Standing and Potential Causes of Action in Data Breach Cases

Standing in data breach cases may be impacted or determined by various factors, including especially the types of information stolen, and the action taken after the breach. In Antman v. Uber Technologies, (N.D. Cal. Oct. 19, 2015), the trial court dismissed the plaintiffs' argument that Uber's failure to protect their data was sufficient to confer standing because, among other reasons, they failed to establish Article III standing. Article III standing has three constitutional requirements. The plaintiff must have: suffered some actual or threatened injury; the injury can fairly be traced to the challenged action of the defendant; and, the injury is likely to be redressed by a favorable decision." See, Legal Information Institute, "Constitutional Standards: Injury in Fact, Causation, and Redressability." For example, the court in Antman stated that the plaintiffs had not adequately established injury. But, it suggested the result would have been different had Social Security numbers been stolen (stating that the plaintiff "specifies disclosure only of his name and drivers' license information. It is not plausible that a person could apply for a credit card without a social security number … plaintiff alludes to the disclosure of unspecified 'other personal information; this is insufficient'").

Thus it is critical when attempting to establish standing under Article III in a data breach suit that the type of information stolen places plaintiff in danger of immediate harm (if the harm has not already occurred). Social Security numbers are the kind of information that would bring about such harm, while a name or address alone is not.