Takeaway: The Eleventh Circuit has yet to
address whether a future risk of identity theft is sufficient to
establish standing in a data breach case. In Muransky v. Godiva
Chocolatier, Inc., 16-16486, 2020 WL 6305084, at *12 (11th
Cir. Oct. 28, 2020), the en banc Eleventh Circuit held that the
plaintiff failed plausibly to allege that a risk of future identity
theft flowing from a violation of the Fair and Accurate Credit
Transactions Act (FACTA) constituted a material risk of harm
sufficient to establish Article III standing. Although
Muransky is not a data breach case, it could be bad news
for data breach plaintiffs. Muransky suggests that the
Eleventh Circuit will carefully scrutinize future injury
allegations and require data breach plaintiffs to satisfy a
relatively high bar to establish standing.
