It well known that there are, unfortunately, many data breaches
that frequently put private citizens' data privacy in
jeopardy. States have passed a variety of statutes aimed at
addressing this problem in an attempt to provide data breach
victims with some form of redress. Nonetheless, even where
there has been a data breach, a plaintiff must meet certain
requirements in order to have standing to bring a lawsuit in an
Article III court. One such requirement, as the case
described below illustrates, is that a plaintiff must have
sufficiently pleaded injury-in-fact in his or her complaint.
According to the putative class action he brought against the
well-known department store chain Macy's in Massachusetts,
Robert Hartigan (“Hartigan”) purchased products on
Macy's website using his VISA credit card on October 10,
2019. See Hartigan v. Macy's Inc., Case
No. 1:20-cv-10551-PBS, Dkt, No. 35 (D. Mass. Nov. 5, 2020).
In so doing, Hartigan provided his home address,
