Second Circuit Ruling Clarifies When Data Breach Plaintiffs Have Adequately Plead Article III Standing

In a thoughtful opinion that diverges from how other circuit courts have addressed the issue, the Second Circuit recently issued a ruling clarifying the circumstances when data breach plaintiffs can rely on fear of identity theft to establish Article III standing.

The case is McMorris v. Carlos Lopez & Associates, LLP (CLA). CLA offers mental and behavioral health services to veterans, service members and their families. An employee at CLA accidentally emailed a spreadsheet containing social security numbers and other sensitive personal information of 130 CLA employees and former employees to CLA staff. Plaintiffs later initiated a class action in the Southern District of New York on behalf of all employees and former employees whose personal information was erroneously emailed, asserting negligence and consumer protection claims. The complaint did not allege that any plaintiffs were the victim of identity theft or that anyone outside of CLA had obtained the