Two cases from the Eighth Circuit Court of Appeals found allegation of a present injury-in-fact is required to establish standing in data breach lawsuits.

Decided on August 1, 2017, In re: SuperValue, Inc., Customer Data Security Breach Litigation involved a data breach where hackers installed software on SuperValue’s network to gain access to credit and debit card information. Plaintiffs, customers from various states affected by the breach, filed suit alleging violations of state consumer protection statutes, violations of state data breach notification statutes, negligence, breach of implied contract, negligence per se, and unjust enrichment.

The district court granted SuperValue’s motion to dismiss, finding that none of the plaintiffs had alleged an injury-in-fact and therefore did not have standing. The Eight Circuit Court of Appeals agreed, finding the plaintiffs failed to allege a substantial risk of future identify theft, and efforts to mitigate their risk (time spent reviewing information about the breach and monitoring their account information) did not create an injury.

However, the appellate court did find the district court erred in holding that one of the named plaintiff’s standing was dependent on the standing of other named plaintiffs and unnamed class members. The plaintiff’s allegation of misuse of his card information was sufficient to demonstrate he had standing and that was all that was required for the court to have subject matter jurisdiction over the action. The court concluded that because the complaint contained sufficient allegations to demonstrate one of the plaintiffs suffered an injury in fact, fairly traceable to the defendants’ security practices, and likely to be redressed by a favorable judgment, the named plaintiff had standing under Article III’s case or controversy requirement.

Decided several weeks later on August 21, 2017, Kuhns v. Scottrade, Inc., No. 16-3426, — F.3d —, 2017 WL 3584046, also involved a security breach, this time at Scottrade, a securities brokerage firm. Plaintiff Kuhns and other customers affected by the data breach brought a putative class action against Scottrade asserting claims of breach of contract, breach of implied contract, unjust enrichment, declaratory judgment, and violation of state consumer protection statutes.

The district court found the plaintiff lacked standing because he had not suffered an injury in fact and dismissed the matter for lack of subject matter jurisdiction with prejudice. While the Eight Circuit Court of Appeals ultimately affirmed the dismissal because the plaintiff failed to state a claim, the court also held that the plaintiff had standing regarding the breach of contract and contract-related claims based on allegations the full benefit of bargain was not received. The appellate court examined whether the plaintiff suffered an injury in fact, that is fairly traceable to the challenged conduct of the defendant, and that is likely to be redressed by a favorable judicial decision. The court found that a party to a breached contract has a judicially cognizable interest for standing purposes, regardless of the merits of the breach alleged.

Looking at these cases together, it appears the bar for establishing standing in data breach cases in the Eight Circuit is met when there is an allegation of a present injury in fact, not a future injury, that is fairly traceable to the defendant’s conduct, and likely to be redressed by a favorable judgment. Here, the allegation of misuse of card information and not receiving the value of a contract (Scotttrade allegedly misrepresented its promise to provide security) were sufficient to establish standing.

Other circuits (including the D.C. and Seventh Circuit) have recently held that the bar to establish standing at the pleading stage is met when plaintiffs assert there is a substantial risk that their personal information could be misused, even if it has not happened yet. This current circuit split will undoubtedly reach the Supreme Court for resolution, however, in the interim, plaintiffs in data breach matters will be looking to file in more favorable jurisdictions while defendants in the Eighth Circuit will have a powerful tool for dismissal.