## Facts

- Horizon Healthcare Services, Inc., a health insurer, collected and stored members’ personally identifiable information and protected health information, including names, addresses, dates of birth, Social Security numbers, and medical information.
- Plaintiffs alleged Horizon functioned as a “consumer reporting agency” and was subject to the Fair Credit Reporting Act (FCRA).
- In November 2013, two Horizon laptops containing unencrypted member data were stolen, affecting the named plaintiffs and more than 800,000 others.
- The stolen data allegedly included varying combinations of personal and health information, up to and including Social Security numbers and certain health information.
- Plaintiffs alleged Horizon failed to secure the data (including by not encrypting it), failed to restrict access to the devices, and failed to follow privacy representations.
- One plaintiff alleged a fraudulent tax return was filed in his name after the breach, causing time and out-of-pocket costs to address the problem.

## Issues

1. Whether alleged unauthorized access to and potential disclosure of personal information, pled as violations of the FCRA, constitutes a concrete injury for Article III standing absent allegations of actual misuse of the data.
2. Whether the district court erred in dismissing the action under Rule 12(b)(1) for lack of subject-matter jurisdiction based on an asserted absence of injury in fact.

## Decision

- The Third Circuit vacated the district court’s dismissal for lack of Article III standing and remanded.
- The court held that alleged FCRA violations based on unauthorized access to and disclosure of personal information constitute a concrete injury sufficient for Article III standing.
- The court rejected a requirement that plaintiffs plead actual identity theft, financial loss, or other downstream misuse to establish standing.
- Because the alleged statutory privacy violations were themselves a concrete injury, all named plaintiffs had standing, regardless of individualized allegations of misuse.

## Legal Principles

- Article III standing requires an injury in fact that is concrete and particularized, causation, and redressability.
- A statutory violation may supply a concrete injury when Congress has identified and provided a remedy for an intangible harm that closely relates to harms traditionally actionable, including privacy and wrongful disclosure of personal information.
- Courts must distinguish “bare procedural” statutory violations from violations that implicate the substantive interests the statute protects; unauthorized dissemination of personal information is not merely procedural.
- In the FCRA context, unauthorized access to and disclosure of covered personal information may itself be a de facto injury, even without proof of subsequent misuse.

## Conclusion

The Third Circuit held that plaintiffs alleging unauthorized access to and disclosure of personal information in violation of the FCRA pled a concrete injury for Article III standing, vacated the jurisdictional dismissal, and remanded for further proceedings.


In re Horizon Healthcare Servs., Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017)