Eleventh Circuit Holds Risk of Future Harm Does Not Establish Article III Standing

Alston & Bird

As part of a growing trend, the Eleventh Circuit recently held that an alleged risk of future identity theft does not establish standing where the plaintiff does not allege any information has actually been misused.  Tsao v. Captiva MVP Rest. Partners, LLC, No. 18-14959, 2021 U.S. App. LEXIS 3055 (11th Cir. Feb. 4, 2021).  The decision is a blow to the data breach plaintiffs’ bar, which routinely attempts to rely on third-party reports and other generic allegations concerning a risk of future harm to attempt to establish Article III standing.

The case arose after hackers allegedly gained access to PDQ’s point of sale system in May of 2017.  Cardholder names, credit card numbers, card expiration dates, and CVVs may have been accessed as a result of the alleged breach.  The plaintiff, whose information may have been accessed by the hackers, filed a class action against PDQ alleging claims of breach of implied contract, negligence, unjust enrichment, and violation of the Florida Unfair and Deceptive Trade Practices Act.  The District Court dismissed the complaint for lack of standing.

On appeal, the Eleventh Circuit affirmed.  It rejected the plaintiff’s reliance on third-party reports—a common allegation in data breach complaints—concerning the risk of identity theft, finding that those reports cut against the plaintiff because they established that the risk of identity theft is very low.  Likewise, the Court also found any purported risk to the plaintiff to be low. The Eleventh Circuit seized on the fact that the plaintiff had immediately cancelled his credit cards, which extinguished any risk of fraudulent charges. Also, the absence of specific evidence that any putative class member’s information had been misused cut against finding a substantial risk of future identity theft. Based on the factors above, as well as the plaintiff’s reliance on “vague, conclusory allegations,” the Eleventh Circuit held “some risk … still exists, but that risk is not substantial and is, at best, speculative.”  Id. at *25, 26.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Alston & Bird | Attorney Advertising

Written by:

Alston & Bird

Alston & Bird on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.