Publications

The question of what constitutes standing under Article III of the U.S. Constitution in the context of data breach cases has been a topic of recent debate, both in and out of courtrooms. The Supreme Court in Clapper v. Amnesty International USA—a case that did not address a data breach—clarified that, in order to establish standing, plaintiffs must show that they suffered an injury that is “concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” In the data breach context, courts typically hold that the mere fact that a data breach occurred does not constitute an injury and frequently find that evidence of harm offered by data breach plaintiffs is too attenuated or difficult to quantify to be deemed “actual or imminent” injury. In recently considering the issue, however, the Seventh Circuit held that, under certain circumstances, data breach victims whose data has been stolen but who have not yet experienced any actual injury nevertheless merit Article III standing.