RICHARD G. BECK et al. v. ROBERT A. MCDONALD, in his official capacity as Secretary of Veterans Affairs et al.
US Court of Appeals for the Fourth Circuit, Diaz, Feb. 6, 2017
Standing- No standing for suit by those whose information was lost by VA in data breach
Facts: An unencrypted laptop containing medical records and a number of boxes containing medical records were lost/stolen from the VA. Those whose information was contained therein filed suit.
As the Supreme Court noted in Clapper v. Amnesty International, to establish Article III standing, an injury must be “concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” “[T]hreatened injury must be certainly impending to constitute injury in fact.”
Standing requires:
(1) an injury-in-fact (i.e., a concrete and particularized invasion of a legally protected interest);
(2) causation (i.e., a fairly traceable connection between the alleged injury in fact and the alleged conduct of the defendant); and
(3) redressability (i.e., it is likely and not merely speculative that the plaintiff’s injury will be remedied by the relief plaintiff seeks in bringing suit).
Standing- “emotional upset” and “fear [of] identity theft and financial fraud” resulting from the data breaches are not “adverse effects” sufficient to confer Article III standing.
The Sixth, Seventh, and Ninth Circuits have all recognized, at the pleading stage, that plaintiffs can establish an injury-in-fact based on this threatened injury.
By contrast, the First and Third Circuits have rejected such allegations.
Contrast drawn by the Fourth Circuit: In the 6/7/9 cases, thieves specifically targeted the data.
Here, there was no evidence to suggest that the data was targeted.
On the standard offer of free credit monitoring for a year:
we decline to infer a substantial risk of harm of future identity theft from an organization’s offer to provide free credit monitoring services to affected individuals.
To adopt such a presumption would surely discourage organizations from offering these services to data-breach victims, lest their extension of goodwill render them subject to suit.
Standing – The APA still requires standing in order to file suit. Mere requirement that agency safeguard records does not confer standing automatically.