December 6, 2022

Volume XII, Number 340

Advertisement

December 06, 2022

Subscribe to Latest Legal News and Analysis

December 05, 2022

Subscribe to Latest Legal News and Analysis

D.C. District Court Confirms No Standing in Data Theft Cases

In a recent decision, the U.S. District Court for the District of Columbia held that the plaintiffs in a data theft case lacked standing when the only injury was an “increased likelihood” of becoming an identity theft victim.

In rendering its decision in In Re Science Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, the district court relied on the U.S. Supreme Court’s decision in Clapper v. Amnesty International USA, where the Court held a “mere loss of data” or “increased risk of identity theft” in a data breach case does not constitute an injury that confers standing. Instead, individuals whose data has been stolen must show that injury has actually occurred or is certainly impending.

The facts of the SAIC case are pleasantly low tech. Data back-up tapes were stolen from a car. The tapes were never found. The tapes contained personal information for more than 4.7 million members of military families. In the hands of a tech-savvy cyber criminal, such information could be a jackpot, but, in the hands of a common street criminal, maybe not. The district court in SAIC stated: “At this point, we do not know who [the thief] was, how much [the thief] knows about computers, or what [the thief] has done with the tapes. The tapes could be uploaded onto [the thief’s] computer and fully deciphered, or they could be lying in a landfill somewhere in Texas.”

The court in SAIC provided a simple summary: “In sum, increased risk of harm alone does not constitute an injury in fact [sufficient for standing]. Nor do measures taken to prevent a future, speculative harm.”

Accordingly, in order to have standing to pursue a data breach case, a plaintiff would have to demonstrate much more than an increased likelihood of harm. Rather, a plaintiff would have to show an actual injury that was directly caused by the breach. Even then, of course, that would only establish standing, and a plaintiff would have to prove the other elements of his or her case.

Copyright © 2022 by Morgan, Lewis & Bockius LLP. All Rights Reserved.National Law Review, Volume IV, Number 205
Advertisement
Advertisement
Advertisement

About this Author

Doneld Shelkey, Technology attorney, Morgan Lewis
Partner

Doneld G. Shelkey represents clients in global outsourcing, commercial contracts, and licensing matters, with a particular focus on the e-commerce and electronics entertainment industries. Doneld assists in the negotiation of commercial transactions for domestic and international manufacturers, technology innovators, and retailers, and counsels clients in the e-commerce and electronics entertainment industries on consumer licensing and virtual property matters.

617 341 7599
Eric Pennesi, Morgan Lewis, Technology attorney
Associate

Eric J. Pennesi focuses his practice on technology, outsourcing, and commercial transactions. As part of his practice, Eric drafts and negotiates a broad range of agreements in matters including software licensing, e-commerce, data licensing and subscriptions, consulting and services, manufacturing and supply, and strategic alliances and joint ventures.

412.560.7414
Advertisement
Advertisement
Advertisement