Citing a trend in data security breach litigation, the U.S. District Court for the District of Connecticut recently found that the fear of identity theft suffices to confer Article III standing on plaintiffs seeking civil damages in the Second Circuit. Such fear will not, however, sustain negligence claims or claims made under state tort laws absent an allegation of actual harm. Although the court in McLoughlin v. People’s United Bank Inc. found for the plaintiffs on the issue of subject matter jurisdiction, it ultimately granted the defendants’ motion to dismiss for failure to state a claim.
In May 2008, the class action plaintiffs in McLoughlin filed a suit seeking damages as the result of a February 2008 incident in which unencrypted back-up tapes containing banking and other personal information of People’s United Bank customers went missing from a third-party vendor’s unattended truck. The complaint included allegations of negligence, breach of fiduciary duty and a violation of Connecticut’s Unfair Trade Practices Act (“CUPTA”). Plaintiffs claimed that the loss of the tapes increased their risk of identity theft, but did not allege any actual financial losses.
The court rejected defendants’ argument that the plaintiffs lacked standing to bring the suit, but granted the motion to dismiss because there was no allegation of actual identity theft or other quantifiable harm. The court also stated that the public policy argument for permitting private litigation of CUPTA violations was undercut by the fact that Connecticut’s Attorney General had already taken action in the matter and had reached a settlement with the defendants.