The Second Circuit recently joined a growing number of federal courts to decide when a data breach of personally identifiable information ("PII") is actionable. According to the Second Circuit, plaintiffs do not have standing to bring a lawsuit when there is no allegation their PII was targeted or misused.
The Second Circuit's decision
To bring a lawsuit in federal court, a plaintiff must have standing. To have standing, the plaintiff must establish, among other things, an "injury in fact." This means an injury that is "concrete and particularized" as well as "actual or imminent." A "conjectural" or "hypothetical" injury is not enough. This distinction is important in data breach cases, where courts are increasingly asked to decide whether a future risk of identity theft is sufficient to maintain claims in federal court.
In McMorris v. Carlos Lopez & Associates, former employees brought a class action after an employer accidentally emailed 65 employees a spreadsheet containing social security numbers, home addresses, dates of birth, telephone numbers, educational degrees, and dates of hire for approximately 130 current...
