Second Circuit Ruling Clarifies When Data Breach Plaintiffs Have Adequately Plead Article III Standing

In a thoughtful opinion that diverges from how other circuit courts have addressed the issue, the Second Circuit recently issued a ruling clarifying the circumstances when data breach plaintiffs can rely on fear of identity theft to establish Article III standing.

The case is McMorris v. Carlos Lopez & Associates, LLP (CLA).  CLA offers mental and behavioral health services to veterans, service members and their families.  An employee at CLA accidentally emailed a spreadsheet containing social security numbers and other sensitive personal information of 130 CLA employees and former employees to CLA staff.  Plaintiffs later initiated a class action in the Southern District of New York on behalf of all employees and former employees whose personal information was erroneously emailed, asserting negligence and consumer protection claims.  The complaint did not allege that any plaintiffs were the victim of identity theft or that anyone outside of CLA had obtained the spreadsheet.  Rather, plaintiffs asserted that they cancelled their credit cards and purchased credit monitoring to guard against “imminent” identify theft. The Southern District dismissed the complaint on grounds that plaintiff has not asserted an injury sufficient to establish Article III standing.

On appeal, the Second Circuit ruled that fear of identity theft can be sufficient for Article III standing, but held that the plaintiffs hadn’t established a substantial risk of identity theft in this particular case.  Perhaps the most notable aspect of the opinion is the Second Circuit’s contention that the often claimed “circuit court” split on the issue of whether fear of identity theft is sufficient for Article III standing is illusory.  Synthesizing the case law, the Second Circuit found that, in fact, no circuit court had ever held that a plaintiff lacks standing where the plaintiff had adequately plead a substantial risk of identity theft.  In the Second Circuit’s view, the cases instead differ on what constitutes a “substantial risk of identity theft.”