The 11^th Circuit recently weighed in on the hottest issue is data breach litigation, whether a demonstration of actual harm is required to have standing to sue. Joining several other circuit courts, the 11^th Circuit in Tsao v. Captiva MVP Rest. Partners, concluded that the plaintiff had failed to allege either that the data breach placed him in a “substantial risk” of future identity theft or that identity theft was “certainly impending”.

The matter in Tsao stemmed from a data breach at a restaurant chain of which the plaintiff frequented. In May of 2017, a hacker exploited the restaurant chain’s point of sale system and gained access to customers’ personal data – the credit and debit card information – through an outside vendor’s remote connection tool. However, due to the nature of the breach the restaurant chain stated that it was not possible to determine the identity or exact number of credit card numbers or names that were accessed or acquired during the cyber-attack.

Within two weeks of the restaurant chain’s announcement of the breach, plaintiff filed a class action complaint on behalf of himself and other customers potentially impacted by the breach, alleging a variety of injuries due to the data breach, including “theft of their personal financial information,” “unauthorized charges on their debit and credit card accounts,” and “ascertainable losses in the form of the loss of cash back or other benefits.”  The plaintiff asserted that he and the class members “have been placed at an imminent, immediate, and continuing increased risk of harm from identity theft and identity fraud, requiring them to take the time which they otherwise would have dedicated to other life demands such as work and effort to mitigate the actual and potential impact of the Data Breach on their lives.”

Standing to sue in a data breach class action lawsuit largely turns on whether plaintiffs establish that they have suffered an “injury-in-fact” resulting from the data breach. Plaintiffs in data breach class actions are often not able to demonstrate that they have suffered financial or other actual damages resulting from a breach of their personal information. Instead, plaintiffs will allege that a heightened “risk of future harm” such as identity theft or fraudulent charges is enough to establish an “injury-in-fact”.

Federal circuits court over the past few years have struggled with the question whether plaintiffs in a data breach class action can establish standing if they only allege a heightened “risk of future harm”.  For example, the 3^rd, 6^th, 7^th,  9^th  and D.C. circuits have generally found standing, while the 1^st, 2^nd, 4^th, 5^th, and 8th circuits have generally found no standing where a plaintiff only alleges a heightened “risk of future harm”. This circuit court split is in large part to due to lack of clarity following the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins which held that even if a statute has been violated, plaintiffs must demonstrate that an “injury-in-fact” has occurred that is both concrete and particularized, but which failed to clarify whether a “risk of future harm” qualifies as such an injury.

In reaching its decision, the 11^th Circuit relied heavily on the 8^th Circuit’s analysis of the issue of standing to sue, in In re SuperVal, Inc. where the court found no standing based on an increased risk of future identity theft” theory, even when a named plaintiff alleged actual misuse of personal information. Citing a U.S. Government Accountability Office Report on the likelihood of identity theft in the event of a data breach (“GAO Report”), the 8^th Circuit reasoned that the hackers in the data breach at issue were not alleged to have stolen social security numbers, birth dates, or driver’s license numbers, and thus, according to the GAO report, the risk of identity theft was “little to no[ne].”

Similarly, the 11^th Circuit reasoned in Tsao, that based on the GAO Report, since only credit and debit card information had potentially been breached in the data breach at issue, no “substantial risk” of identity theft existed. Moreover, the 11^th Circuit emphasized that the plaintiff offered only vague, conclusory allegations that members of the class have suffered any actual misuse of their personal data—here, “unauthorized charges.”

“Without specific evidence of some misuse of class members’ data, a named plaintiff’s burden to plausibly plead factual allegations sufficient to show that the threatened harm of future identity theft was “certainly impending”—or that there was a “substantial risk” of such harm—will be difficult to meet”, the 11^th Circuit stated.

Finally, the 11^th Circuit Court noted that the plaintiff had immediately cancelled his credit cards following disclosure of the breach, “effectively eliminating the risk of credit card fraud in the future.”

Takeaway

The lack of clarity on this issue has made it difficult for businesses to assess the likelihood of litigation and its associated costs in the wake of a data breach.  It is crucial for businesses to assess their breach readiness and develop an incident or breach response plan that takes into consideration the possibility of litigation.