Data Breach and Privacy Class Actions: New Lessons for Analyzing Standing, Webb v. Injured Workers Pharmacy

This CLE webinar will analyze the spectrum of intangible harms that may confer federal standing in data breach and privacy class actions and how courts decide if the alleged injury is concrete, applying lessons from Webb v. Injured Workers Pharmacy L.L.C. (1st Cir. June 30, 2023). The panel will consider three scenarios, beginning with what constitutes actual misuse of information and how courts decide if the misuse was plausibly related to the data breach. The panel will then discuss when the risk of future misuse becomes substantial enough to be "concrete," and what type of present harm the plaintiff must allege. Finally, the panel will take up whether exposure of personally identifying information is an intangible harm sufficient to confer standing and how courts are turning to traditional common law torts for guidance.

Courts wrestle with what, if anything, has to happen to personal information before a cause of action accrues and a plaintiff has standing to seek and ultimately obtain damages or injunctive relief in federal court.

Although courts seem to agree that actual misuse of data is a concrete harm, plaintiffs still must demonstrate a plausible connection between the misuse and the breach. The sufficiency of that connection is determined by (1) judicial experience and (2) common sense. The criteria get stricter as the case progresses, leaving both sides to guess as to the actual standard.

If there has been no actual misuse, plaintiffs may still proceed if there is a substantial risk of actual misuse coupled with some type of present loss. Again, courts have differing tests for what makes a risk substantial and what type of present loss is needed. If the bar is too low, companies may have to defend technical errors; if the bar is too high, consumers could lose the ability to correct serious wrongs.

The most difficult issue is whether exposure or disclosure of personal or confidential information, without more, is an intangible harm sufficient to confer standing. Courts often look for answers by examining how common law privacy torts were analyzed.

Listen as this experienced panel discusses intangible harms in data breach class actions and strategies for navigating evolving standards.