Second Circuit Clarifies Standard for Article III Standing In Data Breach Actions: Court Adopts Factors to Evaluate Whether an Increased Risk of Future Harm Resulting From a Data Breach Confers Standing

Sullivan & Cromwell LLP - April 30, 2021

In McMorris, the United States Court of Appeals for the Second Circuit dismissed a data breach class action for failure to establish Article III standing, but found, for the first time, that standing may be based on an increased risk of identity theft or fraud following the unauthorized disclosure of personal data. The Second Circuit identified factors related to the nature of the data and its exposure or misuse that district courts should consider in determining whether an increased risk has, in fact, been adequately alleged or established, and made clear that “a speculative chain of possibilities” of harm alone will fail to confer standing on plaintiffs. The decision is consistent with that of the eight other circuit courts to have specifically considered this issue.

Subscribe to our Memos