## Facts

- Ceridian Corp. provided payroll processing services and maintained a computerized system containing employees’ personal and financial data, including names, addresses, Social Security numbers, dates of birth, and bank account information.
- An unknown hacker infiltrated Ceridian’s payroll system and potentially gained access to information relating to approximately 27,000 employees.
- It was unknown whether the hacker actually read, copied, understood, or misused any data.
- Ceridian notified potentially affected individuals that some personal information may have been illegally accessed and offered one year of credit monitoring and identity theft protection.
- The named plaintiffs alleged increased risk of identity theft, incurred expenses to monitor and protect credit, and suffered emotional distress.
- Plaintiffs filed a putative class action in the District of New Jersey; the district court dismissed for lack of Article III standing (and, alternatively, for failure to allege cognizable loss).
- Plaintiffs appealed; the Third Circuit addressed only standing and affirmed.

## Issues

1. Whether an increased risk of identity theft, credit-monitoring/mitigation expenses, and emotional distress, without allegations of actual misuse or known access to plaintiffs’ data, constitutes a concrete and imminent injury in fact sufficient for Article III standing.
2. Whether, if standing existed, plaintiffs adequately alleged cognizable damage or loss under their substantive claims (not reached).

## Decision

- The Third Circuit affirmed dismissal for lack of Article III standing.
- The court held plaintiffs alleged only speculative, future harm, not an injury that was actual or imminent.
- The court rejected credit-monitoring and related expenditures as a basis for standing where they were incurred to guard against a non-imminent risk.
- The court treated emotional distress as derivative of the same speculative threat and insufficient to establish injury in fact.
- Because standing was absent, the court did not address the merits of plaintiffs’ substantive causes of action.

## Legal Principles

- Article III standing requires an injury in fact that is concrete and particularized and actual or imminent, not conjectural or hypothetical.
- A claimed increased risk of identity theft from a data breach is insufficient where harm depends on a speculative chain of contingencies and there is no allegation of actual misuse or certainly impending misuse.
- A plaintiff cannot create standing by voluntarily incurring costs (e.g., credit monitoring) to mitigate a risk that is itself not actual or imminent.
- When injury in fact is not plausibly alleged, federal courts lack subject-matter jurisdiction and may not reach the merits.

## Conclusion

The Third Circuit held that a data breach, without known misuse or a non-speculative, imminent threat of misuse, does not confer Article III standing based on increased risk of identity theft, mitigation expenditures, or anxiety about future harm, and it affirmed dismissal on jurisdictional grounds.


Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011)