Publications
Article

Fourth Circuit Sets Middle-of-the-Road Threshold for Establishing Article III Standing in Data Breach Class Action Litigation

Pratt’s Privacy & Cybersecurity Law Report

Today, a clear divergence of opinions exists among the federal courts of appeal as to the appropriate evidentiary threshold that must be met for establishing Article III standing, which varies significantly among the different appellate circuits. The author of this article discusses a U.S. Court of Appeals for the Fourth Circuit decision on the issue.

Adidas. Saks Fifth Avenue. Macy’s. Aside from being some of the world’s largest corporate entities, these companies are just a few of the more noteworthy businesses that have fallen victim to data breach incidents in 2018. At the same time that data breaches continue to increase in both frequency and severity, so too are lawsuits filed by those individuals whose data has been compromised as a result of these breaches. Today, a clear divergence of opinions exists among the federal courts of appeal as to the appropriate evidentiary threshold that must be met for establishing Article III standing, which varies significantly among the different appellate circuits. In Hutton v. National Board of Examiners in Optometry, Inc., the U.S. Court of Appeals for the Fourth Circuit just recently weighed in on this hot-button issue, holding that the theft of individuals’ personal identifying information (‘‘PII’’), combined with actual misuse of that PII, is sufficient to constitute a cognizable ‘‘injury-in-fact’’ for purposes of Article III standing, even where such misuse does not result in any pecuniary loss. In doing so, the Hutton court has paved a middle-of-the-road approach to the injury-in-fact prong of the standing analysis, further deepening the divide among federal circuit courts regarding the level of proof that is required to establish Article III standing in the context of data breach class action litigation.

To read the full article, please click here.

“Fourth Circuit Sets Middle-of-the-Road Threshold for Establishing Article III Standing in Data Breach Class Action Litigation,” by David J. Oberly was published in the May 2019 edition of Pratt’s Privacy & Cybersecurity Law Report (Vol. 5, No. 4), an A.S. Pratt Publication, LexisNexis. Reprinted with permission.