The Supreme Court recently declined to review the Ninth Circuit’s decision in Zappos.com, Inc. v. Stevens, a class action suit resulting from a 2012 data breach of the online retailer. As a result, there remains a split in the courts as to whether a breach of data confers Article III standing on potential plaintiffs, even if no actual injury occurred.

The Ninth Circuit, District of Columbia, Third, Sixth, Seventh, and Eleventh Circuits have all found that plaintiffs who allege fear of future identity theft or fraudulent charges in the wake of a data breach have, in fact, satisfied the injury-in-fact requirement for standing under Article III. Conversely, the First, Second, Fourth, and Eighth circuits have adopted a different reasoning: namely, that fear of future harm is too speculative to meet Article III’s standing requirements as previously interpreted by the Supreme Court (e.g., Clapper v. Amnesty International USA, 568 U.S. 398, 409 (2013)) (standing under Article III requires that any alleged “future harm” be “certainly impending” and that “allegations of possible future injury are not sufficient”).

Drinker Biddle’s Class Action Litigators examine the potential implications for businesses in this Client Alert.

The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.