On January 20, the Third Circuit in In re Horizon Healthcare Services Data Breach Litigation reversed a district court's dismissal of a lawsuit under the Fair Credit Reporting Act involving a data breach at Horizon Healthcare. The Third Circuit held that the plaintiffs had standing to pursue their claims under the FCRA without any accompanying allegation that the breached data had, in fact, been misused. The Third Circuit's decision furthered a developing circuit split on the standard for Article III standing in FCRA data breach litigation.
In reversing and finding standing, the Third Circuit relied heavily on two recent decisions: In re Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016). The Third Circuit noted that "Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress's judgment, ought to remain private," and that "unauthorized disclosures of information have long been seen as injurious." On that basis, the court held that the plaintiffs did not assert a mere "technical" violation of the FCRA. The court summarized its ruling as follows: "In light of the congressional decision to create a remedy for the unauthorized transfer of personal information, a violation of FCRA gives rise to an injury sufficient for Article III standing purposes." The Court held that the Supreme Court's May 2016 decision in Spokeo, Inc. v. Robins did not alter this standing jurisprudence.
The majority was joined by a concurring opinion that based its analysis upon the alleged invasion of privacy and not on the statutory violation. The concurrence stated that "[t]he intangible harm from the loss of privacy appears to have sufficient historical roots to satisfy the requirement that plaintiffs have alleged a sufficiently concrete harm for standing purposes." In so holding, the concurrence invoked common law principles of standing with respect to tort claims implicating invasions of privacy.
This decision from the Third Circuit continues the divergence of decisions regarding Article III standing for data breach claims under the FCRA, with some courts holding that actual third-party use of the disclosed information is required to establish concrete injury. It also demonstrates that the same circuit courts that take pro-defendant positions on substantive issues under the FCRA (such as the Third Circuit's leading pro-defense "willfulness" holding in Fuges v. Southwest Financial Services, Ltd., 707 F.3d 241 (3d Cir. 2012)) can also assume a more liberal position on Article III standing.
We will continue to monitor FCRA data breach decisions and courts addressing the requirements for Article III standing under the FCRA in light of the Spokeo decision.
The Troutman Sanders' Consumer Financial Services Law Monitor blog offers timely updates regarding the financial services industry to inform you of recent changes in the law, upcoming regulatory deadlines and significant judicial opinions that may impact your business. To view the blog, click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
