STANDING AND THE CIRCUIT COURT SPLIT IN DATA BREACH LITIGATION
Every plaintiff in a US lawsuit must establish the threshold issue of standing. Put another way, a court cannot hear a dispute brought by a plaintiff that lacks standing. As the Supreme Court explained in Spokeo, Inc. v. Robins, standing operates to limit the “category of litigants empowered to maintain a lawsuit...to seek redress for a legal wrong”. To establish standing, a plaintiff must sufficiently allege three elements: (i) injury in fact; (ii) that is fairly traceable to the conduct of the defendant; and (iii) it is likely to be redressed by a favourable judicial decision. This article focuses on the first element, injury in fact, where data breach plaintiffs have faced the strongest barrier to standing, and where defendants have found the most fertile grounds for a motion to dismiss.
To establish an injury in fact, a plaintiff must show “an invasion of a legally protected interest” that is “concrete and particularised” and “actual or imminent, not conjectural or hypothetical”. To be ‘particularised’, an injury must have affected the plaintiff in some way. For example, a non-party to a contract rarely has standing to sue to enforce the contract’s terms. Thus, particularisation operates to prevent frivolous litigation being brought by a plaintiff unaffected by injurious conduct of a defendant.
Particularisation, while necessary, is not sufficient to establish an injury in fact. An injury must also be ‘concrete’. This means the injury is not abstract or speculative. While an injury cannot be speculative, the possibility of a future injury that has not yet occurred can potentially be sufficient for standing. As explained by the Supreme Court in Susan B. Anthony List v. Driehaus, a future injury can be sufficient if it is “certainly impending” or poses a “substantial risk” of coming to pass.
Jan-Mar 2018 issue
Potter Anderson & Corroon LLP