July 15, 2020

Volume X, Number 197

July 14, 2020

Subscribe to Latest Legal News and Analysis

July 13, 2020

Subscribe to Latest Legal News and Analysis

Third Circuit Moves Toward a Broader View of Standing in FCRA Data-Breach Class Action

Recently, the Third Circuit widened the gates for certain data-breach plaintiffs, holding that alleged violations of the Fair Credit Reporting Act (“FCRA”) constitute injuries-in-fact sufficient for Article III standing.[1] In its opinion in In re Horizon Healthcare Services Inc. Data Breach Litigation, [2] the Third Circuit clarified the standing requirements for plaintiffs asserting violations of certain federal statutes, and appears to shift the direction of the court’s previous trend. Before now, district courts in the Third Circuit often dismissed data-breach disputes on the basis of Article III standing—that is, many courts, relying on Reilly v. Ceridian Corp.,[3] found that plaintiffs did not plead a concrete injury sufficient to seek redress from federal courts absent allegations of harm arising from actual identity theft. [4]

The In re Horizon decision, however, suggests that the Third Circuit may be moving toward a view of finding standing for certain data-breach incidents that allege violations of certain federal statutes even if the plaintiff does not allege tangible personal harm arising from the data breach. Yet, despite this, and despite the Supreme Court’s ruling in Spokeo, Inc. v. Robins, [5] the contours of Article III standing in the data-breach context remain subject to debate and are not fully defined. [6]

Evolving Standing Requirements in the Third Circuit

The dispute in In re Horizon centered on the personal information of health care plan members of Horizon Healthcare Services, Inc.—including their names, address, dates of birth, and social security numbers. [7] The information was contained on two password-protected laptops that were chain-locked to the employees’ desks but were nevertheless stolen from Horizon’s headquarters. [8] Four plan members sued Horizon on behalf of 839,000 putative class members, alleging that “Horizon failed to take reasonable and appropriate measures to secure the stolen laptop computers and safeguard and protect Plaintiffs’ and Class Members’ [personal information].” [9]

The plaintiffs alleged that Horizon was a “consumer reporting agency” subject to FCRA’s privacy provisions, and that Horizon violated those provisions by (1) failing “to adopt reasonable procedures to keep sensitive information confidential,” and (2) furnishing “their information in an unauthorized fashion by allowing it to fall into the hands of thieves.” [10] In other words, “Horizon's failure to protect [the plaintiffs’] personal information violated the company's responsibility under FCRA to maintain the confidentiality of their personal information.” [11] Only one of the four representative plaintiffs alleged that he actually had suffered identity theft arising from the theft of the laptops. [12]

In the district court, Horizon filed a Rule 12(b)(1) motion to dismiss, arguing that the plaintiffs lacked standing because they had suffered no concrete injury. [13] The plaintiffs responded that “the violation of their statutory right to have their personal information secured against unauthorized disclosure constitutes, in and of itself, an injury in fact.” [14] The district court accepted Horizon’s reasoning and dismissed the case. [15]

On appeal, the Third Circuit reversed, ruling that the plaintiffs, by alleging an unauthorized transfer of personal identifying information in violation of FCRA, had established a sufficient de facto injury for standing. [16] The court reasoned that “the unlawful disclosure of legally protected information constitute[s] a clear de facto injury,” even if that information was not improperly used, [17] and that “Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress’s judgment, ought to remain private.” [18]

Anchoring its decision, the court emphasized that the injury the plaintiffs alleged was not “a mere technical or procedural violation of FCRA.” [19] Instead, the court found that the plaintiffs alleged the “unauthorized dissemination of their own private information—the very injury that FCRA is intended to prevent.” [20] Accordingly, “there is thus a de facto injury that satisfies the concreteness requirement for Article III standing.” [21]

The Third Circuit’s In re Horizon decision is notable in at least three respects.

First, the court’s decision makes clear that disclosure of personal information in violation of FCRA constitutes an injury-in-fact sufficient to create Article III standing even if plaintiffs did not suffer actual harm in the form of identity theft. The court’s decision also makes clear that disclosure of personal information may create standing under other federal statutes in which Congress has expressed an intent to make such an injury redressable. Though the court noted that the “particularization requirement” in the standing framework might work to limit disputes over more “technical breach[es]” of a statute, [22] it expressly declined to rule on when a data breach may be a mere “technical violation of a procedural requirement.” [23]

Second, the court interpreted the Supreme Court’s recent standing decision in Spokeo as a narrow one—working only to clarify and reinforce the Supreme Court’s “traditional notions of standing.” [24] The Supreme Court noted in Spokeo that “not all inaccuracies [in sharing people’s data] cause harm or present any material risk of harm.” [25] The Third Circuit reasoned that this language speaks only to the Article III “concreteness” requirement, and does not create any additional elements of an injury. [26] Thus, in the Third Circuit, Spokeo is simply another case in a long line of standing cases affirming the three traditional standing requirements.

