## Facts

- A federal agency maintained databases containing sensitive personal information of federal employees, applicants, and family members, including Social Security numbers, addresses, birth dates, fingerprints, and background-investigation data.
- The agency provided a private contractor access credentials to agency systems to conduct background investigations.
- For years before the breaches, the agency’s Inspector General reported major network security deficiencies and urged corrective action, including possible shutdown of insecure systems.
- In 2014, attackers used stolen contractor credentials to access the agency’s systems and exfiltrate personal information affecting more than 21 million individuals.
- Plaintiffs alleged harms including fraudulent accounts and tax filings, unauthorized purchases, and costs incurred for credit monitoring and other mitigation steps.
- Plaintiffs brought statutory claims under the Privacy Act against the agency and related claims against the contractor; union-affiliated plaintiffs also alleged a constitutional informational-privacy violation based on failure to secure data.
- The district court dismissed largely for lack of Article III standing and, as to the constitutional claims, for failure to state a cognizable constitutional violation.

## Issues

1. Whether allegations of substantial risk of identity theft, mitigation expenses, and some instances of misuse constitute an injury in fact for Article III standing in a large-scale data breach.
2. Whether alleged harms were plausibly traceable to defendants’ conduct, including alleged security failures and compromised contractor credentials.
3. Whether plaintiffs plausibly alleged “intentional or willful” conduct under the Privacy Act sufficient to support damages and the statute’s waiver of sovereign immunity.
4. Whether a government contractor was entitled to derivative sovereign immunity at the pleading stage for alleged security failures.
5. Assuming a constitutional right to informational privacy exists, whether failure to protect stored personal data from third-party hackers states a constitutional violation.

## Decision

- Affirmed in part, reversed in part, and remanded.
- Held plaintiffs plausibly alleged Article III standing for at least some claims based on a substantial risk of identity theft, mitigation costs tied to that risk, and alleged misuse affecting some individuals.
- Held the Privacy Act damages claims against the agency were plausibly pled; allegations of knowing inaction in the face of repeated security warnings satisfied the “intentional or willful” pleading threshold and triggered the statutory waiver of sovereign immunity.
- Held the contractor was not entitled to derivative sovereign immunity at the motion-to-dismiss stage because it did not show the challenged conduct was specifically directed by the government and the complaint alleged violations of security obligations incorporated into its contract.
- Affirmed dismissal of the union plaintiffs’ constitutional informational-privacy claims; even assuming such a right, the alleged failure to secure data from hackers did not fit recognized constitutional theories focused on compelled disclosure or governmental release/misuse.

## Legal Principles

- A substantial and imminent risk of identity theft from a targeted exfiltration of highly sensitive personal information can constitute an injury in fact; reasonable mitigation costs may support standing when fairly attributable to that risk.
- Traceability is plausibly alleged where the complaint links a breach to known security deficiencies, ignored warnings, and the alleged attack vector (including compromised credentials) tied to defendants’ conduct.
- For Privacy Act damages, allegations that an agency knowingly refused to implement adequate safeguards despite repeated, detailed warnings can satisfy the “intentional or willful” standard at the pleading stage and invoke the Act’s waiver of sovereign immunity.
- Derivative sovereign immunity for contractors is not available where the contractor fails to show its challenged conduct was specifically directed by the government and the complaint plausibly alleges conduct outside contractual or statutory security obligations.
- Even if a constitutional right to informational privacy is assumed, negligent or reckless failure to prevent third-party intrusion into stored government records, without purposeful governmental disclosure or compelled disclosure, does not necessarily state a constitutional violation.

## Conclusion

The D.C. Circuit allowed key data-breach claims to proceed by recognizing plausible standing based on substantial identity-theft risk and related mitigation costs, permitted Privacy Act damages claims against the government based on alleged knowing security failures, rejected derivative sovereign immunity for the contractor at the pleading stage, and upheld dismissal of constitutional informational-privacy claims premised on failure to secure data from hackers.


In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42 (D.C. Cir. 2019)