Fourth Circuit Holds Plaintiffs Who Allege Identity Theft Have Standing To Sue Post-Data Breach, But What Does It Mean For Certification?

Carlton Fields
Contact

The Fourth Circuit’s 2017 decision in Beck v. McDonald held that the mere fear of identity theft in the wake of a data breach was insufficient to confer Article III standing. Plaintiffs must do more. But how much more? The Fourth Circuit’s latest holding clarifies that plaintiffs who allege that credit cards have been fraudulently applied for – and in some cases issued – using their nonpublic personal information satisfy Article III’s requirements.

Optometrists brought two putative class actions against the National Board of Examiners in Optometry (NBEO) after an alleged breach of the NBEO database compromised their personal information. The plaintiffs discovered the breach in 2016 when they learned that Chase Amazon Visa credit card accounts had been fraudulently applied for using their names and social security numbers. After conferring with their colleagues, plaintiffs learned that other optometrists had the same problem and concluded that the NBEO was the likely source of the stolen information. Although the organization initially denied that its databases had been compromised, it subsequently stated it was conducting an investigation and advised the affected individuals to continue monitoring their credit. Plaintiffs alleged various injuries in the wake of the fraudulent credit applications, including an imminent threat of future harm based on the theft of their information, time and money spent initiating credit freezes and/or filing reports with relevant authorities, and, in one case, a temporarily decreased credit score due to the fraudulent card application.

The United States District Court for the District of Maryland dismissed the complaints for lack of subject matter jurisdiction, relying on the Fourth Circuit’s 2017 decision in Beck v. McDonald to find plaintiffs failed to establish Article III standing and, in particular, injury-in-fact. The court emphasized that plaintiffs alleged only speculative, future harms, which were insufficient for purposes of standing, as they had not incurred fraudulent charges, been denied credit, or been required to pay a higher interest rate. Additionally, because the NBEO had not confirmed a data breach and the link between them was speculative, plaintiffs failed to allege their injuries were fairly traceable to the organization.

On a consolidated appeal, the Fourth Circuit vacated the decision. Although Beck held that a mere compromise of personal information, without more, fails to satisfy the injury-in-fact element, the court distinguished that decision from the instant case, as the optometrists here had already suffered actual harm in the form of identity theft and credit card fraud. Additionally, the plaintiffs had incurred costs to mitigate damage and protect their credit — and, while such costs may not suffice for standing when the injury is merely speculative, it was sufficient here because those costs were incurred in response to existing harm. Moreover, the court held that complaints contained sufficient allegations demonstrating the NBEO was the likely source of the breach. Thus, plaintiffs’ allegations sufficed for Article III standing.

In the wake of a circuit split on standing in data breach cases, the plaintiff’s bar may be tempted to select putative class representatives who have experienced identity theft – and are thus more likely to clear Article III’s standing hurdle. But could that decision create problems at class certification? For example, plaintiffs who allege identity theft may not be adequate representatives of a class that includes those who have not suffered identity theft. And a class of identity theft victims only may not be ascertainable, as the defendant may not know which individuals have had their personal data used by thieves to open fraudulent accounts – thus creating the thorny problem of requiring class members to self-identify. Although this case cleared the standing hurdle, it remains to be seen whether it can proceed on a class basis. Stay tuned for more developments.

Hutton v. National Board of Examiners in Optometry, Inc., Nos. 17-1506, 17-1508 (4th Cir. June 12, 2018).

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Attorney Advertising.

© Carlton Fields

Written by:

Carlton Fields
Contact
more
less

PUBLISH YOUR CONTENT ON JD SUPRA NOW

  • Increased visibility
  • Actionable analytics
  • Ongoing guidance

Carlton Fields on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide