Class Action Dismissed Over Lack of Injury Raises Bar for Data Breach Suits

Phelps’ cross-practice team shielded an insured from prolonged litigation by securing a rare early dismissal with prejudice in a federal data breach class action. The firm leveraged its regional data privacy, cybersecurity insurance and litigation experience to argue claims stemming from a possible breach of personal identifying information (PII) lacked evidence of actual misuse or harm.

The district court's strict interpretation of "concrete injuries" in this case set a noteworthy precedent for what is required to establish standing in data breach lawsuits. The challenging nature of data breach cases has often hindered dismissal efforts and led to significant financial, reputational and operational costs for breached companies. The district court’s ruling reiterated that even in data breach litigation, actual harm must be demonstrated.

The district court dismissed all of the claims brought by the plaintiff, including negligence, invasion of privacy, and violation of the Illinois Consumer Fraud Act brought against a corporate investigative firm. In furtherance of his claims, the plaintiff alleged that the data breach caused emotional distress, increased risk of identity theft, and time lost mitigating potential impacts. The firm countered that these claims were speculative, and that there was no evidence of actual misuse of PII or financial losses directly tied to the breach. The district court agreed that the alleged injuries were not concrete and particularized enough to confer Article III standing, which requires an actual or imminent injury. It dismissed the claims against the company with prejudice.

Phelps partners Pablo Gonzalez, Walt Green, David Patrón, Mike Hooker, Jason Pill and associate Jesse Stewart secured the dismissal in a collaboration spanning multiple offices and practice areas.