Supreme Court’s Clapper Decision Raises Bar For Standing In Data Security Breach Litigation

On February 26, 2013, the United States Supreme Court in Clapper v. Amnesty International adopted a demanding standard for Article III standing in privacy cases. Although the case addressed issues of Constitutional privacy, the decision also will likely assist companies that have suffered data security breaches in obtaining dismissal of ensuing lawsuits by consumers claiming that their data was compromised in the breach. The Court held that in order to satisfy Article III's standing requirement based on a threat of future harm, a plaintiff must show that the threatened injury is "certainly impending." This holding has broad implications for data security breach litigation, where consumers often cannot plead, much less show, that any exposure of their data in the breach has resulted or will imminently result in criminals committing identity theft or otherwise causing them financial injury.