Second Circuit Rules That Risk Of Future Identity Theft Not Enough To Support Standing In Data Breach Class Action

The Second Circuit recently joined a growing number of federal courts to decide when a data breach of personally identifiable information ("PII") is actionable. According to the Second Circuit, plaintiffs do not have standing to bring a lawsuit when there is no allegation their PII was targeted or misused. 

The Second Circuit's decision

To bring a lawsuit in federal court, a plaintiff must have standing. To have standing, the plaintiff must establish, among other things, an "injury in fact." This means an injury that is "concrete and particularized" as well as "actual or imminent." A "conjectural" or "hypothetical" injury is not enough. This distinction is important in data breach cases, where courts are increasingly asked to decide whether a future risk of identity theft is sufficient to maintain claims in federal court.