Federal Court Dismisses Data Breach Litigation

Recently, a federal court in Kansas joined a number of other courts in finding that allegations of future, speculative harm unadorned with actual theft or misuse of personal information are insufficient to establish Article III standing. 

In Ex rel Situated v. Med-Data Inc., Case No. 21-2301-DDC-GEB, 2022 U.S. Dist. LEXIS 60555 (D. Kan. Mar. 31, 2022), Plaintiff C.C. ("Plaintiff") filed a class action lawsuit against Defendant Med-Data ("Med-Data"), a health care provider, arising out of a data event in which Plaintiff's and tens of thousands of others' patient protected health information ("PHI") and personally identifiable information ("PII") was disclosed. Plaintiff was a patient of one of Med-Data's "business associates" and provided her PII and PHI to Med-Data as a result. On or around March 31, 2021, Plaintiff received a notice of the data event, notifying her that her PII and PHI were "uploaded to a public facing website" and the data "was stolen,