalen v. Michaels Stores, Inc., — F. App’x —, 2017 WL 1556116, at *1-2 (2d Cir. May 2, 2017); see, e.g., Beck v. McDonald, 848 F.3d 262, 274 (4th Cir. 2017).
In contrast, the Sixth, Seventh, and Ninth Circuits have held that allegations of future harm are sufficient when plaintiffs allege that their data has been stolen and is in the hands of ill-intentioned criminals. See, e.g., Remijas v. Neiman Marcus Grp., 794 F.3d 688 (7th Cir. 2015); Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010).
The circuit split may soon grow, as this issue is currently pending before the Eighth Circuit, which heard oral argument on the matter just last month. See Alleruzzo, et al. v. SuperValu, Inc., No. 16-2378 (8th Cir.).
Is the Divide Real?
Some courts deny that a circuit split exists on this...
