Guest Blogger: Violetta Abinaked, Summer Associate
As noted in Dittman et al. v. The University of Pittsburgh Medical Center, Case No. GD-14-003285, previously reported on here, Pennsylvania has firmly adopted the approach that the Risk of Harm is Not Enough in Data Breach Actions. Still, data breaches have become some of the most noteworthy headlines in recent news. An increase in litigation has brought with it efforts to shrink the case load through the Article III requirement of standing. This means that courts are finding that the plaintiffs have not sufficiently established a concrete injury in order to seek remedies from the court. One of the main issues with data breaches is that once the data has been extracted or accessed, it is not necessarily always true that tangible harm will follow. Due to that nature, the Third Circuit established that when it comes to data breach actions, simply the risk of future harm does not suffice to save the claim. The seminal case of Reilly v. Ceridian Corp. held that where no actual misuse is alleged, "allegations of hypothetical, future injury do not establish standing under Article III." 664 F. 3d 38 at 41 (3rd Circuit 2011).
The courts are making it tougher to carry out a data breach claim if the plaintiff can't show actual or certainly impending misuse of the information. Reilly's narrow definition of standing is leading the courts' decisions in dismissing cases. A defendant will likely have a higher chance of getting a dismissal in a data breach action if the plaintiff is not able to provide any actual misuse of the information—at least in the Third Circuit. As a company which may be at risk for a data breach, this heightened need for tangible damage from the plaintiff may be a saving grace if future litigation arises.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
