Are DC Federal Courts The Next Hotbed For Data Breach Class Actions?

We have previously reported on the evolving circuit split over standing in data breach class actions. On August 1^st, a three judge panel for the District of Columbia Circuit became the latest to weigh in on the issue. In Attias v. CareFirst, the DC Circuit panel joined the Sixth, Seventh, and Ninth Circuits in finding that fear of future identity theft in the wake of a data breach satisfied the injury in fact requirement for standing under Article III of the United States Constitution. Reversing the lower court, the panel described plaintiffs' burden to establish standing at the pleading stage as a "low bar," and criticized the lower court for adopting an "unduly narrow reading" of plaintiffs' complaint. Citing the Supreme Court's decision on standing in Susan B. Anthony List v. Driehaus, the panel stated that plaintiffs need only allege a "substantial risk" of identity theft as a result of a data breach; the panel found this requirement met where the personal