Class action lawsuits present numerous challenges for both defendants and harmed parties. The costs of such lawsuits and the situations in which lead plaintiffs bring them often mean the only ones that benefit from them are the attorneys on both sides of the aisle. While legislators seek to remedy some aspects of class litigation, these suits continue to expand. Recently, they have expanded into the area of cyber crimes and data breach litigation.
Both the Seventh Circuit (which covers Illinois) and Ninth Circuit (which covers California) have issued opinions early in 2018 addressing class action litigation in the aftermath of major data breaches. The cases are Dieffenbach v. Barnes and Nobles and In re Zappos.com Inc. Data Security Breach Litigation, respectively. These opinions address issues of standing and the ability show damages as part of the preliminary aspects of their respective cases. Both data breaches occurred in 2012 with the lawsuits being filed in the same year, highlighting how slow and expensive such litigation can be, and how it can drain a company’s financial resources in defending itself.
Standing and the ability to prove damages are related but different issues within a legal context. Standing relates to a plaintiff’s ability to bring a lawsuit and hinges on a determination that the plaintiff has suffered an injury. In fact, a phrase meaning that the injury is concrete, not hypothetical, traceable to the defendant, and capable of being redressed by winning the lawsuit.
Defendants in both the Ninth and Seventh Circuits had challenged that victims of a data breach could not prove standing because their injuries were either speculative, hypothetical, or non-existent. Both Courts rejected this reasoning, though on different grounds. The Seventh Circuit has held that the time and money lost by plaintiffs in protecting themselves against future identity theft constituted injury in fact. The Ninth Circuit held that the risk of future identify theft in the near future constituted injury in fact.
The Seventh Circuit case moved on to address the damages element of the claim. Relying on the federal rules of civil procedure, the Court held that plaintiffs were not required to allege with specificity the nature of the damages suffered. It was sufficient for state law to provide for compensable damages to the plaintiffs if they prevailed for the plaintiffs to overcome a motion to dismiss on these grounds.
At the same time, both courts foresaw significant difficulties for the plaintiffs in proving their case at trial while lamenting the length of litigation each had taken. Neither class has been certified by their respective court, even after over five years of continuing litigation and mounting legal bills. As data breaches continue to grow in size and in economic damages, such litigation poses a significant threat to any company storing significant amounts of personally identifiable information. Charlie E. Bernier Principal Consultant and Cyber Insurance Expert at ECBM warns, "Companies need to take all reasonable actions to protect themselves from cyber breaches and the losses they can cause, including litigation and defense costs."