The Eleventh U.S. Circuit Wades into the Data-Breach-Standing Debate
Last week, in a 26-page opinion, the 11th U.S. Circuit Court of Appeals weighed in on two questions crucial to the viability of privacy and data breach litigation in federal court—and perhaps even in general. First, does a plaintiff who claims to have been exposed to a substantial risk of future identity theft resulting from a data breach have standing under Article III to pursue his claims in federal court where the complaint alleges no actual misuse of his information? Second, do a plaintiff’s self-help efforts to mitigate this risk (e.g., canceling credit cards and losing benefits, and spending time and money monitoring one’s bank statements and credit score) suffice to demonstrate “actual harm” and thereby satisfy the standing requirement? The court answered both questions in the negative.