Third, the court distinguished its prior guiding precedent, Reilly v. Ceridian Corp., in that the data-breach plaintiffs in that case had not asserted statutory causes of action under FCRA. [27] The Reilly plaintiffs’ common law claims did not grant them standing because “their risk of harm was too speculative.” [28] Contrast that with In re Horizon, in which the court relied heavily on the fact that “Congress has elevated the unauthorized disclosure of information into a tort[,] [a]nd so there is nothing speculative about the harm that Plaintiffs allege.” [29] This distinction, based on statutory versus common law causes of action, will likely be critical in data-breach cases in the Third Circuit.


In re Horizon appears to have shifted the Third Circuit’s prevailing analysis of injuries for standing, at least in the FCRA context and potentially in the context of other federal statutory violations. [30] This decision seems to narrow the lack-of-standing defense in that type of data-breach case, and potentially in others, when the claims involved arise from certain statutory rights, which may allow more lawsuits past the motion-to-dismiss stage. Still, the Third Circuit’s opinion leaves open what other federal statutes beyond FCRA may recognize data breaches as redressable injuries, and leaves open whether and under what circumstances a mere technical violation of a certain statute could constitute a concrete harm for standing. In any case, the Third Circuit’s statutory standing analysis will likely continue to evolve as the court irons out potential discrepancies between its jurisprudence on this issue and those of other circuits post-Spokeo. [31]

[1] See In re: Horizon Healthcare Services Inc. Data Breach Litigation, No. 15-2309, --- F.3d ---, 2017 WL 242554 (3d Cir. Jan. 20, 2017).

[2] Id.

[3] 664 F.3d 38 (3d Cir. 2011).

[4] See Nicholas Ranjan & Syed Ali, Federal Courts in the Third Circuit are Following the National Trend and Dismissing Data Breach Cases for Lack of Standing, K&L Gates (Apr. 24, 2015), http://www.klgates.com/federal-courts-in-the-third-circuit-are-following.... The court in Reilly held that “a security breach that compromised private information held by a payroll processing firm did not cause an injury in fact” when the plaintiffs�� claims were “based solely on the common law.” In re Horizon, 2017 WL 242554, at *11 n. 20.

[5] 136 S. Ct. 1540 (2016). According to the Third Circuit, Spokeo simply reiterates “traditional notions of standing” and “reemphasizes that Congress has the power to define injuries that were previously inadequate in law.” In re Horizon, 2017 WL 242554, at *10.

[6] By way of background, Article III, section 2, clause 1 of the U.S. Constitution provides that the federal judiciary may hear only cases or controversies arising within its jurisdiction. That phrase—“cases or controversies”—has been interpreted by the Supreme Court to require three things from the plaintiff in order for a court to hear their case: first, the plaintiff must have suffered an “injury-in-fact” that is both “concrete and particularized” and “actual or imminent” (injury); second, there must be a “causal connection between the injury and the conduct complained of” (causality); and third, “it must be likely . . . that the injury will be redressed by a favorable decision” (redressability). See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). The standing disputes in data-breach cases center primarily around the injury requirement—particularly that the injury must be “concrete.”

[7] See In re Horizon, 2017 WL 242554, at *2.

[8] Id.

[9] Id. at *3 n.6.

[10] Id. at *3. The court noted this about FCRA: 
FCRA was enacted in 1970 to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy. With respect to consumer privacy, the statute imposes certain requirements on any “consumer reporting agency” that “regularly ... assembl[es] or evaluat[es] consumer credit information ... for the purpose of furnishing consumer reports to third parties.” 15 U.S.C. § 1681a(f). Any such agency that either willfully or negligently “fails to comply with any requirement imposed under [FCRA] with respect to any consumer is liable to that consumer.” Id.
Id. (some citations omitted).

[11] Id.

[12] Id.

[13] Id. at *4.

[14] Id. at *6.

