October 15, 2019

October 15, 2019

Subscribe to Latest Legal News and Analysis

October 14, 2019

Subscribe to Latest Legal News and Analysis

U.S. Supreme Court Declines to Hear Zappos Data Breach Case

Earlier this week, the Supreme Court once again denied a petition for writ of certiorari to resolve the circuit split on standing in data breach class actions. Zappos.com, Inc. v. Stevens, No. 18-225, __ S. Ct. __ (Mar. 25, 2019). This decision was a setback for companies hoping to limit their liability in data breach cases and kept intact the Ninth Circuit’s decision that found plaintiffs have standing based on allegations that their information was stored in a breached database without any allegations that their information was misused. Of note, this is the third such refusal by the Supreme Court over the past year to resolve this threshold issue in data breach cases. With this most recent denial, a business’s legal exposure after a data breach will continue to depend on the laws of the circuit where the claims are filed.

Standing to pursue data breach claims is of great importance to retailers, as they are increasingly named as defendants in class action lawsuits filed by consumers whose information was allegedly compromised in the breach. From last April to June alone, data breaches and cyberattacks affected over 765 million people. Yet most of the affected consumers never experience identity theft or fraudulent charges. Is the mere fear of identity theft or fraudulent charges in the wake of a data breach enough to constitute an injury in fact giving rise to standing sue? Or should these actions be dismissed for lack of jurisdiction?

The Ninth Circuit has now joined the District of Columbia, Third, Sixth, and Seventh Circuits that have adopted a plaintiff-friendly view, holding that plaintiffs who alleged fear of future identity theft or fraudulent charges in the wake of a data breach satisfied the injury-in-fact requirement for standing under Article III. Even more alarming for retailers, is that Zappos did everything a responsible corporate citizen would do upon learning of a breach: immediately cut access between its systems and the outside world, suspended online ordering until customers’ passwords were reset, and notified its customers to change their passwords. These actions prevented widespread harm and, as a result, only a handful of customers out of 24 million reported concerns that their information was misused in the six years following the breach. The Supreme Court’s denial of Zappos’s petition leaves these circuit decisions in place that appear to ignore the fundamental requirements of Article III standing.

On the other hand, the First, Second, Fourth, and Eighth Circuits have adopted a defense-friendly view of standing. These circuits reason that fear of future harm as a result of a data breach is too speculative to meet Article III’s standing requirements, as interpreted by the Supreme Court. See, e.g., Clapper v. Amnesty International USA, 568 U.S. 398, 409 (2013) (standing under Article III requires that any alleged “future harm” be “certainly impending” and that “allegations of possible future injury are not sufficient”).

Unfortunately, it may be years until the Supreme Court has the appetite to clarify Article III’s standing requirements in data breach cases. In the absence of Supreme Court guidance on the standing issue, we anticipate that district courts within the District of Columbia, Third, Sixth, Seventh, and Ninth Circuits – which have ruled favorably for plaintiffs on the standing issue – will emerge as the forums of choice for data breach class actions. Retailers should be mindful of these unfavorable jurisdictions and where possible seek to consolidate data breach cases elsewhere.

©2019 Drinker Biddle & Reath LLP. All Rights Reserved

TRENDING LEGAL ANALYSIS


About this Author

Partner

Kristin Ann Shepard focuses on the defense of insurance companies and other financial institution clients in high-stakes litigation in state and federal trial and appellate courts. She has defended financial services companies in nationwide class actions, multidistrict litigation, and market conduct litigation, including underlying claims of consumer fraud, unfair insurance practices, RICO, and various common law torts. Kristin also has defended corporate-owned life insurance (COLI) carriers in litigation by policyholders and insureds, and advised clients on related tax...

202-230-5232
Daniel E. Brewer, Attorney, Drinker Biddle, Philadelphia, Commercial Litigation
Associate

Daniel E. Brewer has experience in a variety of complex commercial matters, including consumer class actions, complex business disputes, products liability, shareholder derivative actions and other corporate governance matters. In the course of his practice, Daniel handles many aspects of civil litigation, ranging from pre-litigation counseling, to discovery and dispositive motion practice, to trial advocacy and post-trial proceedings. He represents companies and individuals in a broad range of industries, including banking, telecommunications, automobile, pharmaceutical and computer software.

Dan also represents clients in responding to governmental inquiries and investigations, including investigations initiated by the Securities and Exchange Commission, the Department of Justice and the Office of Attorney General for the Commonwealth of Pennsylvania.

Dan is a contributor to the firm's SEC Law Perspectives Blog, which provides reports, discussions, and analyses on noteworthy trends in enforcement and regulatory activity of the U.S. Securities and Exchange Commission (SEC) and other agencies, such as the U.S. Commodity Futures Trading Commission (CFTC).

While in law school, he was a legal writing teaching assistant. Prior to becoming an attorney, Dan worked for an energy and environmental consulting firm in Washington, D.C.

215-988-3370
Christina Chapin, Drinker Biddle, Trial Lawyer
Associate

Christina R. Chapin assists clients with various aspects of trial preparation, including legal research and the drafting of motions and other legal memoranda.

As a summer associate at Drinker Biddle, she researched and drafted memoranda on issues including cross-border discovery conflicts and tortious interference claims.

Christina served as a judicial extern for the Hon. Thomas M. Durkin of the District Court for the Northern District of Illinois and the Hon. Mary Anne Mason of the Illinois Appellate Court. 

(312) 569-1106