Standing

2 posts

Access Denied: Data Breach Litigation, Article III Standing, and a Proposed Statutory Solution

By Patrick Lorio

As businesses and individuals increasingly rely on electronic technology to facilitate transactions, hackers have taken advantage of the weaknesses of data security systems intended to protect sensitive information. As a result, hackers have gained access to individuals’ personal and financial information. American law, however, has been slow to catch up to the threat posed by data security breaches. Although breaches have become commonplace in the past decade, victims of data breaches are often denied their day in court. Instead, many federal courts find that plaintiffs who sue companies for failing to adequately protect their private information lack Article III standing, the constitutional doctrine that requires plaintiffs to show an “injury-in-fact” in order to sue in federal court. While some jurisdictions hold that hackers having access to individuals’ information is sufficient to confer Article III standing, other jurisdictions dismiss plaintiffs’ cases unless the plaintiffs can demonstrate unreimbursed financial loss directly attributable to the data breach, a very high bar to reach.

The purpose of this Note is threefold. First, I analyze the existing split within the U.S. Courts of Appeals with regard to the correct theory of Article III standing to apply in data breach cases. The circuit split primarily involves disputes over the correct interpretation of Clapper v. Amnesty International, a 2013 U.S. Supreme Court case dealing with the “imminency” requirement of Article III standing’s injury-in-fact component. Second, I predict what the recent holding in Spokeo v. Robbins (2016) portends for data breach victims. Spokeo heightened the scrutiny that federal courts must place on the “concreteness” of injury in addition to the inquiry into “imminency.” Finally, I propose that the strict Article III standing requirements articulated by the Supreme Court in both Clapper and Spokeo necessitate action by Congress. I argue that Congress should pass a comprehensive data breach statute that would confer standing upon victims of data breach. I conclude by showing how a recent Third Circuit decision demonstrates the viability of a statutory solution to the problem encountered by data breach victims.

Download Article

Characterizing the Harms of Compromised Genetic Information for Article III Standing in Data Breach Litigation

By Terry Wong

As direct-to-consumer genetic testing has proliferated, individuals face a heightened risk of having their genetic information exposed in data breaches. In response to these breaches, individuals that turn to the federal courts as an avenue for recovery must overcome the legal barriers that have often frustrated victims in traditional data breach contexts. In particular, these plaintiffs have struggled due to the circuit split among the U.S. courts of appeals over whether certain harms are sufficient to confer Article III standing in data breach cases. While federal courts continue to debate over the sufficiency of traditional data breach harms, compromises of genetic information raise exceptional considerations and harms that should favor the conferral of Article III standing.

This Note analyzes that the implications of data breaches involving compromised genetic information that justify an expansive approach to the conferral of Article III standing. Part II of this Note surveys the growing prevalence of data breaches and discusses the common legal obstacles that victims face in seeking recovery against breached entities. Part III outlines the relevant Article III standing requirements and reviews the circuit split among the U.S. courts of appeals by focusing on the primary hurdle for data breach victims — establishing injury in fact. Part IV raises and analyzes the exceptional features and implications of data breaches involving genetic information. In doing so, this Part characterizes the potential harms resulting from genetic information compromise and discusses how they should impact the Article III standing analysis to satisfy the injury-in-fact requirement.

Download Article