In the wake of the Supreme Court’s TransUnion decision, courts have grappled with the question of when, if ever, victims of a data breach have suffered a sufficient injury-in-fact to meet Article III standing requirements.
In a decision last week, Holmes v. Elephant Insurance, the Fourth Circuit held that some, but not all, of the plaintiffs in a class action based on a data breach of a an insurance-selling website. Applying TransUnion, the court held that the relevant inquiry was whether the harms at issue resembled those recognized by a common-law tort–not whether the allegations resembled the elements of a common-law tort more generally. Under this framework, the court held that those plaintiffs whose drivers’ license numbers were listed on the dark web had standing, as that harm had a close relationship to a harm recognized at common law–the tort of public disclosure of private information–even if the plaintiffs would not have had a claim under that tort. The court held though that the plaintiffs whose numbers were obtained by hackers but not posted on the dark web did not suffer a sufficient injury. It also rejected arguments based on future likelihood of misuse of the plaintiffs data as speculative, and that emotional distress and “mitigation time” could not provide independent bases for standing.
