Data Breach Class Actions: Analyzing Standing for Future Injuries-in-Fact (Part 2)

By Brandon C. Meadows, Esq. & Ty Robare, Law Clerk

Businesses regularly store the data of customers and clients, whether through transactions or regular recordkeeping practices. When businesses hold onto this data, they are obligated to protect it from falling into the hands of unauthorized parties. In the digital age, though, the menace of data breaches looms large, often leaving a trail of individuals grappling with the loss or compromise of their personal information. This grim reality has precipitated a cascade of class action lawsuits, as affected parties seek judicial redress.

Yet, the pathway to adjudication begins (and often ends) with the pivotal challenge of establishing standing. Businesses faced with the prospect of class action litigation have a key opportunity at the outset of the case to eliminate the case entirely or drastically reduce their exposure. This article endeavors to help unravel the complex tapestry of constitutional standing in data breach class action litigation and provide a roadmap for navigating its earliest stage.

TransUnion: A Two-Pronged Test for Injury-in-Fact

The Supreme Court’s decision in TransUnion LLC v. Ramirez, 141 S.Ct. 2190 (2021) serves as a pivotal legal precedent on the issue of “standing” under Article III of the Constitution for data breach class action litigation and provides perspective on the treatment of related litigation in Florida state courts. The putative class action in TransUnion arose from claimed violations of the Fair Credit Reporting Act involving the maintenance of allegedly inaccurate consumer credit files.

The Supreme Court emphasized the constitutional requirement that, to have Article III standing, plaintiffs must have suffered a “concrete harm that is particularized to them.” Id. at 2209. According to the Court, unless an inaccurate file was actually disclosed to a third party—thus giving rise to cognizable injury akin to that suffered in a defamation case—its mere existence could not constitute concrete harm sufficient to support jurisdiction. Id. at 2210–11.

In reaching this conclusion, the Court parsed the class of 8,185 individuals into subgroups, finding standing only for those 1,853 individuals whose false information was evidentially provided to third parties. Id. For the remaining individuals who were not the subject of third-party disclosures, the Court ruled they lacked standing as they did not meet the injury-in-fact standard.

In effect, the Court’s decision reduced the putative class by 77%. The impact of such a decision can be immense in any case because it substantially reduces a defendant (or defendants’) aggregate exposure and greatly narrows the class.

The Impact of TransUnion in Putative Data Breach Class Actions

The Circuits Still Lack Harmony in Their Standing Analyses
Since TransUnion, plaintiffs have sought to bypass the impact of the Supreme Court’s decision through pleadings built around recharacterizing the risk of future harm as a concrete, particularized injury. Plaintiffs’ counsel generally takes the approach of anchoring such claims in emotional distress, therapy costs associated with that claimed distress, and mitigation expenses such as time and money spent canceling a credit card or monitoring financial information for potential issues.

For instance, in Clemens v. ExecuPharm Inc., the Third Circuit endorsed the notion that mitigation expenses, emotional distress, and related injuries are permissible harms under Article III. 48 F.4th 146, 158 (3d Cir. 2022). This decision appears to resolve the Third Circuit’s previous issues with Article III standing in the data breach class action context, wherein they rejected similar claims without present harm to anchor the substantial risk of future injury.

The Third Circuit is not alone. District courts in the Second, Sixth, and Ninth Circuit have echoed similar endorsements for a finding of injury-in-fact. See Miller v. Syracuse Univ., No. 5:21-CV-1073, 2023 WL 2572937, at *7 (N.D.N.Y. Mar. 20, 2023); Ortiz v. Perkins & Co., No. 22-cv-03506, 2022 WL 16637993, at *4 (N.D. Cal. Nov. 2, 2022); Bowen v. Paxton Media Grp., LLC, No. 5:21-cv-00143, 2022 WL 4110319, at *5 (W. D. Ky. Sept. 8, 2022).

As the various federal appellate circuits continue to grapple with how to approach Article III standing in data breach class action lawsuits, TransUnion has illuminated the proverbial north star: cases permitting claims of standing based only on highly individualized factors such as claimed emotional distress, therapy costs, or mitigation efforts should not proceed in lieu of evidence establishing a common, class-wide injury.

How Many Class Members Even Need to Demonstrate Standing?

Naturally, because the post-TransUnion litigation environment opens the door to the dismissal of class representatives who fail to allege actual, present harm, many cases are likely to see some (but not all) class representatives fail to allege standing. The TransUnion majority was very careful to note that it was not addressing “the distinct question of whether every class member must demonstrate standing before a court certifies a class.” 141 S.Ct. at 2208 n.4.

The Eleventh Circuit nearly made its position on this issue clear. In a post-TransUnion TCPA case, the Eleventh Circuit decertified a settlement class because the class definition expressly included members did not (and could not) satisfy Article III standing. Drazen v. Pinto, 41 F.4th 1354, 1357–61 (11th Cir. 2022). The court rejected the proposition that plaintiffs with no standing in the Eleventh Circuit could be part of a nationwide class, even if they may have standing in accordance with the precedential holdings of other circuits. Id. at 1358–59.

However, within one year, the Eleventh Circuit granted hearing en banc and vacated the judgment. Drazen v. Pinto, 74 F.4th 1336 (11th Cir. 2023). Notably, the panel opinion did not readdress the issue of whether all class members were required to satisfy Article III standing at the time of class certification. See Id. at 1342–43.

Accordingly, TransUnion represents, at the very least, a line in the sand for a demonstration of injury-in-fact. Without a present harm to anchor the substantial likelihood of future injury, the class action cannot, and likely will not, proceed.

Crucially, this overview of standing in data breach class actions does not begin to cover all the laws implicated by this issue or the factors that may compel the application of such laws.

If you find yourself facing the prospect of a class action lawsuit and want to understand your case, the merits of your claim or defense, potential monetary awards, or the amount of exposure you face, you should speak with a qualified Jimerson Birr lawyer. Our experienced team of attorneys is here to help. Call Jimerson Birr at (904) 389-0050 or use the contact form to set up a consultation.

Related blogs:

Data Breach Class Actions: Analyzing Standing for Future Injuries-in-Fact (Part 1)