## Facts

- Veterans treated at a VA medical center alleged harm from two separate losses of patient information.
- In 2013, an unencrypted laptop containing personal information for about 7,400 patients was stolen or misplaced.
- In 2014, four boxes of pathology reports containing personal information for over 2,000 patients were stolen or misplaced.
- The information included items such as names, dates of birth, partial Social Security numbers, and other identifiers.
- Plaintiffs alleged increased risk of future identity theft, emotional distress, and time and money spent monitoring accounts and purchasing credit services.
- After discovery and passage of time, plaintiffs could not show misuse of the data, access to the information by a thief, or identity theft traceable to either incident.

## Issues

1. Whether an increased risk of future identity theft from the loss of personal information constitutes an injury in fact that is concrete and imminent for Article III standing.
2. Whether mitigation expenses (credit monitoring and related efforts) create injury in fact when the asserted future harm is speculative.
3. Whether plaintiffs have standing to seek injunctive relief under the APA to compel improved data-security measures based on past data-loss incidents.

## Decision

- The Fourth Circuit affirmed dismissal for lack of Article III standing.
- The alleged risk of future identity theft was too speculative and not sufficiently imminent or substantial.
- Mitigation costs did not independently establish standing because they were incurred in response to a speculative risk.
- Plaintiffs lacked standing for APA injunctive relief because past breaches alone did not show a real and immediate threat of future injury.

## Legal Principles

- Article III requires an injury in fact that is concrete, particularized, and actual or imminent, not conjectural or hypothetical.
- A theory of future harm may support standing only when the threatened injury is certainly impending or presents a substantial risk, not an attenuated chain of possibilities.
- A plaintiff cannot create standing by spending money to mitigate a speculative risk; such expenses are not cognizable injury in fact when the underlying harm is not imminent.
- Standing for injunctive relief requires a real and immediate threat of future injury, not merely exposure to a past wrong.

## Conclusion

Because plaintiffs could not show actual misuse of their information or a non-speculative, imminent likelihood of identity theft, the Fourth Circuit held they lacked standing for Privacy Act damages and APA injunctive relief, and it treated mitigation expenditures as insufficient to supply injury in fact absent a substantial risk of harm.


Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017)