$115 million. 80 million class members. 120 lawsuits.
These three numbers capture only a small part of the story in Anthem, a multidistrict data breach litigation before Judge Lucy Koh in the Northern District of California. Last month, the Anthem parties agreed to settle all claims for $115 million a new record for data breach cases (by comparison, data breach cases against Target and Sony Pictures settled for $18 and $3 million, respectively).
The Anthem settlement appears to represent yet another watershed moment in data breach litigation. This is a still a relatively new and rapidly evolving field, but, as more and more of these cases are filed, several recurring battle lines have emerged through parties' arguments and judicial opinions. This article discusses two such issues standing and class certification. It also discusses the prospect of additional clarity in this area.
Standing
Data breach plaintiffs commonly allege two types of harm. First, plaintiffs allege an increased risk of identity theft, and seek compensation for out-of-pocket costs such as credit monitoring. Second, plaintiffs seek benefit of the bargain losses, claiming that they paid for but did not receive adequate data security. Under both theories, however, plaintiffs must show injury and causation to establish standing requirements which have, thus far, generally represented stumbling blocks for data breach litigants.
Increased Risk of Identity Theft
Many courts have dismissed cases where no plaintiff has suffered harm as a direct result of the breach, even if plaintiffs have paid out of pocket costs to protect themselves from possible injury. As the Fourth Circuit observed in Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), for merely "speculative threats," self-imposed costs "cannot confer standing."
The Seventh Circuit's decision in Remijas v. Neiman Marcus Group, 794 F.3d 688, 693 (7th Cir. 2015), however, bucked that trend. There, the court held that customers who had their personal information stolen "should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing, because there is an objectively reasonable likelihood that ... injury will occur." Unlike plaintiffs in Beck, however, the Remijas plaintiffs noted that 9,200 of the 350,000 customers at issue had already suffered some sort of fraud. This, in the court's view, made the threat of future harm imminent, rather than speculative.
Benefit of the Bargain Losses
Plaintiffs have also asserted a "benefit of the bargain" damages theory. In Resnick v. AvMed, 693 F.3d 1317, 1328 (11th Cir. 2012), for instance, the Eleventh Circuit denied dismissal where plaintiffs alleged (1) that "they conferred a monetary benefit ... in the form of monthly premiums," (2) that defendant claimed that he had used these premiums to "pay for ... data management and security," and (3) that defendant had "failed to implement ... measures ... mandated by industry standards."