Facts
- A bank used a third-party vendor to transport backup tapes containing customers’ personal information, including names and Social Security numbers.
- On two occasions, backup tapes were lost during transit.
- The bank notified affected individuals that it did not know whether the data had been accessed or misused.
- The bank offered precautionary services, including 24 months of credit monitoring, identity-theft insurance coverage (reported up to $25,000), and related assistance.
- Plaintiffs did not allege any confirmed identity theft, fraudulent charges, or concrete financial loss tied to the missing tapes.
- Plaintiffs sued on behalf of a putative class, asserting negligence, breach of contract, breach of fiduciary duty, and state consumer-protection violations, based primarily on increased risk of identity theft, emotional distress, and costs/time spent monitoring credit.
Issues
- Whether plaintiffs had Article III standing when they alleged only an increased risk of future identity theft and precautionary or emotional harms without any actual misuse of their data.
- Whether, assuming standing, plaintiffs’ common-law and statutory claims failed because alleged risk-based harms and precautionary expenditures were not legally cognizable damages.
Decision
- The court granted the bank’s motion and dismissed the action.
- The court held plaintiffs lacked Article III standing because the alleged injury was speculative and contingent on future misuse of information.
- Alternatively, the court held that even if standing existed, the claims failed as a matter of law because plaintiffs did not plead compensable damages; precautionary costs and anxiety tied to a speculative risk were insufficient.
Legal Principles
- Article III requires an injury in fact that is concrete and particularized and actual or imminent; an alleged increased risk of identity theft, without actual misuse or tangible loss, is generally too conjectural to confer standing.
- Self-incurred expenditures to guard against a speculative future harm (e.g., credit monitoring undertaken as a precaution) generally do not convert a potential future injury into a present, cognizable injury for standing or damages purposes.
- Claims for negligence, contract, fiduciary duty, and consumer-protection violations commonly require non-speculative injury or loss; absent actual misuse or measurable loss, allegations of risk, fear, and prophylactic measures are insufficient.
Conclusion
The court dismissed a data-loss putative class action where the missing backup tapes had not been shown to cause any actual identity theft or financial loss, holding that speculative risk and related precautionary costs did not establish Article III standing and, in any event, did not constitute compensable damages.