[15] The district court had held that standing requires additional “specific harm,” more than “mere violations of statutory and common law rights.” Id. at *6.

[16] Id. at *1, *12.

[17] Id. at *8 (citation omitted).The court relied on In re Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), two privacy cases involving standing by way of violations of statutory rights.

[18] In re Horizon, 2017 WL 242554, at *8.

Id. at *11.

[20] Id.

[21] Id.

[22] Id. at *11 n.22.

[23] Id. at *10 (“In some future case, we may be required to consider the full reach of congressional power to elevate a procedural violation into an injury in fact, but this case does not strain that reach.”).

[24] See id. at *8-*9.

[25] 136 S.Ct. at 1550.

[26] In re Horizon, 2017 WL 242554, at *10.

[27] Id. at *10 n.20.

[28] Id.

[29] Id.

[30] For this reason, the Third Circuit may consider granting en banc review and rehearing the case.

[31] See, e.g., Braitberg v.Charter Commc’ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016) (reasoning that, after Spokeo, plaintiff needed to plead a “material risk of harm” to have standing); Gubala v. Time Warner Cable, Inc., No. 16-2613, --- F.3d ---, 2017 WL 243343 (7th Cir. Jan. 20, 2017).

Copyright 2020 K & L GatesNational Law Review, Volume VII, Number 31


About this Author

Nicholas Ranjan, KL Gates Law Firm, Complex Commercial Litigation Attorney

Mr. Ranjan is a commercial litigator, whose practice focuses on energy/oil & gas, arbitration, class action defense, and appellate litigation. He has been selected by Chambers USA as one of the top commercial litigators in Pennsylvania since 2014, with clients commending his “creative approach and responsiveness.”

In addition to his litigation practice, Mr. Ranjan counsels energy clients in crisis management events, including serving as lead for on-site response, litigation management, and insurance/cost recovery.

Syed D. Ali, Insurance, Products Liability, Attorney, KL Gates, Law Firm

Mr. Ali is an associate in the firm’s litigation group. His practice includes products liability, toxic tort, insurance coverage, and appellate litigation. 

Mr. Ali defends clients in toxic tort cases in federal district courts across the country. He coordinated an equipment manufacturer’s defense in hundreds of cases in the federal asbestos MDL court in the United States District Court for the Eastern District of Pennsylvania. He has secured numerous defense rulings on summary judgment in federal court. 

Mr. Ali also represents corporate policyholders in both state and federal courts seeking insurance coverage in a variety of contexts, including marine-cargo losses, environmental claims, and product liabilities. 

Finally, Mr. Ali has an appellate practice and has litigated in appellate courts across the country. He has authored briefs in the United States Courts of Appeals for the Second, Third, Fourth, and Ninth Circuits, and also several state appellate courts. 

Andrew Glass, KL Gates Law Firm, Financial Litigation Attorney

Mr. Glass is a partner resident in K&L Gates’ Boston office, and a member of the firm's Consumer Financial Services Litigation and Class Action Litigation Defense groups, with extensive experience in complex commercial litigation. Mr. Glass's practice focuses on the defense of federal and state class action litigation brought against consumer financial services, mortgage lending, and consumer credit institutions. These class actions concern challenges under federal statutes, including the Fair Housing Act, Equal Credit Opportunity Act, Fair Credit Reporting Act, Real...

Gregory Blace, KL Gates Law Firm, Class Action Litigation Attorney

Mr. Blase is a partner in the Boston office of K&L Gates where he is a member of the firm's Class Action Litigation Defense group. Mr. Blase has experience in complex commercial litigation, and has represented mortgage lenders, servicers and other financial institutions in class action and individual suits under the Telephone Consumer Protection Act, Fair Credit Reporting Act, Fair Debt Collection Practices Act, Truth in Lending Act, Fair Housing Act, Equal Credit Opportunity Act, Real Estate Settlement Procedures Act, and various state unfair and deceptive practices...

Ryan Tosi, KL Gates Law Firm, Financial Services Attorney

Ryan Tosi is a partner in the Boston office of K&L Gates, and a member of the firm's Consumer Financial Services Litigation, Class Action Litigation Defense, and Government Enforcement groups. Mr. Tosi’s practice focuses on federal and state class action litigation and consumer finance litigation. Mr. Tosi has extensive experience representing financial services institutions, consumer credit institutions, mobile wireless companies, and sports entertainment companies in class action litigation, government enforcement matters, bankruptcy proceedings and individual...