Supreme Court Declines To Address Circuit Split On Data Breach Standing Issue

A circuit split on whether actual misuse of personal data is required to have standing to assert data breach claims remains unresolved. Last week the Supreme Court rejected a petition to review that issue in CareFirst v. Attias. In CareFirst, the D.C. Circuit joined several other circuits in holding that the threat of misuse of data, in and of itself, gives rise to standing. Other circuits require more concrete harm in the form of actual misuse of data. Until the Supreme Court settles the issue, companies will remain susceptible to data breach lawsuits in jurisdictions adhering to the liberal standard endorsed in CareFirst.

In CareFirst, the defendant CareFirst initially succeeded in obtaining dismissal of the data breach claims on standing grounds. CareFirst argued that plaintiffs had alleged no injury beyond the statutory violations purportedly arising from the breach. In fact, three years later, none of the plaintiffs had suffered any concrete harm resulting from