The standard defense to a data breach lawsuit has been — there was no actual injury (only the fear of a potential injury), so the plaintiffs lack standing and the case must be dismissed. This defense has historically resulted in the dismissal of data breach lawsuits. But this standing defense is under siege and the Third Circuit might have given it a permanent seat.
In re: Horizon Data Breach Litigation, Horizon, a large health insurer, had two laptops stolen. The laptops contained the PII (or personally identifiable information) of hundreds of thousands of people. A class action lawsuit was filed in which the plaintiffs alleged that because Horizon did not take reasonable steps to secure its data, the plaintiffs were exposed to a potential vulnerability to identity theft. The district court dismissed the action, on the basis of standing, as none of the putative class members could show that the breached information was used to their detriment. The Third Circuit, in a published and precedential decision that was the first of its kind, reversed and found that, even without evidence that the information was used improperly, the plaintiffs had standing to proceed with their claims.
This decision is big news as it comes from a federal circuit court and means that the standing defense is losing its hold as a viable defense. Standing, in short, is taking a seat.
Special thanks to Matt Care for his contribution to this post. For more information, please e-mail Bob Cosgrove.