No Injury? No Problem: Mere Risk Of Identity Theft Can Establish Standing

Standing requirements have forced many a data breach action to stand down. Can a plaintiff have a claim (and on behalf of a massive class) when plaintiff hasn't suffered any harm? For those polling the Circuits, the Ninth Circuit votes "yes." And because no good deed goes unpunished, the Court interpreted defendant's helpful advice to consumers as an "acknowledgment" of the harm.

For years, district courts in the Ninth Circuit have debated whether the mere risk of future identity theft originating from a data breach constitutes an injury sufficient to confer Article III standing following the United States Supreme Court's decision in Clapper v. Amnesty Int'l USA, 133 S.Ct. 1138 (2013). On March 8, 2018, in In re Zappos.com, Inc., Customer Data Security Breach Litig., Case No. 16-16860 (9th Cir. 2018), the Ninth Circuit concluded that it did. The Court found that, notwithstanding the Supreme Court's decision in Clapper, its prior decision in Krottner v. Starbucks,