Sixth Circuit Lowers Bar For Plaintiff’s Standing To Sue In Data Breach Cases

King & Spalding
Contact

On September 12, 2016, a split panel from the U.S. Court of Appeals for the Sixth Circuit held in an unpublished opinion that customers of Nationwide Mutual Insurance (“Nationwide”) could pursue claims stemming from a 2012 data breach without alleging their identities had actually been stolen, or that the hackers had actually used their personal information. The Court held the plaintiffs had Article III standing to sue Nationwide for the data breach, even though the only harm the plaintiffs alleged related to a heightened risk of identity theft and certain costs associated with monitoring their credit history after the data breach. In coming to this conclusion, the Sixth Circuit panel cited recent decisions in the Seventh Circuit, which similarly held that Article III standing could be based upon fraud prevention expenses following a data breach. However, the Nationwide ruling appears to be the first data breach case in which the plaintiffs did not have to wait for actual misuse of their personal data in order to have standing to pursue their claims. 

A lower court had previously granted Nationwide’s motion to dismiss, finding (amongst other things) that the plaintiffs did not have Article III standing because they had not alleged a cognizable injury under the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681. In reversing the lower court, the Sixth Circuit concluded that by claiming that the theft of their personal data had put them at increased risk for fraud, and that they had incurred related costs to mitigate this risk (such as paying for credit “freezes”), the plaintiffs had established enough for standing. The Nationwide case also represents the first data breach standing claim to be analyzed at the U.S. Court of Appeals level since the U.S. Supreme Court’s October 2015 decision in Spokeo, Inc. vs. Robins, which held that Article III standing requires a concrete injury even in the context of a statutory violation (i.e., that a bare procedural violation of a statute – in this case, the FCRA – was not sufficient for Article III standing).

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© King & Spalding | Attorney Advertising

Written by:

King & Spalding
Contact
more
less

King & Spalding on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.