Courts won’t do anything

Last summer, the U.S. Supreme Court seemed to make it much harder to bring privacy lawsuits, including data breach class actions, in federal court. But after about eight months of lower court decisions, the picture seems to be one of complexity rather than certainty.

A quick primer on standing, for lawyers and non-lawyers alike

The Supreme Court has been strict in holding that plaintiffs in federal court must have “standing” to sue. To establish standing, plaintiffs must show that they have suffered an “injury in fact” that is concrete, particularized, and actual or imminent. An intangible injury, such as harm to reputation, can be concrete, and, until last summer, it seemed that future injury could qualify if it was “certainly impending” or there was  a “substantial risk that the harm will occur.”

This was all particularly important in data breach cases: Plaintiffs usually have strong evidence that their data was stolen (frequently in the form of a notification letter directly from the breached company), but quite often they cannot say that all (or even any) of the data subjects had personally experienced fraudulent charges or identity theft. Instead, plaintiffs often allege that they face a risk of ID theft or other future harm from misuse of their data. The courts seemed to be warming to future harm as satisfying the injury-in-fact requirement. Indeed, in April 2021, the federal Court of Appeals for the Second Circuit, in a case called McMorris, said that no court of appeals had explicitly foreclosed plaintiffs from establishing standing based on a risk of future identity theft. The appellate panel then held explicitly that “plaintiffs may establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data.” (The court went on to rule that standing was not established based on the facts alleged before it.)

A few weeks later, on June 3, 2021, the Eleventh Circuit found standing based on risk in the massive Equifax case: “Given the colossal amount of sensitive data stolen, including Social Security numbers, names, and dates of birth, and the unequivocal damage that can be done with this type of data, we have no hesitation in holding that Plaintiffs adequately alleged that they face a ‘material’ and ‘substantial’ risk of identity theft that satisfies the concreteness and actual-or-imminent elements.” This was on top of earlier decisions in at least four other circuits finding standing in data breach cases based on risk of future harm.

TransUnion v. Ramirez: An apparent game changer

All that seemed to change June 25, 2021, when the Supreme Court handed down its decision in TransUnion v. Ramirez. The case arose under the Fair Credit Reporting Act, which requires credit reporting agencies to follow reasonable procedures to assure maximum possible accuracy in consumer reports. The act specifies that any person who willfully fails to comply with the act “is liable to that customer” for damages. In its credit reports, TransUnion had incorrectly tagged thousands of law-abiding Americans as being on the government’s list of terrorists, drug traffickers and serious criminals. For 1,853 people, the company had provided the incorrect reports to third parties. The court had no trouble finding injury in fact and standing for them. The court said the injury caused by the dissemination of the inaccurate information bore a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts — namely, the reputational harm associated with the tort of defamation — and therefore satisfied the constitutional requirement.

But as to the 8,185 class members who had been falsely tagged but whose credit reports had never been disseminated, the court ruled that the mere existence of inaccurate information in a database is insufficient to confer standing, even though Congress had said that consumers could sue a credit reporting agency that failed to assure the accuracy of its reports. Plaintiffs argued that they were at risk of future harm, in that the inaccurate reports could be disseminated at any time. That’s where the Court dropped the hammer, stating that, “in a suit for damages, the mere risk of future harm, standing alone, cannot qualify as a concrete harm.”

The court left open several avenues to standing. It suggested that a plaintiff’s knowledge that he or she is exposed to a risk of future physical, monetary or reputational harm could cause its own current emotional or psychological harm, which might suffice. It also said that disclosure to a third party, even “accidental disclosure,” might give rise to standing. After all, it granted standing to the 1,853 persons whose credit reports had in fact been sent out.

All in all, however, TransUnion looked like the death knell for data breach standing based on risk of future ID theft or other fraud.