Dual Decisions Provide Narrow Path For Plaintiffs To Establish Standing In Data Breach And Cybersecurity Suits

Last week, decisions by the United States Supreme Court and the Northern District of Georgia provided further guidance regarding the narrow path required for a class action plaintiff to successfully establish Article III standing in a data breach claim brought in federal court. In Spokeo, Inc. v. Robins, the Supreme Court found that an online search engine's failure to accurately collect and report an individual's personal information was insufficient to establish standing, holding that a mere technical violation of a consumer protection statute without any further alleged harm to the plaintiff failed to constitute an injury that was both "concrete and particularized" and "actual or imminent."¹ Going forward, savvy defendants no doubt will argue that this standard applies to data breach and cybersecurity actions where only speculative—but not actual—economic or other harm is shown by plaintiffs. However, the Northern District of Georgia in In re Home Depot found that