Return to the list of client alerts
For lawsuits filed in Federal Court as a result of a data breach, companies that have been breached have used the requirement of Article III of the US Constitution of “an injury-in-fact’. This is based on a recent Supreme Court decision known as Spokeo. The Supremes said that the “injury” must be present or “certainly impending”, but it must be concrete and particularized. This means that just being afraid that you will be the victim of identity theft is not enough. This is the reason why companies that are breached are so quick to give you your money back. No loss of money means, they think, no concrete injury. That is also why the credit card companies block your card when they think they see fraud and issue you a new one. Again, trying to get to no concrete injury.
In a lawsuit brought against Saks as a result of the breach that they had, the consumers’ lawyers said that the time and money the customers spent responding the the breach was the injury in fact. One consumer had to drive 90 minutes to the bank to get a new credit card and that cost $5 in gas.
In other cases, the time spent talking to the police counted and in another case, the time spent changing automatic payments counted.
What is becoming very clear, and this is not good news for businesses that have breaches, is that many courts are getting tired of all of these breaches and are putting companies on notice to deal with them by saying that a $5 loss is sufficient for Article III standing.
While it is possible that the Supremes will come back and revisit Spokeo, I don’t think that will happen any time soon.
That means that for businesses that suffer a breach, they should not assume that they will be able to get class action lawsuits easily dismissed. Therefore businesses need to spend more resources on avoiding those breaches in the first place.
Source: The law firm of Ballard Spahr.