On September 12, 2016, a split panel from the U.S. Court of Appeals for the Sixth Circuit held in an unpublished opinion that customers of Nationwide Mutual Insurance (“Nationwide”) could pursue claims stemming from a 2012 data breach without alleging their identities had actually been stolen, or that the hackers had actually used their personal information. The Court held the plaintiffs had Article III standing to sue Nationwide for the data breach, even though the only harm the plaintiffs alleged related to a heightened risk of identity theft and certain costs associated with monitoring their credit history after the data breach. In coming to this conclusion, the Sixth Circuit panel cited recent decisions in the Seventh Circuit, which similarly held that Article III standing could be based upon fraud prevention expenses following a data breach. However, the Nationwide ruling appears to be the first data breach case in which the plaintiffs did not have to wait for actual misuse of their personal data in order to have standing to pursue their claims.
A lower court had previously granted Nationwide’s motion to dismiss, finding (amongst other things) that the plaintiffs did not have Article III standing because they had not alleged a cognizable injury under the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681. In reversing the lower court, the Sixth Circuit concluded that by claiming that the theft of their personal data had put them at increased risk for fraud, and that they had incurred related costs to mitigate this risk (such as paying for credit “freezes”), the plaintiffs had established enough for standing. The Nationwide case also represents the first data breach standing claim to be analyzed at the U.S. Court of Appeals level since the U.S. Supreme Court’s October 2015 decision in Spokeo, Inc. vs. Robins, which held that Article III standing requires a concrete injury even in the context of a statutory violation (i.e., that a bare procedural violation of a statute – in this case, the FCRA – was not sufficient for Article III standing).
