Full text of the court decision
A federal district court in California has dismissed, for lack of standing, a class action lawsuit against Health Net of California, Inc. and IBM over the loss of nine Health Net server drives that had been used to store personal and medical information. Whitaker v. Health Net of California, 2012 WL 174961 (E.D. Cal. 2012). This case presents another example of the importance of reviewing one of the most basic elements of a case — standing, even in the context of a class action complaint.
The facts underlying Whitaker were these: IBM managed Health Net's information technology infrastructure and had access to Health Net members' information during the alleged class period. On January 21, 2011, IBM informed Health Net that it had lost nine Health Net server drives consisting of more than 800,000 California residents' personal and medical information, including the personal and medical information of the putative class members.
The class action complaint alleged violation of the Confidentiality of Medical Information Act (CMIA) against both Health Net and IBM, and violation of the Customer Records Act (CRA) by Health Net.
IBM moved to dismiss the complaint for lack of standing on the ground that the plaintiffs did not assert they suffered any injury. In response, the plaintiffs argued they did have standing because of the threat posed by the loss of their information.
Agreeing with IBM, the court concluded that because “the threat plaintiffs allege is wholly conjectural and hypothetical; plaintiffs lack standing to bring these claims.” Analyzing other “missing data” cases in the Ninth Circuit, the court drew a distinction between a case involving the “theft of information” and a case involving data that was lost. Where data is merely lost and not stolen, the court suggested that the threat of identity theft or other harm was not as great.
Regardless, the court noted that in this case, “plaintiffs do not explain how the loss here has actually harmed them or threatens to harm them, or that third parties have accessed their data.” Id. The risk that the data might be stolen at some point in the future was not enough to create an injury for purposes of standing. Indeed, the only allegation of “particularized, real and immediate harm alleged” was a letter allegedly received by one of the named plaintiffs’ minor daughters (who was not herself a named plaintiff) informing them the daughter's Social Security Number has been misused. This allegation, that a named plaintiffs’ family member suffered a possible injury, was not enough.
The court held: “That a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that the injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Id. Because the threat plaintiffs alleged was “wholly conjectural and hypothetical,” the plaintiffs lacked standing to bring their claims.
In line with other “no-harm” class actions we have discussed in past articles, Whitaker emphasizes that even in the class action context, the named plaintiffs must actually allege that they suffered some injury. It is not enough that one of the unnamed class members was injured or that the named plaintiffs’ unnamed family member was injured. The named plaintiff must himself actually suffer an injury and that injury cannot be hypothetical.
