October 20, 2021

Volume XI, Number 293

Advertisement
Advertisement

October 20, 2021

Subscribe to Latest Legal News and Analysis

October 19, 2021

Subscribe to Latest Legal News and Analysis

October 18, 2021

Subscribe to Latest Legal News and Analysis

Second Circuit Affirms Dismissal of Data Breach Class Action on Article III Standing Grounds, Citing Unanimity of Circuits on “Increased Risk” Claims

The Second Circuit just affirmed the dismissal of a data breach class action predicated on an alleged increased risk of identity theft on Article III standing grounds.  McMorris v. Carlos Lopez & Assocs.LLC, No. 19-4310, 2021 WL 1603808 (2d Cir. Apr. 26, 2021).  Notably, the district court that dismissed the action raised the issue of standing sua sponte in advance of a scheduled class settlement fairness hearing.

McMorris involved the alleged disclosure of employee information—including Social Security numbers, home addresses, dates of birth, telephone numbers, educational degrees, and dates of hire—after one of the defendant’s employees accidentally emailed such information to all of the employees within the company (approximately 65).

Notably, the plaintiffs did not claim they suffered fraud or identity theft because of the inadvertent disclosure.  Similarly, the plaintiffs did not claim their information was shared with anyone outside of the company or that third parties otherwise had taken or misused it.

Nonetheless, the plaintiffs claimed they were “at imminent risk of suffering identity theft” and that they cancelled credit cards, purchased credit monitoring and identity theft protection services, and spent time assessing whether they should apply for new Social Security numbers after the email incident.

On those facts, the court found the plaintiffs lacked Article III standing.  The court characterized the decision as one that “join[s] all [] sister circuits that have specifically addressed the issue in holding that plaintiffs may establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data.”  The court nonetheless found that the plaintiffs “failed to show that they are at a substantial risk of future identity theft or fraud sufficient to establish Article III standing” on the facts alleged.

The court articulated a “non-exhaustive” list of three factors to consider when courts are “confronted with allegations that plaintiffs are at an increased risk of identity theft or fraud based on an unauthorized data disclosure”:

  1. Whether the plaintiffs’ data has been exposed as the result of a targeted attempt to obtain that data;

  2. Whether any portion of the dataset has already been misused, even if the plaintiffs themselves have not yet experienced identity theft or fraud; and

  3. Whether the type of data that has been exposed is sensitive such that there is a high risk of identity theft or fraud.

Applying those factors, the court found that, despite the sensitivity of information involved, the plaintiffs did not claim their information was subject to a targeted data breach or allege any facts showing their information (or that of any others) was misused.  Accordingly, the court affirmed the dismissal on Article III standing grounds.

Copyright © 2021, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XI, Number 117
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Ann Marie Mortimer Litigation Attorney Hunton Andrews Kurth LA
Partner

With over 20 years of experience in commercial litigation, Ann Marie has successfully resolved the most difficult cases facing her clients. She has an established track record in class action consumer claims litigation, focusing on data security, false advertising, and unfair competition class actions. Her cross-disciplinary practice encompasses complex commercial transactions, litigation of distribution agreements, and toxic tort/environmental claims. In connection with counseling clients to manage downstream litigation risk, Ann Marie has conducted internal...

213-532-2103
Shawn Patrick Regan Securities Litigation Attorney Hunton Andrews Kurth New York
Partner

Mr. Regan’s practice focuses on the financial services, energy, data-technology, and consumer retail industries.

He counsels clients in their most vexing matters, often involving regulatory and public relations elements or novel jurisdictional, substantive, and procedural issues.  

Shawn handles complex business disputes, securities litigation, government and regulatory investigations, cross-border litigation, and putative class/mass actions, involving contracts, torts, fraud, and other common law and statutory claims...

212-309-1046
Jason Kim Finance Lawyer Hunton Andrews Kurth Law Firm
Counsel

Jason’s practice focuses on class action defense and other complex commercial litigation in the data breach, financial services and consumer contexts.

Jason has represented clients at trial and on appeal in all manner of business disputes. He has litigated multiple highly publicized data breach class actions, financial services class actions and consumer class actions for a broad spectrum of Fortune 500 companies. 

Jason is admitted to practice before the Ninth Circuit Court of Appeals and all Districts in California. He also serves as an editor of the firm’s ...

+1 213 532 2114
Advertisement
Advertisement
Advertisement