At CPW we’ve been giving our readers comprehensive coverage of rulings in the realm of data breach litigation.  For a reminder of the current Article III standing split in the data breach context and some other decisions, check out our prior posts here, here, and here.  Well, last week, in a break with a recent streak of plaintiff-friendly rulings, the Ninth Circuit recently sided with a defendant in affirming that a plaintiff had failed to adequately allege damages in a data breach litigation.  Read on below to find how it all went down.

In Pruchnicki v. Envision Healthcare Corp., No. 20-15460, 2021 U.S. App. LEXIS 11699 (9th Cir. Apr. 21, 2021), the Ninth Circuit considered the Plaintiff’s appeal of the district court’s dismissal of her claims against several healthcare corporations for a third party data breach.  The Complaint had asserted claims for negligence, breach of implied contract, negligent misrepresentation, and violation of Nevada Revised Statutes § 41.600 (deceptive practices).  Plaintiff claimed four “injuries” in support of her claim: (1) lost time spent reviewing consumer credit reports, obtaining new credit cards, checking financial accounts, and answering an increased number of “spam” calls; (2) emotional distress, including “stress, nuisance, and annoyance” from dealing with the effects of the breach, “worry, anxiety, and hesitation” when applying for new credit cards, and concern that “damage to her creditworthiness could impact her ability to obtain credit for her business”; (3) “imminent and certainly impending injury flowing from potential fraud and identity theft”; and (4) “diminution in value of [her] personal and financial information.”

Does this sound inadequate to you to support a claim?  The Ninth Circuit certainly thought so.

The district court found that the Plaintiff’s allegations were sufficient for standing purposes, but did not state a claim for compensable damages.  The Ninth Circuit agreed, finding that each of the four categories of injury the Plaintiff claimed was insufficient.  The Court noted that lost time did not constitute compensable damages, and the amended complaint did not plead physical injury or any other necessary components of an emotional distress claim.  The Ninth Circuit also observed that the Plaintiff had not sufficiently pled that her personal information lost value or had actually been stolen, and that the controlling law did not allow for recovery of speculative damages.

This is a critical ruling for any defendant litigating a data breach, especially in the Ninth Circuit.  For more developments in this area, stay tuned.  CPW will be there.