Second Circuit Clarifies That Fear of Identity Theft is Enough Harm to Bring Suit
May 20, 2021
In an April opinion, the U.S. Court of Appeals for the Second Circuit clarified when data breach plaintiffs can rely on fear of identity theft to establish Article III standing.
The case McMorris v. Carlos Lopez & Associates, LLP involved the inadvertent disclosure of personal data by an employee of Carlos Lopez & Associates.
The defendant offers mental and behavioral health services to veterans, service members and their families. At issue is an incident where an employee of Carlos Lopez accidentally emailed a spreadsheet containing Social Security numbers and other sensitive personal information of 130 current and former employees to other staff. The employees later brought a class action in the Southern District of New York on behalf of all employees and former employees whose personal information was erroneously emailed. The suit alleged negligence and violations of state consumer protection statutes.
Notably, the complaint did not allege that any plaintiffs were the victim of identity theft or that anyone outside the company had obtained the spreadsheet. Instead, the allegations centered on the “imminent risk of suffering identity theft” as the plaintiffs cancelled credit cards and purchased credit monitoring.
Originally, the Southern District dismissed the complaint on grounds the plaintiff had not asserted an injury sufficient to establish Article III standing. On appeal, the Second Circuit reversed holding that fear of identity theft can be sufficient, but held that the plaintiffs hadn’t established a substantial risk of identity theft in this particular case.
In the opinion, the court set out three factors to consider when determining if fear of identity theft rises to a level to provide standing for a lawsuit:
- whether the plaintiff’s data was exposed
- whether other consumers’ data that was also exposed has been misused
- whether the data is sensitive and of a type likely to be misused.
At the same time, the court found that paying out of pocket expenses to guard against identify theft does not automatically create standing.
While other circuits also have held that a substantial risk of identity theft is sufficient for standing, no other circuit has developed a set of analytical factors. McMorris is likely to get cited as more cases of incidental exposure of personal information occur.
Contact ALTA at 202-296-3671 or communications@alta.org.