Recent Decision Highlights Viability of Factual Challenges to Standing in Data Breach Cases

Private civil actions against companies that have suffered data security breaches raise a panoply of issues, but none more prevalent or decisive than those relating to injury and damages. This is because most plaintiffs in data security actions have not experienced any actual loss resulting from the breach, but instead premise their claims on alternative theories of injury, such as the risk of harm. Judicial decisions addressing data security claims have placed clear limitations on the types of injuries the law will remedy. One of those limits derives from the principle of standing, which asks whether plaintiff is the proper litigant to raise the breached company's alleged legal violations with the court. To have standing, a plaintiff must face an actual or sufficiently imminent future injury from the breach.