The Fourth Circuit’s 2017 decision in Beck v. McDonald held that the mere fear of identity theft in the wake of a data breach was insufficient to confer Article III standing. Plaintiffs must do more. But how much more? The Fourth Circuit’s latest holding clarifies that plaintiffs who allege that credit cards have been fraudulently applied for – and in some cases issued – using their nonpublic personal information satisfy Article III’s requirements.
Optometrists brought two putative class actions against the National Board of Examiners in Optometry (NBEO) after an alleged breach of the NBEO database compromised their personal information. The plaintiffs discovered the breach in 2016 when they learned that Chase Amazon Visa credit card accounts had been fraudulently applied for using their names and social security numbers. After conferring with their colleagues, plaintiffs learned that other optometrists had the same problem and concluded that the NBEO was the likely source of the stolen information. Although the organization initially denied that its databases had been compromised, it subsequently stated it was conducting an investigation and advised the affected individuals to continue monitoring their credit. Plaintiffs alleged various injuries in the wake of the fraudulent credit applications, including an imminent threat of future harm based on the theft of their information, time and money spent initiating credit freezes and/or filing reports with relevant authorities, and, in one case, a temporarily decreased credit score due to the fraudulent card application.
The United States District Court for the District of Maryland dismissed the complaints for lack of subject matter jurisdiction, relying on the Fourth Circuit’s 2017 decision in Beck v. McDonald to find plaintiffs failed to establish Article III standing and, in particular, injury-in-fact. The court emphasized that plaintiffs alleged only speculative, future harms, which were insufficient for purposes of standing, as they had not incurred fraudulent charges, been denied credit, or been required to pay a higher interest rate. Additionally, because the NBEO had not confirmed a data breach and the link between them was speculative, plaintiffs failed to allege their injuries were fairly traceable to the organization.
On a consolidated appeal, the Fourth Circuit vacated the decision. Although Beck held that a mere compromise of personal information, without more, fails to satisfy the injury-in-fact element, the court distinguished that decision from the instant case, as the optometrists here had already suffered actual harm in the form of identity theft and credit card fraud. Additionally, the plaintiffs had incurred costs to mitigate damage and protect their credit — and, while such costs may not suffice for standing when the injury is merely speculative, it was sufficient here because those costs were incurred in response to existing harm. Moreover, the court held that complaints contained sufficient allegations demonstrating the NBEO was the likely source of the breach. Thus, plaintiffs’ allegations sufficed for Article III standing.
In the wake of a circuit split on standing in data breach cases, the plaintiff’s bar may be tempted to select putative class representatives who have experienced identity theft – and are thus more likely to clear Article III’s standing hurdle. But could that decision create problems at class certification? For example, plaintiffs who allege identity theft may not be adequate representatives of a class that includes those who have not suffered identity theft. And a class of identity theft victims only may not be ascertainable, as the defendant may not know which individuals have had their personal data used by thieves to open fraudulent accounts – thus creating the thorny problem of requiring class members to self-identify. Although this case cleared the standing hurdle, it remains to be seen whether it can proceed on a class basis. Stay tuned for more developments.
Hutton v. National Board of Examiners in Optometry, Inc., Nos. 17-1506, 17-1508 (4th Cir. June 12, 2018).
