On February 4, 2021, the Eleventh Circuit Court of Appeals issued a critical opinion addressing Article III standing in private data breach actions, which has been the subject of a closely watched circuit split.
The case, Tsao v Captiva MVP Restaurant Partners LLC, originated in the District Court for the Middle District of Florida where the plaintiff filed a class action complaint against the restaurant chain PDQ in connection with a May 2017 data breach. Following the breach, PDQ posted a notice to customers regarding the breach, explaining that customers’ names, credit card numbers, card expiration dates and CVVs may have been exposed.
Subsequently, the plaintiff filed a class action complaint containing causes of action for breach of implied contract, negligence, negligence per se, unjust enrichment and violation of the Florida Unfair and Deceptive Trade Practices Act. Without alleging any specific instances of data theft, the named plaintiff alleged that the class was “injured” because they “have been placed at an imminent, immediate, and continuing increased risk of harm from identity theft and identity fraud, requiring them to take the time which they otherwise would have dedicated to other life demands such as work and effort to mitigate the actual and potential impact of the Data Breach on their lives.”
The district court dismissed the complaint for lack of standing, finding that although the plaintiff alleged that his data was “exposed” to criminals, he failed to allege any concrete injury – i.e. that his credit cards were used fraudulently or that his identity was stolen. Plaintiff appealed.
On appeal, the plaintiff argued that standing was established for two reasons. First, standing was proper because he could suffer future injury as a result of the data breach. Second, his lost time, reward points and access to preferred credit cards caused by the breach constituted an “injury.”
The Eleventh Circuit rejected both arguments, holding that “[e]vidence of a mere data breach does not, standing alone, satisfy the requirements of Article III standing.” The court went on to explain that “a plaintiff alleging a threat of harm does not have Article III standing unless the hypothetical harm alleged is either ‘certainly impending’ or there is a ‘substantial risk’ of such harm.” The court further explained that “if the hypothetical harm alleged is not ‘certainly impending,’ or if there is not a substantial risk of the harm, a plaintiff cannot conjure standing by inflicting some direct harm on itself to mitigate a perceived risk.”
In analyzing the plaintiff’s arguments, the court held that dismissal was proper because allegations of an increased risk of identity theft did not meet the standard of a “certainly impending” or “substantial risk” of harm. Likewise, vague, conclusory allegations that members of the class suffered misuse of data did not confer standing. The court warned that without a specific allegation of the misuse of class members’ data, evidence that an injury is certainly impending would be “difficult to meet.”
Finally, the court rejected the plaintiff’s argument that he was injured through his lost opportunity to accrue reward points, the cost and time associated with remedying the breach and restricted access to his preferred credit cards. It explained that it is well established that a plaintiff “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Because the alleged harms were tied to the plaintiff’s voluntary cancellation of his credit cards, which were intertwined with his perception of the risk of identity theft, standing was not proper.
The Tsao decision is the latest circuit court decision to address the issue of whether a plaintiff can establish injury-in-fact at the pleading stage based on the increased risk of identity theft. The Sixth, Seventh, Ninth, and D.C. Circuits have recognized that such an increased risk can confer standing, while the Second, Third, Fourth, and Eighth Circuits have declined to find standing under such circumstances.
